VPN-only home segment: kill the fallback, not just the SSID

You put the guest SSID on the VPN and call the segment VPN-only. Then the tunnel drops for two minutes and the devices quietly return to the ordinary WAN. Nothing in the SSID name prevented that. A VPN-only segment is defined by what happens when the tunnel is unavailable, not by the network's label.

The label is a promise; the fallback policy is the enforcement.

Myth: the SSID is the boundary

An SSID without its own forwarding policy is just a name. The boundary is a separate interface, VLAN or subnet, with its own DHCP scope and its own rules. A VLAN gives you a forwarding boundary that a Wi-Fi name cannot.

Client isolation belongs in the design too. Two devices on the segment may need to talk to each other, or they may not, and that choice should be explicit rather than inherited from a guest profile.

Write the segment's interface and address range down before you write a single rule. That one line prevents most of the later confusion.

Myth: the tunnel route covers every protocol

Apply the firmware's policy to that segment so its internet-bound traffic uses the tunnel. Configure the remote forwarding and translation the tunnel requires. Keep only the local resource access the segment actually needs.

Check both address families. If IPv6 is not carried through the tunnel, the policy has to handle it, or an IPv6-capable device will find a direct route you did not intend.

An IPv4-only kill switch with IPv6 enabled is a common way to leak. Test with an IPv6-capable client, not only with the laptop you have at hand.

Myth: DNS and the tunnel endpoint follow the tunnel

Router DNS can be generated locally and follow the router's own routing table, not the segment's policy. Decide which path that resolver should use and what it does when the tunnel fails. The VPN's own endpoint connection is another exception: it needs the documented outer route to the peer. Route that connection into the tunnel and it cannot come up.

Keep recovery administration separate from the segment's internet access. If a failed peer also locks you out of the router, you have turned a tunnel outage into a site visit. Keep that access on a management network, not on the VPN-only segment.

What actually makes it VPN-only

Block ordinary WAN forwarding for the segment whenever the tunnel is down. That rule, not the SSID, is what makes the label true. Test it with harmless traffic from a segment device.

Run three checks: normal operation through the tunnel, the permitted failure test with the tunnel down, and recovery when it returns. Confirm that another household segment keeps its own intended route throughout. Keep any direct exceptions documented, or the label hides paths you no longer remember.

A short record of the segment, the selected tunnel and the exceptions gives you specific checks after a firmware update changes rule order or resolver behavior. The pfSense WireGuard client recipe is a useful reference for the tunnel side, not a substitute for the segment policy.