UniFi VLAN Setup Guide: Segment Your Network the Right Way

To set up a VLAN in UniFi, create a network under Settings > Networks with a VLAN ID from 2 to 4009. Then attach clients by selecting that network on an SSID in Settings > WiFi or as a switch port’s Native VLAN. Last, enable Network Isolation: networks in UniFi’s Internal zone can reach each other by default.

The goal is a working segmented network, not a partial one that looks right in the dashboard but passes traffic it shouldn’t.

UniFi VLAN Configuration at a Glance

Work top to bottom: a port or SSID can only select a VLAN that already exists as a network.

Plan Your VLAN Schema First

Configuring VLANs without a written plan leads to VLAN ID collisions, overlapping subnets, and firewall rules that reference the wrong network. Spend ten minutes on paper before touching the controller.

A practical three-VLAN schema for a home or small-office UniFi deployment:

Align your VLAN IDs with the third octet of the subnet — VLAN 10 maps to 192.168.10.0/24, VLAN 20 to 192.168.20.0/24. This makes firewall rules readable without a lookup table and catches typos at a glance.

Reserve VLAN 1 for trusted, managed clients and network infrastructure. Keep your UDM Pro, USW-Pro-24-PoE, and U6-Enterprise access points on the Default network so management traffic never crosses a VLAN boundary. If you move APs to a separate management VLAN while a self-hosted controller sits on another subnet, they need manual Layer 3 adoption with set-inform or DHCP option 43. IoT devices — thermostats, cameras, smart bulbs, anything that runs firmware you don’t control — belong on VLAN 10. Guest wireless goes on VLAN 20 with no route to any internal segment.

Add a separate Cameras VLAN when its access policy differs from other IoT devices. Permit only the camera-to-recorder services the deployment needs and the administrator’s approved path to the recorder. The Protect storage and recording guide covers the recording side of that plan.

Roll out Trusted and Guest first, then move one IoT device and verify its permitted services. Add cameras and other exceptions only after the simpler policy works. Keep a management connection available throughout, and record each exception’s source, destination, service, and reason.

Creating Virtual Networks in UniFi Network

Ubiquiti’s official documentation describes the process from the controller side. The path is the same whether you are running UniFi Network on a UDM Pro, a Cloud Gateway Ultra, or a self-hosted controller:

1. Navigate to Settings > Networks.
2. Click Create New Network.
3. Set the Network Name, such as “IoT”, and select the gateway that will route it.
4. Set the VLAN ID, subnet, and gateway address from your plan.
5. Configure DHCP and DNS for that network, avoiding conflicts with existing reservations.
6. Review isolation settings and apply the changes.

For a third-party router, create the VLAN interface, subnet, and DHCP service on that router first. In UniFi, select Third-party Gateway and match its VLAN ID. Hosting the Network application on a computer does not turn that computer into the VLAN router. Ubiquiti notes that most third-party gateways block inter-VLAN traffic by default; a UniFi gateway routes between internal networks until you isolate them.

Repeat for each VLAN. On a UniFi gateway, these settings define the routed network and its DHCP service. Review the effective firewall policy separately; naming a network “Guest” does not establish its isolation.

Switch Port VLAN Assignment and Tagging: Trunk and Access Ports

Once your virtual networks exist, you need to assign them to physical switch ports. UniFi’s port settings map directly to 802.1Q tagging concepts, though the UI uses different terms.

A tagged frame carries a 32-bit 802.1Q field with a 12-bit VLAN ID; an untagged frame belongs to the port’s native VLAN. UniFi calls the untagged network the Native VLAN and controls tagged ones with Tagged VLAN Management, which Ubiquiti’s switch port documentation splits into three options:

The U6-Enterprise tags traffic per SSID, so its port needs every SSID’s VLAN tagged.

To assign a VLAN to a port on a USW-Pro-24-PoE or any other UniFi switch:

1. Open Devices, select the switch, then Ports > Port Manager.
2. Select the port or ports.
3. Set Native VLAN to the target network.
4. Set Tagged VLAN Management to Block All for a single end device, or Allow All or Custom for an AP or downstream switch.
5. Apply, then reconnect the device so it takes a lease from the new subnet.

Per the same documentation, a port feeding an access point should never use a network that AP broadcasts as its Native VLAN, except VLAN 1, and a Custom list must not drop a VLAN that downstream devices need. Your gateway uplink port should remain on Default (VLAN 1) as the native network, with all other VLANs tagged on the same trunk.

