This is how the networks can be set up. Notice that one network is for VPN. That way, I can still remotely access and control devices that only work on my local network, and do not touch the internet. The VPN brings me in, behind the router. The onboard firewall then allows me, and only me, to access devices on the various other networks. This is also useful when I'm out and about. If I'm at Starbucks or something, I'm using MY network, not theirs. Devices on their Network cannot see my traffic.