VLANs made simple: Main, IoT, Guest and Cameras

Four networks cover most homes: Main for your own devices, IoT for smart gadgets, Guest for visitors and Cameras for Protect. Create each as a VLAN, assign it to Wi-Fi and switch ports, then add a few zone-based firewall policies so Main can reach everything while the others stay contained.

You'll need

• A UniFi gateway, which the zone-based firewall requires. Network 11 moves every site to the zone-based firewall automatically.
• Your switches and APs adopted (see our setup guide).
• A wired connection to the console while you work, so a firewall mistake can't cut you off.

Step 1 — Plan your networks

Match each VLAN ID to the third number of its subnet so you can tell them apart at a glance. Valid VLAN IDs run from 2 to 4094.

Step 2 — Create each network

1. Go to Settings › Networks › New Virtual Network (some builds say Create New). VLAN Magic on the Topology page does the same job.
2. Enter a name, such as IoT.
3. Turn Auto-Scale off, then set the gateway address and subnet, for example 192.168.40.1/24.
4. Set Advanced to Manual and enter the VLAN ID (40).
5. Leave DHCP Mode on DHCP Server and accept the suggested address range.
6. Set the options per network:
   • Allow Internet Access: off for Cameras, on for the rest.
   • Device Isolation: on for Guest, so visitors' devices can't see each other.
   • Network Isolation: leave off. It blocks all traffic between VLANs, including from Main, and the policies below give finer control.
   • Zone: Hotspot for Guest. Leave IoT and Cameras for now; Step 4 gives them their own zones.
7. Save, then repeat for Guest, Cameras and IoT.

Step 3 — Put the networks on Wi-Fi and switch ports

• Wi-Fi: in Settings › WiFi › [network name], choose the VLAN under Network. Give guests their own Wi-Fi network with Client Device Isolation on. Set up the IoT Wi-Fi as 2.4 GHz-only with WPA2 and Fast Roaming off (see our Wi-Fi settings guide).
• Switch ports: go to UniFi Devices › [switch] › Port Manager and select the ports.
  • A port for one device (a camera or TV): set Native VLAN to its network and Tagged VLAN Management to Block All.
  • Ports to APs and other switches: leave Tagged VLAN Management on Allow All, the default, so every VLAN reaches them.
  • Never change the native VLAN of an uplink port, or of the port your own computer uses. You'll cut off everything behind it, including yourself.
  • Power-cycle a port after changing it, so the device picks up a new address.
• Every hop counts. A VLAN must be allowed on each switch port between the gateway and the APs that broadcast it.

Step 4 — Create the IoT and Cameras zones

Custom zones keep IoT and Cameras traffic apart from your main network. Ubiquiti doesn't document a new zone's default policies, so check the zone matrix after creating each one.

1. Open the zones page: Settings › Zones on Network 11, or Settings › Policy Engine › Zones on 10.x.
2. Click Create Zone, name it IoT and add the IoT network. Repeat for Cameras. You can have up to 30 zones.
3. In the zone matrix, check what each new zone can reach. Step 5 adds Block policies so IoT and Cameras can't start connections to Main.

Step 5 — Add the firewall policies

Create each policy at Settings › Policy Table › Create New Policy (on Network 10: Settings › Policy Engine › Policy Table).

Policies are checked top to bottom and the first match wins. New custom policies go above the built-in ones but below your existing custom policies, so use Reorder to place each narrower policy, such as Cameras to NVR, above any broader one it should override, such as Cameras to Main.

With these in place:

• Main reaches IoT and the internet.
• IoT reaches the internet and the gateway's DNS and DHCP. It can reply to Main but can't start connections to it.
• Cameras reach the console running Protect, and nothing on the internet.
• Guest reaches the internet only, and visitors can't see each other.

Step 6 — Make casting and AirPlay work across VLANs

1. Discovery: mDNS is on by default for new networks. The gateway's mDNS setting offers Auto, which suits most homes, or Custom, which lets you pick services (such as AirPlay) and the networks to bridge.
2. Connection: discovery only makes devices visible. The Main to IoT policy is what lets your phone actually connect.
3. Still failing? Multicast filtering on the APs can drop mDNS; see the multicast notes in our Matter and Thread and Wi-Fi settings guides.

Check it worked

• Connect a device to each network and check its address on the Clients page (Network column).
• From a device on Main, ping an IoT device: it should answer. From a laptop on the IoT Wi-Fi, ping a Main device: it should fail.
• Cast from your phone on Main to a TV on IoT.
• On Network 11, Live Flows shows which policy allowed each flow (see our Live Flows guide).

Watch out for

• Blocking every connection state kills replies. If you write block policies inside the Internal zone instead of using custom zones, set Connection State to New and Invalid, not All.
• Never block the Gateway zone outright. Devices lose DHCP and DNS.
• AP ports: an AP port's native VLAN mustn't match a VLAN its Wi-Fi broadcasts, unless that's VLAN 1.
• No DHCP, no connection. Setting a port's native VLAN to a network without DHCP breaks the devices on it.
• The Network 11 migration creates duplicate rules from your old firewall. Back up first and tidy up afterwards. Networks in the Internal zone stay open to each other.
• Deleting a custom zone deletes its policies.
• VPN users land in the VPN zone, which can reach Internal by default. To limit them, add an Allow policy from VPN to Internal for just the devices they need, such as a NAS, with a Block policy from VPN to Internal below it.
• Small gateways, fewer mDNS networks. The Express and UXG-Lite can proxy mDNS for only two networks.

Sources: Zone-based firewalls · Migrating to the zone-based firewall · Creating virtual networks · Network and client isolation · Switch port VLAN assignment · mDNS proxy · Configuring IPv6 · Device adoption · Network release notes