>Buys new AP to cover a deadspot when going from attic to bedroom.
>Moves old AP from attic to bedroom.
>Installs new AP.
>Phone: *proceeds to ignore the existence of the 5GHz channels*
>*sigh*

(this is just my phone being stupid btw, it is known to be stupid)

So the new AP has wireless reception so good... My phone doesn't want to roam.  

Yes, @mikrotik's new hAP AX S's signal is so good, my phone just doesn't bother to roam.
Even standing in the kitchen (2 floors down, each floor being a slabs of concrete) I still get ~60%.

If you want to buy a single AP to cover most of the house... I think I can give this bugger quite a good recommendation.

@finlaydag33k @mikrotik Didn't start looking yet, but one wish for this year is a separate accesspoint for IoT applications and then a separate network for cameras too.
So, will have a look at this one.

For the home network there are two older routers in IP-sharing mode as repeaters, also for a few old POTS phones on the VoIP.

@AngelaScholder Why not use VLANs instead?

@mikrotik

@finlaydag33k It would be a VLAN indeed, but I will need a WLAN access point as at least a lot of it is wireless.
And as it is from the front of the home to in the garage behind it it will probably have to be two access points.

Where possible it's all wired.

@mikrotik

@AngelaScholder If you go with MikroTik, you can use 1 AP to provide multiple SSIDs, which you can use for specific VLANs.

Over here, an AP has 4 networks:
- The main network (which puts the device in a VLAN based on the user that's logged in via RADIUS - My devices get put in VLAN1001, my parents get put in VLAN1002).
- IoT network (VLAN1005).
- Guest network (VLAN1004).
- Open network with OWE (VLAN1006 - Which I turn on if we expect a lot of guests).

So luckily no need to use 2 APs for 2 "different types of devices" (just to "extend the range").

@mikrotik

@finlaydag33k @AngelaScholder @mikrotik Can confirm: this is very similar to my setup with various VLANs mapped to specific SSIDs present on both 2.4 and 5Ghz for separation of IOT, LAN etc

@erik Only real reason I have the IOT VLAN done as an SSID (instead of through RADIUS), is because many IOT and other consumer devices (like say, my Nintendo Switch and Printer) don't support WPA(2/3)-EAP. :')

@AngelaScholder @mikrotik

@finlaydag33k @AngelaScholder @mikrotik Agreed - my IOT network is also filtered so that compromised devices on that network can’t reach out to the regular LAN. In the process of slowly identifying and filtering external comms from this network on the firewall so that compromised devices can’t reach out to C2

@erik Yea, it's also filtered here.
Some IoT devices can reach out in certain cases but it's highly restricted and "disallowed by default".
I don't trust IoT devices because they are meant to be cheap, not secure.

@AngelaScholder @mikrotik