This seems really nice! May I ask how you set it up? Is it a question of configuring routing, a firewall, or both? Does it matter if you have separate or a shared subnet?
I have some router with Shibby Tomato laying around (DD-WRT is unsupported), but I'm not sure if I need some other hardware, software, or if it's just a matter of finding the right settings…
My main control device is a VM running Home Assistant, so the underlying system (Hue and TRÅDFRI mainly) doesn't really matter much.
[0] Mostly. There's a port open for one device to do HTTP POSTs of data to one machine on the main network. MQTT is also open so that my ESP32/ESP8266 stuff can push data to the broker.