The UniFi gear I actually run

This is the box every VLAN and WireGuard video is recorded on. The built-in controller means there is no separate Cloud Key to power or update, and the 10G interfaces give you headroom most home labs never actually hit. If you are under roughly 50 devices and want one device that routes, runs the controller and terminates the VPN, this is where I would start.

Check price on Amazon

A managed switch is where VLANs stop being theory. The Pro Max line gives you 2.5G access ports plus SFP+ uplinks, so you can trunk back to the gateway without a bottleneck and still hand PoE to cameras and APs. Sixteen ports is the size I keep recommending because people always underestimate how fast ports disappear.

Check price on Amazon

My default access point. Wi-Fi 7, a 2.5G PoE uplink so the AP is not the slow link, and it stays wired rather than dropping into mesh, which is where most "bad Wi-Fi" complaints actually come from. One per floor is the rule of thumb I use before anyone reaches for a second.

Check price on Amazon

The little switch I drop behind a desk or a TV to break out a VLAN without running another cable back to the rack. Managed, so it still respects your tags. It is the cheapest way to stop yourself from collapsing VLANs just because you ran out of ports in one room.

Check price on Amazon

The cheap part everyone forgets. If your WAN handoff or an uplink is RJ45 rather than fiber, you need a copper SFP+ module to land it in the gateway or switch. Worth buying before you need it, because a missing transceiver is the reason a link sits dark on install day.

Check price on Amazon