Skip to main content
Configuration

UniFi VLANs, Explained — Segmentation Without the Guesswork

Learn how to design, configure, and troubleshoot VLANs in UniFi Network — from the first broadcast domain to inter-VLAN firewall rules.

The Demarc Networks Editors

How do VLANs work in UniFi Network, and how do you configure one?

A VLAN (Virtual Local Area Network) in UniFi Network creates an isolated Layer 2 broadcast domain on top of your physical infrastructure. You define it under Settings → Networks, assign a VLAN ID (2–4094), and UniFi automatically provisions a dedicated DHCP pool and subnet. Firewall rules under Settings → Firewall & Security control which VLANs can reach each other. The UniFi controller propagates VLAN trunks to managed switches via 802.1Q tagging, so a single uplink carries traffic for every VLAN you create.

What is a VLAN and why does it matter?

A VLAN is a Layer 2 segmentation construct. Instead of buying a separate physical switch for every traffic type you want to isolate, you configure logical segments on a single managed switch and tag frames with a VLAN ID defined in IEEE 802.1Q.

In practice this means your IoT devices — smart bulbs, thermostats, cameras — can live on VLAN 20 while your workstations sit on VLAN 10, and neither can initiate connections to the other unless you write an explicit firewall rule permitting it. The router (UniFi Gateway, Dream Machine, or Cloud Gateway) routes between VLANs at Layer 3 and enforces those rules.

Why bother? Three reasons: security (a compromised IoT device cannot pivot to your NAS), performance (broadcast storms on one VLAN do not flood others), and manageability (DHCP assignments, DNS overrides, and DPI policies can be scoped per VLAN).

Planning your VLAN IDs and subnets

UniFi accepts VLAN IDs from 2 to 4094. VLAN 1 is the default untagged network — leave it alone; changing it mid-deployment causes unexpected switch port behavior.

A practical numbering scheme for home and small-office deployments:

| VLAN ID | Purpose | Subnet example | |---------|---------|----------------| | 10 | Trusted workstations | 192.168.10.0/24 | | 20 | IoT & smart home | 192.168.20.0/24 | | 30 | Guest Wi-Fi | 192.168.30.0/24 | | 40 | Security cameras | 192.168.40.0/24 | | 50 | Lab / servers | 192.168.50.0/24 |

Use /24 subnets for simplicity — they give you 254 usable addresses and keep DHCP pools predictable. If you have more than ~200 devices per VLAN (unusual below enterprise scale), step up to /23.

Avoid overlapping RFC 1918 ranges across VLANs. UniFi's DHCP server will reject duplicate subnets, but routing anomalies can appear if ranges overlap on external uplinks or VPN tunnels.

Creating a VLAN in UniFi Network

  1. Open UniFi Network (local controller or cloud at unifi.ui.com).
  2. Navigate to Settings → Networks → Create New Network.
  3. Name the network (e.g., "IoT"), set VLAN ID to your chosen value, and leave Auto-Scale Network on for automatic subnet assignment, or specify your own subnet under Advanced.
  4. Set DHCP Mode to DHCP Server (the default). Set your lease time — 24 hours is fine for static-ish devices; 4 hours for a guest VLAN with high turnover.
  5. Click Add Network.

UniFi automatically creates an interface on the gateway and begins serving DHCP on that subnet. No additional routing configuration is needed — the gateway handles inter-VLAN routing natively.

To assign a wireless SSID to the new VLAN: go to Settings → WiFi, edit or create an SSID, and set Network to your new VLAN under Advanced.

To assign a switch port: open Devices → [switch] → Ports, select the port, set Profile to your VLAN or create a port profile under Settings → Profiles → Port.

Firewall rules — isolating VLANs from each other

By default, all networks in UniFi can communicate with each other. You must add explicit rules to block inter-VLAN traffic.

