Hello! 

So, I am the head tenant of a flat. I work in networking (Fixed line broadband, and complex hardware troubleshooting) but I want to get some input on the way to go here. My current flatmates aren't as conscious and networking-minded as I am, so I don't want them doing something dodgy on the network and somehow getting all devices infected, albeit with a firewall in place and other steps to stop them from visiting a website that may distribute malware.

I'm just wondering about recommendations, I currently have a TP-Link ER605 (5 Port Wired Router, 1x WAN, 4x LAN) with OpenWrt flashed on it, LAN1 and LAN2 are run to APs and LAN3 is just run to the TV. I was thinking of chucking all their devices on AP1 and all mine and my partners on AP2 (There will be negligible Wi-Fi hindrance due to the size of the house and quality of the APs) and separating via different Subnets. However, I am first wondering if setting VLANs or a different subnet is better.

Suggestions welcomed!