Vlans

[pokibalboa]

Hi, I am trying to segregate my home network for two weeks now and its just beyond me, i need help.
So the thing is I have a ISP modem in the basement connected to OPNSense box, which is my main router. I have 5 ETH ports (1 is for wan and 4 are connected to my main mikrotik switch).
From OPNsense lan goes to my main switch (mikrotik SwOS) and then to 1 floor (eap615), ground floor (mikrotik RouterOS AP and from here one cable goes to the office), server (media/nas), workshop (unmanaged switch, ap and pc).

So what I would like to do is:
- 1 network for the office, from which you could not get to any other networks
- 1 network for 1 floor:
      - here I have Tp-Link EAP615 AP, on one eth port i have my pc on the other a TV, I would like to have 2 WIFI, one for IOT and one for laptops)
- 1 network for ground floor
      - Here i have Mikrotik RouterOS router as an AP. One eth port goes to the office area, others are for ground floor. I would also like to have 2 WIFI, 1 for IOT and 1 for guests. (I would like to config it so you cannot access any other network from this one)
-  There is a server/NAS conected to the switch (It needs to see other networks except the office area)

So i would like to have IOT vlan which could go to internet but not to my other networks. Since i have plex and home assistant on my server, IOT vlan should communicate with those two apps but nothing more.
On my first floor wifi IOT and 2eth from eap615 should be only IOT VLAN, wifi XY and 1eth should only be  VLAN 2.
On my ground floor  wifi IOT should be on IOT VLAN, XX wifi and other ETH ports on the switch should be their own VLAN, except the one that goes to the office and the one that goes to downstairs TV.
Im including the picture of my network.

[Demusman]

First thing I see is an unmanaged workshop switch with 2 vlans on it... how to you plan on doing that??

[pokibalboa]

I'll buy a managed switch when I'll need it, for now it's OK that workshop is on the same network as my main pc, so vlan2 is that even possible?
Main thing for now is to segregate home and office network and in home network to have IOT network for all the iot devices