Segment based on usage, a decent switch kan handle around 4k VLAN.

• users (Ethernet)
• users (wlan)
• iot
• cameras
• servers
• storage
• media devices
• phones
• printers
• guests

If you can enable client isolation on WiFi, port protection/isolation on Ethernet and start using 802.1x for network auth… then you are off to a pretty decent start in case of a vendor bug, misconfiguration or some curious individual

A switch can pass VLAN tagged packets through it even if it doesn’t understand VLANS itself.

The switch only has to be VLAN aware if you want the switch port itself to assign the VLAN tag.

As long as you’re access point is capable of VLAN tagging, that should be sufficient for your scenario. Some access points like ubiquity can handle multiple SSIDs with different VLANs. If your device supports it then it should be fine

A managed switch will make your life easier, but it’s optional. Especially if the hardware you’re going to plug into the switch can do its own VLAN management like Linux

Depending on your threat model, you might require the switch itself to be vlan aware so that sensitively tagged packets are not exposed physically to untrusted devices.

If you’re choosing your switch, how many devices do you want to plug into it, how many devices might you grow into in the future, what throughput requirements do you have, do you want manager unmanaged, does it need to be able to deliver POE? The more things you say yes to you the more expensive the switch

Depending on how much you want to learn, vs things just working: Most Learning - A linux machine with a bunch of ethernet ports (you can get 4x/8x ethernet pcie cards dirt cheap now) do everything for your switch in linux. The most reliable and hands off “it just works” - A unifi managed switch.

Not stupid questions at all.

can I do this all with a single switch?

You could technically do all of this on a cheap WiFi router running dd-wrt firmware. VLANs on ports, multiple WiFi SSIDs, the whole thing. I have. But it is all hacky finicky configuration that is annoying to do, and I will never do it that way again. There is something to be said for owning and using products that “just work”, especially if you have a family that relies on your network and network services being stable.

To answer your question directly, you can do everything VLAN related except the WiFi portion on one wired switch, but you are going to need a router to do anything meaningful with those VLANs.

Do I need a separate access points for each VLAN or can I have multiple vLANs on a single AP?

One AP can serve multiple SSIDs, and can map them each to a particular VLAN. The ability to do this depends on the Access Point.

How many ports should I be looking at on my switch? Would four be enough for my set-up?

Definitely definitely definitely get more than you think you need. You are already doing cool stuff, and will likely add more of it over time as you gather more ideas and experiments. I wouldn’t do less than 10 ports in your case. Nothing is more annoying than running out of ports capable of VLANing and having to upgrade the gear and redo the configuration on a new device. Your time has value, and IMO it is more expensive than just spending a few more bucks on the right gear that is nice to configure and just works.

Also managed is best right?

Absolutely yes. The term managed is going to have different meanings depending on the age of the gear and the “level” of the gear though. An old Cisco switch would be the traditional definition of managed. New ubiquiti gear with its software defined networking would be managed also. Hacking around with the config on a dd-wrt router would be considered “managed” too, in my book. You can’t really achieve VLANs without some way to configure them, and management is that configuration method, when you boil it down.

There is more stuff you need to think about, like how to route between your VLANs, and the filtering you will want to apply to that routing for security reasons. You are going to need a router, and picking one that is right for you is probably going to be the trickiest thing, because you seem like the type that isn’t going to be afraid to do more complex things over time, while also keeping budget in mind.

I’ll cut to the chase. I have the network you are trying to do, and I’ll tell you the gear I’ve settled on, for your reference. I recommend it, but of course I am biased, so really just use this as a reference and make your own decision. I’ve had all kinds of gear over 2 decades, and built and worked on enterprise networks of all kinds, and this is what I’ve settled on for me as good enough for the kind of stuff you and I are into.

I have a 10 port ubiquiti gigabit managed switch with a handful of PoE ports. It’s got PoE to power a (now lightly outdated) ubiquiti WAP. The WAP and switch are configured by a piece of software from ubiquiti I run on a computer (it can run on a pi, do monitoring and all kinds of cool stuff, but I don’t bother because I just use it occasionally to change config here and there). The software lets me config VLANs on the switch and WAP, which also lets me plop WiFi SSIDs on those VLANs. I have multiple separate WiFi SSIDs served from the single WAP; one for guests, another one for home automation and WiFi cameras, another for everything else.

My router is a pfSense that I built from gear from pcEngines, because the official pfSense gear is 3 times the price, and the affordable hardware of theirs is not the most reliable. I chose pfSense because it is a good balance between cheap, and does almost any networking thing possible while being easy enough to achieve it. Updates are also free, which is a big deal. You could pay through the nose to get the simplicity of a ubiquity router, and it still not be able to do everything you want to do that you could with a pfSense. That said, the ubiquity does a lot with ease, you just pay a premium for that convenience. If you like to learn and tinker, I recommend pfSense, because it’s easy enough to mostly point and click, but it doesn’t stop you from making something really intricate just the way you want, if you like. It’s a BSD box under the hood, after all.

Anyway, long story short, my router lets me reach my WiFi cameras and home automation gear that are on their own isolation VLANs from my main VLAN, but those cameras and stuff can’t reach back into my main VLAN nor reach the Internet because of the filtering rules I’ve defined on the router.

You will probably have more questions now. Never fear though, this stuff is doable.