UniFi VLAN Setup Guide: Segment Your Network the Right Way

This UniFi VLAN setup guide walks through every configuration step from network creation to verified isolation: defining your VLAN plan, creating virtual networks in the controller, assigning trunk and access ports on UniFi switches, mapping SSIDs to VLANs, writing firewall rules that actually block cross-segment traffic, and enabling mDNS reflection so IoT devices remain discoverable. The goal is a working segmented network, not a partial one that looks right in the dashboard but passes traffic it shouldn’t.

Plan Your VLAN Schema First

Configuring VLANs without a written plan leads to VLAN ID collisions, overlapping subnets, and firewall rules that reference the wrong network. Spend ten minutes on paper before touching the controller.

A practical three-VLAN schema for a home or small-office UniFi deployment:

VLAN ID	Name	CIDR	Gateway	Inter-VLAN policy
1	Default	192.168.1.0/24	192.168.1.1	Full access (trusted)
10	IoT	192.168.10.0/24	192.168.10.1	Deny all except WAN
20	Guest	192.168.20.0/24	192.168.20.1	Internet only, deny LAN

Align your VLAN IDs with the third octet of the subnet — VLAN 10 maps to 192.168.10.0/24, VLAN 20 to 192.168.20.0/24. This makes firewall rules readable without a lookup table and catches typos at a glance.

Reserve VLAN 1 for trusted, managed clients and network infrastructure. Keep your UDM Pro, USW-Pro-24-PoE, and U6-Enterprise access points on the Default network so management traffic never crosses a VLAN boundary. IoT devices — thermostats, cameras, smart bulbs, anything that runs firmware you don’t control — belong on VLAN 10. Guest wireless goes on VLAN 20 with no route to any internal segment.

Add a separate Cameras VLAN when its access policy differs from other IoT devices. Permit only the camera-to-recorder services the deployment needs and the administrator’s approved path to the recorder. The Protect storage and recording guide covers the recording side of that plan.

Roll out Trusted and Guest first, then move one IoT device and verify its permitted services. Add cameras and other exceptions only after the simpler policy works. Keep a management connection available throughout, and record each exception’s source, destination, service, and reason.

Creating Virtual Networks in UniFi Network

Ubiquiti’s official documentation describes the process from the controller side. The path is the same whether you are running UniFi Network on a UDM Pro, a Cloud Gateway Ultra, or a self-hosted controller:

1. Navigate to Settings > Networks.
2. Click Create New Network.
3. Set the Network Name, such as “IoT”, and select the gateway that will route it.
4. Set the VLAN ID, subnet, and gateway address from your plan.
5. Configure DHCP and DNS for that network, avoiding conflicts with existing reservations.
6. Review isolation settings and apply the changes.

For a third-party router, create the VLAN interface, subnet, and DHCP service on that router first. In UniFi, select Third-party Gateway and match its VLAN ID. Hosting the Network application on a computer does not turn that computer into the VLAN router.

Repeat for each VLAN. On a UniFi gateway, these settings define the routed network and its DHCP service. Review the effective firewall policy separately; naming a network “Guest” does not establish its isolation.

Switch Port VLAN Assignment: Trunk and Access Ports

Once your virtual networks exist, you need to assign them to physical switch ports. UniFi’s port profile system maps directly to 802.1Q tagging concepts, though the UI uses different terms.

Ubiquiti’s switch port documentation defines two modes:

Trunk port (Allow All): The default for every port. Tagged frames for all VLANs pass through. Use this on uplink ports between switches and on ports connected to access points — the U6-Enterprise handles VLAN tagging per SSID and needs tagged frames for every network it serves.

Access port (Native Network only): Assigns a port to a single VLAN. End devices plugged into this port receive untagged frames and are placed in the specified VLAN. Correct for a Philips Hue bridge, a smart TV, or a game console that should live in the IoT or Default VLAN.

To configure a port on a USW-Pro-24-PoE, navigate to Devices > [switch] > Ports, select the port, and set the Native Network to the target VLAN. For access ports, also set Tagged Networks to “Block All.” For trunk ports to downstream switches or APs, leave it “Allow All” or explicitly enumerate the VLANs that need to traverse the link.

Your gateway uplink port should remain on Default (VLAN 1) as the native network, with all other VLANs tagged on the same trunk.

