--- title: How to set up VLANs on a UniFi network description: "A practical walkthrough of VLANs on UniFi: planning the segments, creating the networks, tagging Wi-Fi and switch ports, and firewalling between them." date: 2026-08-28 updated: 2026-08-30 tags: [how-to, unifi, networking] url: "https://joshdargie.com/blog/unifi-vlan-setup-guide" author: Josh Dargie --- This is the first of my How To Friday posts: hands-on walkthroughs of jobs I do all the time, written so you can do them yourself. First up is the one I get asked about most, splitting a UniFi network into VLANs. VLANs are how you stop your cameras, your smart plugs, your point-of-sale terminal and your guests from all sitting on the same network as your laptop and your file server. One flat network was fine in 2010. It is not fine now, and if you run a business it may also be a compliance problem. A note on versions before we start: I wrote and tested this against a current UniFi Network application. Ubiquiti moves menu items around between releases, so treat the paths below as "where it usually lives" and the concepts as the part that does not change. ## Plan the segments first Do not open the controller yet. Decide on paper what belongs together. For most homes and small businesses I end up with some version of this: * **Main** (VLAN 1, the default): your trusted computers and servers. * **IoT** (VLAN 20): smart plugs, TVs, speakers, thermostats. Devices you do not fully trust. * **Cameras** (VLAN 30): NVR and cameras, ideally with no internet access at all. * **Guest** (VLAN 40): visitors' phones. Internet only, nothing else. * **Work** (VLAN 50, business only): POS, payment terminals, or anything a regulation cares about. Fewer is better. Every segment you add is a segment you have to firewall, troubleshoot and remember. Three or four covers almost everyone. Write down the VLAN ID and an address range for each, for example 10.0.20.0/24 for VLAN 20. Keeping the third octet equal to the VLAN ID will save you squinting at logs later. ## Create the networks In the UniFi Network application, go to Settings, then Networks, and create a new virtual network for each segment on your list. Give it the name and VLAN ID you planned. Let UniFi handle DHCP for each network unless you have a reason not to. Two settings worth attention while you are in here: * **Isolation.** Newer versions offer a per-network isolation toggle and zone-based firewalling. Turning isolation on for IoT, Cameras and Guest gets you a sane default (devices can reach the internet but not your other networks) before you write a single rule. * **mDNS.** If you want to cast to a TV on the IoT network from a phone on Main, enable multicast DNS between those two networks. This is the setting people miss, and it is why "casting broke after I added VLANs" is such a common complaint. ## Tag the Wi-Fi Go to Settings, then WiFi, and either create a new SSID per segment or, better, keep two or three SSIDs total: one for Main, one for IoT, one for Guest. Each SSID gets its network set to the VLAN you created. Broadcasting six SSIDs costs airtime; most sites should not. Wired devices are handled at the switch instead: open the port the device plugs into and set its port profile to the right network. A camera port gets the Cameras profile. An access point port stays on All, because the AP needs to carry every VLAN. ## Firewall between segments Isolation toggles get you most of the way. Where you need finer control (say, your laptop on Main should reach the NVR on Cameras, but the cameras should never reach anything), you write firewall rules or zone policies: * Allow established and related traffic back in, so replies work. * Allow Main to reach IoT and Cameras. * Block IoT and Cameras from reaching Main, and block Cameras from the internet entirely if your NVR is local. * Guest should already be internet-only if you used the guest network type. The order of rules matters: allow rules go above the blocks they punch through. ## Test it like you mean it Do not declare victory from the couch. Join each network with a phone or laptop and actually try things: can Guest see your NAS (it should not), can Main reach the NVR (it should), does casting still work, does the payment terminal still process. Five minutes of testing beats a week of "the printer disappeared" tickets. If something cannot reach something it should, check the port profile first, then the firewall rule order. Those two cover ninety percent of VLAN problems I get called about. ## Where this gets harder Multi-site networks, VoIP with its own QoS, cameras that need cloud access sometimes, a server that must straddle two segments: this is the point where the flowchart stops fitting in a blog post. That judgment call, what is worth segmenting and what is over-engineering for your situation, is exactly the kind of thing I help people with. If you are staring at a half-planned network and want a second opinion before you commit, [that is an hour well spent](/hire#second-opinion).