Comment by marcuspovey

At home, and everywhere I've had a say on how the network is laid out during working hours, I treat wifi as external. They get internet access, and there's a password to prevent the neighbours kids downloading GBs of pr0n, access to internal resources require connection over the vpn.

This has the side benefit that all my devices can connect securely to home resources wherever I am in the world.