The cleanest approach is a block-all, allow-specific posture per VLAN:

  1. Go to Settings → Firewall & Security → Rules → LAN.
  2. Create a rule to block traffic from your IoT VLAN to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). This prevents IoT devices from reaching any other private network segment.
  3. Create allow rules for the specific flows you need — e.g., allow IoT VLAN to reach the DNS server on your trusted VLAN, or allow your NVR VLAN to reach cameras on the camera VLAN but not vice versa.

Rule order matters. UniFi evaluates firewall rules top-down and stops at the first match. Place allow rules above the block-all rule for any traffic you need to permit.

A common mistake: blocking inter-VLAN traffic and then wondering why mDNS-based devices (Apple TVs, Chromecast, printers) stop working across VLANs. mDNS does not cross broadcast domain boundaries. The fix is enabling mDNS repeating under Settings → Networks → [network] → Advanced, which lets UniFi rebroadcast service announcements across VLANs without opening full layer-3 access.

Troubleshooting common VLAN problems

Device not getting a DHCP address: Verify the switch port profile includes the correct VLAN as tagged or untagged. An access (untagged) port should have the VLAN set as the native network. Check Devices → [switch] → Ports to confirm the assignment is applied.

Device gets an address but cannot reach the internet: The gateway may be missing a routing entry. In UniFi this is automatic, but check Settings → Networks to confirm the VLAN has a valid gateway IP assigned. If you have a custom DNS server, ensure the IoT VLAN's DNS setting points to a reachable resolver.

Firewall rules not taking effect: UniFi applies LAN firewall rules to traffic that crosses VLANs (routed traffic). Rules do not apply to intra-VLAN traffic (same broadcast domain). If you need to filter within a VLAN, use a client isolation setting on the SSID or VLAN instead.

Trunk port dropping traffic for a VLAN: On switch-to-switch uplinks, both ends must have the VLAN in their allowed list. Check the port profile on both switches. If you are using a non-UniFi switch on the edge, verify it is tagging VLAN frames with the correct ID on the uplink port.

Frequently Asked Questions

Yes, for wired VLAN segmentation. UniFi gateways (Dream Machine, Cloud Gateway, UniFi Express) handle routing and enforcement, but a managed switch is required to propagate VLAN tags across physical ports. If your deployment is wireless-only, an access point can put SSIDs on different VLANs without a managed switch — the AP tags traffic before handing it to the gateway uplink.

UniFi Network supports up to 4093 VLANs (IDs 2–4094) in software. The practical limit is the hardware capacity of your switches and gateway — consumer-grade Dream Machines handle 5–15 VLANs without measurable throughput degradation. Above that, monitor CPU utilization on the gateway, especially if you have heavy inter-VLAN traffic being inspected by IDS/IPS.

Yes. UniFi Express supports up to 5 VLANs and includes the full UniFi Network controller. The configuration is identical to larger deployments — Settings → Networks → Create New Network. Its 1 Gbps throughput is shared across all VLANs, so plan accordingly for high-bandwidth use cases.

Any unused ID in the 2–4094 range works. A common convention is to use VLAN 30 or 100 for guest traffic to keep it visually distinct from primary VLANs. More important than the ID is ensuring the guest network has the 'Guest Network' checkbox enabled in UniFi, which activates client isolation and blocks access to all other VLANs automatically.

mDNS (multicast DNS) is link-local and does not cross Layer 3 boundaries by default. Enable mDNS repeating on each network under Settings → Networks → [network] → Advanced → Enable mDNS. This configures UniFi to proxy mDNS announcements between VLANs so that service discovery works without opening full inter-VLAN routing.

Minimally. Each VLAN-backed SSID adds a small amount of management overhead (beacon frames, association table entries) to the access point radio. A practical limit for home and small-office deployments is 3–4 active SSIDs per radio band per AP. Beyond that, airtime contention starts to impact throughput. Prefer fewer SSIDs and use wired VLAN segmentation for devices that can be wired.