How to Set Up VLANs in UniFi

VLANs — Virtual Local Area Networks — are one of the most useful tools in any network administrator’s kit, and UniFi makes them more accessible than most platforms. Whether you want to keep IoT devices away from your main computers, isolate a guest network, or segment a home lab from production traffic, VLANs let you do all of that on a single set of physical hardware. This guide walks through the full process: creating VLANs in UniFi Network, assigning them to wireless SSIDs, applying them to switch ports, and building a sensible home VLAN scheme from the ground up.

What Is a VLAN and Why Does It Matter?

A VLAN is a logical network segment that exists within a physical network. Devices on different VLANs are isolated from each other at layer 2 (the data link layer) — they can’t communicate directly even if they’re connected to the same physical switch, unless a router (or layer 3 switch) explicitly forwards traffic between them.

In practice, this means you can have a £30 smart plug and your work laptop on the same physical switch without the plug having any visibility of the laptop. If that smart plug is ever compromised, the attacker is limited to the IoT VLAN — they can’t pivot to your main network without bypassing firewall rules that you control.

For home users especially, VLANs are a practical and low-cost security improvement. You’re not adding hardware — you’re making better use of what you already have. For a broader look at why this matters, see our post on how to secure your home network.

A Sensible Home VLAN Scheme

Before touching the controller, it’s worth deciding on your VLAN structure. A typical home setup uses four VLANs:

The Management VLAN is optional for home users — most people don’t need it — but it’s good practice if you want to lock down access to your network devices themselves. For a Proxmox home lab, the same principles apply; see our guide on how to set up VLANs in Proxmox for the virtualisation side of things.

Step 1: Create VLANs in UniFi Network

Log in to your UniFi Network controller. If you haven’t completed the initial setup yet, start with our guide on how to set up a UniFi network from scratch first.

1. Go to Settings > Networks
2. Click Add New Network
3. Enter a name — e.g. “IoT”
4. Set the VLAN ID — use 10 for IoT, 20 for Guest, 99 for Management
5. Set the Host Address — e.g. 192.168.10.1 for IoT. UniFi will use this as the gateway address for the subnet
6. Leave DHCP Mode set to DHCP Server — UniFi will hand out addresses in this range automatically
7. For IoT and Guest networks, enable the Guest Network toggle. This automatically applies firewall rules that block access to other VLANs while allowing internet access
8. Click Add Network

Repeat this process for each VLAN in your scheme. Once created, each network will appear in the Networks list with its VLAN ID, subnet, and status shown.

What the Guest Network Toggle Actually Does

The “Guest Network” toggle in UniFi is a convenience feature that applies pre-built firewall rules preventing traffic from that VLAN reaching any other local subnet. It’s not just a label — it actively enforces isolation. Enable it for IoT and Guest VLANs. Leave it off for your Main LAN and Management VLANs.

Step 2: Assign VLANs to SSIDs

Each SSID needs to be mapped to a network (VLAN) so that wireless clients are placed into the correct segment when they connect.

1. Go to Settings > WiFi
2. Click Add New WiFi Network (or edit an existing one)
3. Enter the SSID name — e.g. “Home-IoT” or “Home-Guest”
4. Set a password
5. Under Network, select the corresponding VLAN network from the dropdown — e.g. “IoT” for the IoT SSID
6. Click Add WiFi Network

Repeat for each SSID. A typical home setup ends up with three SSIDs:

• Home — mapped to Main LAN (VLAN 1)
• Home-IoT — mapped to IoT (VLAN 10)
• Home-Guest — mapped to Guest (VLAN 20)

For a detailed walkthrough of the guest network specifically — including captive portals and bandwidth limits — see our guide on how to set up a guest Wi-Fi network in UniFi.

Step 3: Apply VLANs to Switch Ports

Wireless devices are handled automatically once SSIDs are mapped to VLANs. Wired devices connected to switch ports require a different approach — you need to assign the correct VLAN profile to each port.

Switch Port Profiles

UniFi uses Port Profiles to define how a switch port handles VLANs. There are two key concepts:

• Access port (untagged) — the port carries traffic for a single VLAN only. The connected device doesn’t need to know anything about VLANs. Use this for end devices: a smart TV, a desktop PC, a NAS.
• Trunk port (tagged) — the port carries traffic for multiple VLANs simultaneously, with 802.1Q VLAN tags. Use this for uplinks between switches, and between switches and access points.

UniFi handles trunk/uplink ports automatically in most cases — the link between your gateway and a UniFi switch, or between a switch and a UniFi access point, is automatically configured to carry all VLANs. You typically only need to manually configure access ports for wired end devices.

Assigning a VLAN to a Switch Port

1. Go to Devices and click on your UniFi switch
2. In the device detail panel, click Ports
3. Find the port you want to configure and click the edit (pencil) icon
4. Under Port Profile, select a network — for example, “IoT” to put a wired smart TV on the IoT VLAN
5. This sets the port to carry only that VLAN’s untagged traffic
6. Click Apply

The device connected to that port will now receive a DHCP address from the IoT subnet (192.168.10.x) and be isolated from your main LAN accordingly.

Custom Port Profiles

If you need a port to carry multiple specific VLANs (for example, a port going to a secondary unmanaged switch serving both IoT and Guest devices), you can create a custom port profile:

1. Go to Settings > Networks and scroll to Port Profiles
2. Click Add New Profile
3. Set the Native Network (the untagged VLAN for that port)
4. Add Tagged VLANs as needed
5. Save and apply to the relevant port

Step 4: Verify Your VLAN Configuration

Testing is essential — it’s easy to make a mistake with VLAN assignments that isn’t immediately obvious.

Test Wireless Isolation

1. Connect a device to your IoT SSID
2. Check the IP address — it should be in the IoT subnet (e.g. 192.168.10.x)
3. Try to ping a device on your main LAN (e.g. your router at 192.168.1.1) — this should fail if the Guest Network toggle is active
4. Confirm internet access works normally

Test Wired Port Assignment

1. Connect a device to the configured switch port
2. Check the DHCP lease — it should be in the expected VLAN subnet
3. In the UniFi Clients view, confirm the device shows the correct Network label

Check in the UniFi Dashboard

Go to Clients and add the “Network” column to the view. Each connected device should show which network (VLAN) it belongs to. This is the quickest way to verify everything is assigned correctly at a glance.

Inter-VLAN Routing and Firewall Rules

By default, with the Guest Network toggle enabled on IoT and Guest VLANs, those networks are isolated from everything else. But what if you want to allow specific traffic between VLANs? For example, you might want your main LAN to be able to reach an IP camera on the IoT VLAN, while preventing the reverse.

This requires custom firewall rules in Settings > Firewall & Security > Rules. UniFi’s firewall is stateful, so you only need rules in one direction — allow traffic from Main LAN to IoT VLAN for the specific IP or port, and the return traffic is handled automatically.

Writing custom firewall rules is beyond the scope of this guide, but the key point is that VLANs don’t need to be completely opaque to each other — you can create precise, surgical exceptions where needed without opening up broad access.

Summary

VLANs in UniFi are well-implemented and genuinely approachable once you understand the three-step process: create the network with a VLAN ID, assign it to an SSID or switch port, and verify the segmentation is working. A four-VLAN home scheme — Main, IoT, Guest, and optionally Management — covers the vast majority of use cases and meaningfully improves your network security posture without adding cost or complexity. For the full picture of what a well-configured UniFi home network looks like, see our UniFi home network guide.