I have a separate network for the kids that only allows specific IPs through. They are pretty young though so mostly to let updates through.