Assigning SSIDs to VLANs

Navigate to Settings > Wi-Fi, create a new wireless network (or edit an existing one), and in the Network field select the virtual network you created. A U6-Enterprise AP will broadcast the SSID and tag all client traffic with the corresponding VLAN ID before sending it upstream on the trunk link. Clients on that SSID receive DHCP from the gateway interface for that VLAN and are routed accordingly.

Use clear SSID names and verify that a newly joined client receives the intended VLAN’s address, gateway, and DNS configuration. An SSID name is a label; the VLAN mapping and firewall policy provide separation.

What Is UniFi VLAN Magic?

VLAN Magic is UniFi’s shortcut for creating a VLAN and moving devices onto it by MAC address in one pass, from the Topology view. Click Topology, click the ⊕ symbol to open the Create Virtual Network panel, name the VLAN, select the devices, and optionally isolate it or block its internet access, per Ubiquiti’s VLAN documentation.

LazyAdmin’s walkthrough dates the feature to UniFi Network 8.0.24 and explains that it moves each device with Virtual Network Override, which Ubiquiti describes as a UniFi Gateway feature that assigns VLANs by MAC address at the gateway. Wireless clients need no SSID change, but wired devices still depend on correct port settings.

It does not work for devices behind a USW Flex, USW Flex Mini, USW Ultra, USW Flex 2.5G or ECS Aggregation switch, so check your models first; the home switch guide helps if you are still buying. Never override a device onto its switch port’s native VLAN, a mistake the VLAN troubleshooting guide calls out. VLAN Magic suits a few stray devices; whole networks are easier to audit through explicit port and SSID settings.

Dynamic VLAN Assignment: PPSK, RADIUS and MAC-Based

Dynamic VLAN assignment places a client on a VLAN by its password, credentials or MAC address instead of the port or SSID it uses. Ubiquiti documents four methods:

PPSK is the practical home option. Per Ubiquiti’s PPSK and RADIUS guide, add a network in Settings > WiFi, enable Private Pre-Shared Keys (PPSK), and create one password per existing VLAN, so one SSID name serves Trusted and IoT clients separately.

For RADIUS, UniFi gateways include a built-in server: in the RADIUS Servers section of Settings > Networks, enable RADIUS Assigned VLAN Support and give each user under Local Credentials a VLAN. Ubiquiti’s RADIUS article specifies tunnel-type 13 and tunnel-medium-type 6; users without a VLAN fall back to the untagged one. Every VLAN a client might land on must be tagged on its AP’s switch port.

IoT VLAN Setup in UniFi

An IoT VLAN is the IoT network from the plan above plus Wi-Fi settings that older devices can join. Build it in this order:

1. Create the IoT network (VLAN 10 here) under Settings > Networks with DHCP enabled.
2. Add an IoT SSID mapped to it. Ubiquiti’s IoT guidance for U7 access points recommends a separate SSID set to 2.4 GHz only and WPA2; the Wi-Fi 6 vs 6E vs Wi-Fi 7 guide explains why smart-home gear stays on 2.4 GHz.
3. Consider Enhanced IoT Connectivity on that SSID only. Ubiquiti’s SSID settings reference describes it as AP functions for devices with limited networking capabilities; HostiFi’s June 2025 write-up reports it turns off band steering, BSS transition, fast roaming and 5 GHz.
4. Block new IoT-to-Trusted connections with Network Isolation, or with zone-based policies if trusted clients must still reach IoT devices for casting or a hub’s web interface.
5. Scope mDNS to the IoT and Trusted networks, then move one device at a time.

Firewall Rules for Inter-VLAN Isolation

A VLAN separates Layer 2 traffic; routed access depends on the gateway policy. Ubiquiti’s isolation documentation distinguishes inter-network isolation from switch ACLs and wireless client isolation.

For straightforward inter-VLAN separation, select a network under Settings > Networks and enable Network Isolation. For selective access, use the zone-based firewall and review the source and destination zones. Menu labels differ on older releases, so match the documentation to the installed version.

The zone-based firewall arrived in UniFi Network 9.0.108. Each network sits in exactly one zone, and the default matrix allows all Internal-to-Internal traffic, so an IoT network left in the Internal zone is not isolated. Custom policies take precedence over built-in ones and can be reordered.

