Smart TVs aren’t harmless displays: the moment they sit on a flat home network they spin up a full discovery stack and, in the worst case, can map your entire LAN. Here is how to properly lock down an LG webOS TV (or Samsung Tizen, Google TV, Roku & co.) with UniFi – VLAN, Layer-2 isolation, firewall zones and optional DNS control.
The trigger was a widely shared video showing how aggressively current LG TVs scan the local network. The approach below is deliberately simple and takes just a few steps with a zone-based UniFi configuration.
Why smart TVs are a network risk
A modern TV does not behave passively on the network. It sends ARP sweeps, mDNS, SSDP and DLNA requests, broadcast probes, plus fallback and sometimes encrypted DNS queries. That lets it discover other devices, detect services and build a profile of your home network. This is not just LG webOS – it applies to virtually every platform, including Samsung Tizen, Google TV, Amazon Fire TV and Roku.
1. The TV goes on a dedicated IoT VLAN
The foundation is a dedicated VLAN for untrusted devices – TVs, cameras, smart appliances. Crucially, no trusted devices (PCs, NAS, phones) live here. That contains the blast radius even if a device is compromised.
2. Wi-Fi AP: Layer-2 isolation is the strongest lever
Most of the probing happens at Layer 2, which makes the access point the most effective choke-point. UniFi offers slightly different controls depending on the AP generation, so check whether your AP is from the WiFi 5 or the WiFi 6/7 line.
WiFi 5 APs (UAP-AC series)
Strict, predictable isolation – ideal for an IoT SSID. Recommended toggles:
- Client Device Isolation → ON
- Block LAN to WLAN Multicast/Broadcast → ON
- Multicast Enhancement → OFF
- Proxy ARP → ON
WiFi 6/7 APs (U6/U7 series)
Somewhat „smarter“ behaviour, but it isolates just as reliably with the right tuning. Recommended toggles:
- Client Device Isolation → ON
- Multicast Enhancement → ON
- Block LAN to WLAN Multicast/Broadcast → ON
- Proxy ARP → ON
The effect
- LG can no longer ARP-scan
- LG cannot see other IoT devices
- LG cannot see trusted devices
- LG receives no mDNS/SSDP/DLNA
- LG cannot fingerprint your LAN
In the end the TV can only „see“ the access point – nothing else.
3. Firewall: block IoT → all internal zones (Layer 3)
While AP isolation covers Layer 2, the zone-based firewall locks down the Layer-3 protocols. In a zone-based setup it is „block by default“ – you just place each VLAN in the correct zone. The IoT VLAN is then blocked from reaching:
- trusted networks
- management networks
- the router’s admin interface
- guest networks
- the DMZ
- VPN networks
- other IoT devices (already covered by AP isolation)
That cuts the TV off from everything – except the Internet.
4. Allow IoT → Internet
Outbound Internet access stays open. I deliberately don’t restrict ports or cloud endpoints here – it keeps the setup low-maintenance. If you want to go stricter you can block individual destinations, but that needs more upkeep.
5. Optional: DNS control
As a finishing touch I point the IoT VLAN’s DNS traffic to a controlled resolver – such as Pi-hole, AdGuard Home or Unbound. That lets you log the TV’s domain lookups, block obvious telemetry domains and sinkhole advertising endpoints.
You’ll find curated blocklists for exactly this purpose in our overview: DNS blocklists on netguide.io/de/lists. Add the lists to Pi-hole or AdGuard and the resolver sinkholes tracking and telemetry domains automatically.
To be honest: DNS blocking is a cat-and-mouse game, because domains change and some devices fall back to hard-coded resolvers or DoH. As an extra layer of control and transparency it is still worthwhile – especially combined with forcibly redirecting DNS as above.
The result
- The TV cannot scan the LAN
- The TV reaches no internal zones
- The TV cannot reach the router
- The TV sees no other devices
- The TV can reach only the Internet
- DNS filtering adds optional extra control
Apple TV as the „safe“ streaming device
For the actual streaming I use an Apple TV: far less intrusive, no always-on microphone and predictable behaviour. That turns the LG panel into basically just a display – exactly what I want.
TL;DR
Smart TVs probe your network. I isolate mine like this:
- put it on an IoT VLAN
- enable Layer-2 isolation on the AP (WiFi 5 / WiFi 6/7 toggles above)
- block IoT → all internal zones with the firewall (Layer 3)
- allow only IoT → Internet
- optionally filter DNS (blocklists)
- use Apple TV as the „safe“ streaming platform
FAQ
Why does my TV scan the network at all?
Smart TVs look for media servers (DLNA), casting targets and other devices to offer features like screen sharing or multiroom – and in doing so often gather more information than playback alone requires.
Isn’t a guest Wi-Fi enough?
A guest network often isolates clients from each other, but it is designed for captive-portal setups and gives you no clean zone and firewall control. A dedicated IoT VLAN with a zone-based firewall is the more robust solution.
Do I strictly need UniFi?
No. The principle – VLAN, client isolation at the AP, Layer-3 firewall rules, controlled DNS – works just as well with OPNsense/pfSense, MikroTik or OpenWrt. UniFi just makes it especially clear.
Does DNS filtering block tracking completely?
No. DNS filtering noticeably reduces telemetry and ads, but it is not a cure-all: devices can fall back to hard-coded IPs or encrypted DNS. That is why network isolation (VLAN + firewall) is the real foundation, with DNS as the bonus.
Note: I’m not a network guru – this is simply a setup that works well for me. Your environment, devices and requirements may differ, so adjust the steps as needed. Suggestions and improvements are welcome.