MQTT on subnet or how to make more secure the embeded MQTT?

Configuration
1

Can I put MQTT into subnet or different WIFI than HA for security reasons?

Or how to secure embeded MQTT?

2

Set a username / password
Don’t use the default port

3

Are you exposing your broker to the internet?

4

No, HA isn’t exposed outside.

5

Then your only threat is people who have already gained illegitimate access to your network. If that has happened, then you have already lost :sob: and any additional measures to your mqtt are just going to be an inconvenience to you, not your attacker.

You should, of course, keep any guests on a separate wifi network, but that is just standard security.