I finally built the IoT VLAN I'd been putting off for a year: a walled-off network for all the chatty, phone-home gadgets — the camera, the robot vacuum, the smart bulbs, a wall tablet — so that if one of them ever gets compromised, it's trapped in a sealed room and can't wander over to my NAS or my hypervisors. Every device moved across in minutes. Every device except the dishwasher, which took two sessions and taught me that network segmentation and cloud appliances have fundamentally incompatible ideas about the word "home".
Why the dishwasher even cares about the network
It's a Siemens on Home Connect — the app on your phone, the appliance on your WiFi, a cloud in between so you can start a wash from the tram. To move it onto the new VLAN, it has to join a different WiFi network: the IoT SSID instead of the main one. Simple in theory. You tell the appliance the new network's name and password, it hops over, done.
The first attempt, a few days earlier, just... didn't. I re-paired it, the panel threw an error, and it quietly reconnected to the old network as if nothing had happened. The tell was in the access-point logs: zero authentication attempts on the IoT network. Not one.
A client that never appears in the WiFi logs isn't being rejected. It never tried. Which means it was never actually pointed at the network in the first place.
That single observation rules out an enormous amount of debugging. It's not the password, not an encryption mismatch, not a DHCP problem, not a band issue — because none of those had a chance to happen. The dishwasher was never told to join the new network at all. So the question was never "why won't it connect?" It was "why won't the app send it the new network?"
The gate: "you are not at home"
Here's the collision. To change the WiFi on an already-paired Home Connect appliance, the app requires you to be "home" — by which it means it can reach the appliance locally, on the same network. It's a reasonable safety rule: don't let someone repoint your dishwasher's WiFi from the far side of the planet.
But my phone was on the IoT VLAN (where I was trying to send the dishwasher), and the dishwasher was still on the trusted LAN. And those two networks cannot reach each other — that separation is the entire point of the VLAN. So the app tried to find the dishwasher locally, couldn't, decided I was "away", and locked the settings I needed. The isolation I'd carefully built to protect the network was now standing between me and the device it was isolating. It cannot tell the difference between "the owner configuring the dishwasher" and "the dishwasher trying to talk to something it shouldn't" — from the firewall's point of view, those are the same forbidden packet.
Getting back "home"
The fix, once I saw it, was almost funny in how backwards it felt: to change a device's network, put your phone on the network the device is on right now — not the one you're moving it to. So I moved my phone back to the trusted LAN, alongside the dishwasher. Now the app could reach it locally.
Except it still insisted I was away. The app had cached the "away" verdict and wasn't re-checking. A full force-stop and reopen cleared it, and — finally — it saw the dishwasher, saw me as "home", and unlocked. Even then, the in-app "change network" option stayed greyed; the real path was to trigger a fresh pairing from the appliance's own panel, at which point the app's setup flow reappears and lets you choose a target network.
Then came the parade of small papercuts, each of which would have derailed the whole thing on its own:
- A band change nobody mentioned. The dishwasher had been on 5 GHz; my IoT SSID is 2.4 GHz only (deliberately — it's where cheap IoT radios are happiest). It's dual-band, so it can do 2.4, but you have to pick the right SSID and not assume it'll follow you down.
- A demand for a static IP. The setup screen asked me to type in an IP, gateway and DNS. Ignore it — pick DHCP/automatic and let the router hand it the reserved address it already has waiting.
- An "IPv6 broadcast" toggle that had me chasing my tail for ten minutes before I remembered my LAN is IPv4-only. On a network with no IPv6 at all, the setting does precisely nothing. Leave it and walk away.
It moved
And then it just worked. The dishwasher associated to the IoT network — this time the logs lit up with a real, successful join — pulled its reserved address on the new VLAN, and reconnected to the Home Connect cloud within seconds. Home Assistant never noticed a thing, because Home Connect is a cloud integration: it reaches the appliance through the internet, not the LAN, so it doesn't care one bit which VLAN the dishwasher lives on. The single most stubborn device in the apartment was finally in its sealed room.
The lesson
Three things I'm keeping. First: network segmentation is a security win, not a stability one, and it will actively fight your management tools. The moment you wall off a device, anything that used to reach it locally — including your own phone app — is now on the wrong side of a firewall that can't read intent. Plan for the management path, not just the device.
Second: cloud appliances have their own definition of "home", and it's about local reachability, which is exactly what a VLAN removes. The rule of thumb I earned the hard way — to reconfigure a device's network, your phone has to be on the network it's on now, not the one you're sending it to.
And third, the debugging one, which is really the whole post in a sentence: a device that never appears in the logs was never pointed at the network. When something "won't connect", check whether it's being rejected or whether it never tried — because those two failures live in completely different places, and only one of them is on the network.
Comments