Assigning SSIDs to VLANs

Navigate to Settings > Wi-Fi, create a new wireless network (or edit an existing one), and in the Network field select the virtual network you created. A U6-Enterprise AP will broadcast the SSID and tag all client traffic with the corresponding VLAN ID before sending it upstream on the trunk link. Clients on that SSID receive DHCP from the gateway interface for that VLAN and are routed accordingly.

Use clear SSID names and verify that a newly joined client receives the intended VLAN’s address, gateway, and DNS configuration. An SSID name is a label; the VLAN mapping and firewall policy provide separation.

Firewall Rules for Inter-VLAN Isolation

A VLAN separates Layer 2 traffic; routed access depends on the gateway policy. Ubiquiti’s isolation documentation distinguishes inter-network isolation from switch ACLs and wireless client isolation.

For straightforward inter-VLAN separation, select a network under Settings > Networks and enable Network Isolation. For selective access, use the zone-based firewall and review the source and destination zones. Menu labels differ on older releases, so match the documentation to the installed version.

Write the intended policy before adding rules:

• Preserve DHCP and the configured DNS service on each network.
• Keep administrator access to network management available.
• Allow only the specific trusted-to-IoT or camera-to-recorder services required.
• Permit established return traffic for those allowed connections without granting new connections in the reverse direction.
• Block new IoT and Guest connections to private resources unless explicitly required.
• Permit the intended internet access and restrict guest access to management interfaces.

Order narrow exceptions before a broader deny that would otherwise match them. Policies for traffic to the gateway itself need separate attention from policies for traffic routed through it. Check IPv6 policy too when clients receive IPv6 addresses.

Wireless client isolation covers peers on the same AP. If guest devices use multiple APs or wired ports, evaluate the corresponding switch isolation controls as well. A captive portal is a separate feature; the guest network and captive portal guide explains that distinction.

mDNS Reflection for IoT Discovery

Ubiquiti’s mDNS proxy documentation provides Auto, Off, and Custom modes. Custom limits rebroadcasts to selected networks and services. Review this setting explicitly: the documentation says mDNS is enabled on newly created networks.

For a trusted phone that needs to discover an IoT receiver, select only the relevant networks and discovery services. Discovery and the subsequent application connection are separate checks. Keep the specific service access allowed by your firewall plan; discovering a device does not prove that playback or printing can reach it.

Verify UniFi VLAN Isolation Before Moving Every Device

Use clients and services you administer. First confirm each destination service works from an allowed client. Then repeat from the restricted VLAN. A failed ping alone cannot establish firewall isolation because the destination may simply ignore ICMP.

Check	Where to check	Expected result for this plan
Address, gateway, and DNS	A newly connected client in every VLAN	Settings match that VLAN’s subnet and DHCP configuration
DHCP renewal and name resolution	IoT and Guest clients	Both continue working through the intended services
Internet access	IoT and Guest clients	The ordinary applications you intend to allow work
Access to a known private service	IoT or Guest to a trusted host	New connections are blocked, except any documented exception
Controller and gateway administration	Guest client, then designated administrator	Guest is denied; the administrator retains access
Approved IoT service	Trusted client to the allowed IoT device	The service and its return traffic work
Reverse initiation	IoT device toward a trusted service	A new connection is blocked despite the permitted return path
Guest peers	Two guest clients, including different APs or wired ports when used	Isolation matches the controls configured for each path
Service discovery	Trusted and Guest clients	Only the networks deliberately included in mDNS scope receive discovery

For each unexpected result, check the client’s actual VLAN, the destination service, the effective rule order, and the relevant firewall log. If all services fail, resolve addressing and DHCP/DNS first. If a private service remains reachable, inspect the matching allow rule rather than assuming another VLAN will fix it.

Keep the first rollout small: Trusted plus Guest, then one IoT device, then the rest. Validate one exception at a time and retain its purpose in your network plan. Repeat the checks after moving a switch uplink, changing SSID mappings, or restoring a controller backup.

Where this fits

This guide assumes the gateway is already up. If it is not, how to set up a UniFi Dream Machine covers the wizard and the first firewall rules, and choosing a UniFi gateway covers the model choice behind it. For the per-SSID isolation toggles that sit beside these firewall rules, see UniFi advanced wireless settings.

Related across the network

• UniFi Home Network Setup: What to Buy First — ubiquitiguide.com