Build a UniFi network for a two storey house

Goal and requirements

Provide reliable coverage on both floors, wired connectivity for fixed equipment and separate networks for household, smart-home and guest devices. The worked design starts with one wired access point per floor. That is an initial layout to measure, not a guarantee that every two-storey house needs exactly two access points.

You need a UniFi gateway with a working internet connection, a managed PoE switch, two compatible access points, Ethernet runs to their intended positions and an administrator's wired laptop. Match PoE standards and uplink speeds to the chosen models. Complete the initial gateway and internet setup before building the internal networks.

Plan the household networks

Name VLAN Subnet Intended devices
Main10 10 192.168.10.0/24 Household computers and phones
IoT20 20 192.168.20.0/24 Smart-home devices
Guest30 30 192.168.30.0/24 Visitors
Cameras40 40 192.168.40.0/24 Cameras and separate NVR

Use .1 as each gateway and .100 to .199 as its DHCP range. Keep existing infrastructure management unchanged. This example uses IPv4 on the added networks; an IPv6 deployment needs equivalent addressing and firewall verification.

Build and configure

  1. Mark the floor plan. Identify the office desk, living room, bedrooms and outdoor areas that need service. Mark dense walls, metal cupboards and the floor between levels. Choose accessible AP positions near the areas of use, with Ethernet back to the switch. Follow each AP's intended mounting orientation. Avoid making an equipment cupboard the default WiFi location solely because the internet connection is there.
  2. Label and bench-test. Connect the gateway to the switch and adopt both APs while they are accessible. Name them Downstairs and Upstairs. Confirm a working wired internet connection, then a working basic WiFi connection. Record the switch port and cable label for each AP before moving it to the final position.
  3. Create the networks. In Network › Settings › Networks, create the four networks in the table with the specified VLAN, gateway and DHCP settings. Check for overlapping subnets before saving. Creating the network does not itself move an existing device into it; assignment happens through an SSID or switch port. [1]
  4. Configure the AP uplinks. On AP-facing ports, retain the existing native management network and permit tagged VLANs 10, 20 and 30. Permit those VLANs on each intervening switch link. Reserve camera VLAN 40 for the ports and links that need it. Assign an ordinary household wired-client port to Main10 as native, with tagged VLANs blocked. [2]
  5. Create three WiFi names. Under Settings › WiFi, create Home mapped to Main10, Home IoT mapped to IoT20, and Home Guest mapped to Guest30. Broadcast them from both APs initially. Set distinct passwords and supported security options. Use a compatibility-oriented 2.4 GHz IoT configuration where required by the actual devices. Keep the main network's configuration appropriate for its clients. [3]
  6. Apply the intended separation. Enable Network Isolation for Guest30 and IoT20 as the simple starting policy. Enable Client Device Isolation on Home Guest, and use supported switch ACL isolation when guest clients span APs or wired ports. Follow holiday rental wifi guide to verify gateway-management restrictions. This design deliberately starts without cross-network casting or printer exceptions; add a documented exception only for an identified service. [4]
  7. Connect fixed equipment. Place TVs, desktop computers and other suitable fixed clients on wired Main10 ports where available. Build the Protect system on Cameras40 using camera system setup guide. Make DHCP reservations for devices whose addresses will be used in an explicit firewall or printing configuration, and record the assignment.
  8. Set a measured radio baseline. Begin with 20 MHz on 2.4 GHz. For 5 GHz, evaluate 80 MHz in a relatively quiet environment or 40 MHz where contention warrants it. Check both APs' channels and overlapping coverage before increasing transmit power. Ubiquiti's guidance distinguishes less crowded homes from denser environments, so treat these as starting points. [5]

Verify the whole house

At every marked location, record the connected AP, band, signal, latency and a practical activity such as a video call. WiFiman Mobile's Signal features require a compatible UniFi gateway; device and platform support affects the available measurements. Walk between floors during a call and observe whether service remains usable. [6]

Check that each WiFi name gives an address from its intended subnet. From Guest30, test a known owner-device service and the gateway management page, not only ping. Both should be inaccessible under the intended policy while public websites remain available.

If one room performs poorly, compare it with a nearby strong location using the same client. Move or add an AP when measurements justify it. If clients connect but receive no address, inspect the SSID's VLAN and every uplink tag. Restore the recorded port configuration if a change disconnects an AP. Save the completed floor plan and configuration once the household's real devices pass testing.

Sources

Back to the series

Leave a comment

Please note, comments need to be approved before they are published.