that is a preconfigured or centrally managed firewall. Ubiquiti (and many others) sell that kind of product, it’s a common Enterprise need.
They cost money, of course.
They cost money, of course.
I want the protected device to be on its own subnet with no plain IP packets passed through. It gets access through an authenticating proxy (speaking TCP and maybe UDP) and maybe through a VPN specific to that device.
Conventional network gear can fudge this by putting each protected device on its own VLAN. This does not scale. It’s also vulnerable to anyone who compromises basically any network device with access to a trunk port.
I would expect my device to be considerably more expensive per port than UniFi. (A VLAN capable UniFi switch port costs about $10.)
There would be no VLAN, just plug the protected device directly into the firewall’s ‘LAN’ port.
A VPN is just a network level proxy for all traffic (roughly speaking), modulo firewall rules.
I’ve done this before. It isn’t even particularly hard to do, assuming the VPN provisioning isn’t a nightmare.
It could be made easier/more commodity of course. I guess we’d need some IoT logic and an app? (Cringes inside)
None of what you just said is particularly relevant to the original statement.
I don't think any goalposts have moved.
Or be actually as secure?
I’m just pointing out these things already exist. You can buy and configure them right now.
At first you seemed to deny it, then it’s ’too hard’? Then ‘oh, but what about feature x or y’?
Pick a lane.