Write the intended policy before adding rules:

• Preserve DHCP and the configured DNS service on each network.
• Keep administrator access to network management available.
• Allow only the specific trusted-to-IoT or camera-to-recorder services required.
• Permit established return traffic for those allowed connections without granting new connections in the reverse direction.
• Block new IoT and Guest connections to private resources unless explicitly required.
• Permit the intended internet access and restrict guest access to management interfaces.

Order narrow exceptions before a broader deny that would otherwise match them. Policies for traffic to the gateway itself need separate attention from policies for traffic routed through it. Check IPv6 policy too when clients receive IPv6 addresses.

Wireless client isolation covers peers on the same AP. If guest devices use multiple APs or wired ports, evaluate the corresponding switch isolation controls as well. A captive portal is a separate feature; the guest network and captive portal guide explains that distinction.

mDNS Reflection for IoT Discovery

Ubiquiti’s mDNS proxy documentation provides Auto, Off, and Custom modes. Custom limits rebroadcasts to selected networks and services. Review this setting explicitly: the documentation says mDNS is enabled on newly created networks.

Each gateway model also caps how many networks can have mDNS enabled:

Services outside the built-in list can be added in the _service._protocol.local format, such as _airplay._tcp.local.

For a trusted phone that needs to discover an IoT receiver, select only the relevant networks and discovery services. Discovery and the subsequent application connection are separate checks. Keep the specific service access allowed by your firewall plan; discovering a device does not prove that playback or printing can reach it.

Verify UniFi VLAN Isolation Before Moving Every Device

Use clients and services you administer. First confirm each destination service works from an allowed client. Then repeat from the restricted VLAN. A failed ping alone cannot establish firewall isolation because the destination may simply ignore ICMP.

For each unexpected result, check the client’s actual VLAN, the destination service, the effective rule order, and the relevant firewall log. If all services fail, resolve addressing and DHCP/DNS first. If a private service remains reachable, inspect the matching allow rule rather than assuming another VLAN will fix it.

Keep the first rollout small: Trusted plus Guest, then one IoT device, then the rest. Validate one exception at a time and retain its purpose in your network plan. Repeat the checks after moving a switch uplink, changing SSID mappings, or restoring a controller backup.

Where this fits

This guide assumes the gateway is already up. If it is not, how to set up a UniFi Dream Machine covers the wizard and the first firewall rules, and choosing a UniFi gateway covers the model choice behind it. For the per-SSID isolation toggles that sit beside these firewall rules, see UniFi advanced wireless settings.

Related across the network

• UniFi Home Network Setup: What to Buy First — ubiquitiguide.com
• OPNsense VLAN Setup: Trusted, IoT, Guest, and Management — opnsenselab.com
• OPNsense DNS Blocklists: Unbound Setup and Tuning — opnsenselab.com

FAQ

does unifi block traffic between vlans by default?

No. On UniFi Network 9.0.108 and later, the zone-based firewall allows all traffic between networks in the Internal zone, so an IoT network left in that zone can reach your trusted devices until you enable Network Isolation or add block policies. Guest networks in the Hotspot zone differ: toward Internal they receive only return traffic.

what vlan ids can i use in unifi?

Use any ID from 2 to 4009 for a new UniFi network. VLAN 1 is the untagged Default network, and Ubiquiti staff say IDs above 4009 are reserved for internal controller and switch use, although 802.1Q allows up to 4,094. Matching the ID to the third octet, like VLAN 10 on 192.168.10.0/24, keeps rules readable.

can one unifi ssid have multiple vlans?

Yes. Enable Private Pre-Shared Keys on the SSID and give each VLAN its own password, or use WPA2 or WPA3 Enterprise with a RADIUS server that returns a VLAN for each user. PPSK is WPA2 only and does not work on 6 GHz, so for 6 GHz clients use WPA3 Enterprise with RADIUS, or separate SSIDs.

why are devices on my unifi vlan not getting an ip address?

Usually the VLAN never reaches the gateway. Ubiquiti’s troubleshooting guide names two common causes: the SSID’s VLAN is set as the Native VLAN on the AP’s uplink port, or the VLAN is not allowed (tagged) on an upstream switch port. Trace the path back to the gateway with the VLAN Viewer in the Ports tab.