This type of routing would make sense when there is a possibility of WiFi password being compromised due to a loss of one or more of IoT sensors - i.e. Smart Garden sensor taken by a wild animal or simply stolen.



"Smart Home" subnet can only access IAoT server on a "Home" network. It has no access to any other computer on a "Home" network, nor it can access WAN interface on pfSense box. "Smart Home" can not be accessed from the Internet either.

At the same time IAoT Server after processing raw data from the "Smart Home" sensors can be accessed from "Home" network as well as from the Internet.
When raw data arrives at IAoT server it is processed in a strict manner allowing only specific data to be processed so forged data if accepted would not do any harm to the server and/or network.There's no place like ~