A VLAN (Virtual Local Area Network) is a method of logically segmenting a physical network into separate broadcast domains. Each VLAN functions as its own independent network, even if multiple VLANs share the same physical switches and cables. VLANs use VLAN IDs to tag traffic, allowing switches and routers to correctly route data between devices. By isolating traffic, VLANs improve network security, preventing devices on one VLAN from directly accessing another. They also enhance performance by reducing unnecessary broadcast traffic and containing network congestion. In typical VLAN architecture, a router or Layer 3 switch handles inter-VLAN routing when communication between VLANs is needed. VLANs can be applied to both wired and wireless networks, with access points assigning wireless clients to specific VLANs via SSIDs. Switch ports can be configured as access ports (untagged VLAN for endpoints) or trunk ports (carry multiple VLANs between switches). Proper planning of subnets and IP addressing for each VLAN ensures smooth network operations and prevents conflicts. VLAN architecture is widely used in enterprise, campus, and advanced home networks to improve scalability, security, and manageability.

VLANs are a powerful way to segment your network for security, performance, and organization. If you’re using Ubiquiti UniFi hardware, setting them up is straightforward once you understand the flow. This guide will walk you through the process step by step.

Step 1: Understand VLAN Basics

Before diving into configuration, it’s important to know what VLANs do:

• Segmentation: Separate devices into different logical networks (e.g., guests, IoT devices, staff).
• Security: Prevent devices on one VLAN from accessing devices on another.
• Traffic management: Prioritize certain types of traffic or isolate bandwidth-heavy devices.

Important Concept: VLANs use tags (IDs) to identify each network segment. Common practice is to use numbers like 10 for Staff, 20 for IoT, 30 for Guests.

Step 2: Plan Your VLAN Structure

Decide which networks you need. Example:

Write down the subnet you want for each VLAN (e.g., 192.168.10.0/24 for VLAN 10).

Step 3: Create VLANs in UniFi Controller

1. Open your UniFi Network Controller / UniFi Network App.
2. Go to: Settings → Networks → Add New Network
3. Configure the network:
   • Name: e.g., “Staff”
   • Purpose: Select Corporate for internal devices or Guest for guest networks
   • VLAN ID: e.g., 10
   • Gateway/Subnet: Define your IP range (e.g., 192.168.10.1/24)
   • DHCP Mode: Usually Auto
4. Click Save

Repeat this step for all VLANs you want.

Step 4: Configure VLAN on UniFi Switch Ports

1. Go to Devices → Select your UniFi Switch → Ports
2. Choose the port connected to a VLAN device (PC, access point, or another switch).
3. Click Edit → Profile
4. Select one of the following port profiles:
   • All (untagged traffic) – default network
   • VLAN Only (tagged traffic) – for devices that support VLAN tagging
   • Hybrid – can handle both untagged and tagged traffic
5. Enter the VLAN ID if needed, then save changes.

Note: For access points, VLANs are usually configured via Wi-Fi SSID settings, not switch ports.

Step 5: Assign VLANs to Wireless Networks

1. Go to Settings → Wi-Fi → Add New Wi-Fi Network
2. Enter SSID Name (e.g., Guest Wi-Fi)
3. Under Advanced Settings, enable VLAN and enter the VLAN ID (e.g., 30)
4. Save and apply changes

Devices connecting to this SSID will automatically be on the VLAN you assigned.

Step 6: Configure Routing Between VLANs (Optional)

By default, VLANs are isolated. If you want devices to communicate:

1. Go to Settings → Routing & Firewall → Firewall Rules
2. Add rules to allow or block traffic between VLANs.
3. Example: Allow Staff VLAN to access IoT VLAN, but block IoT from accessing Staff.

For advanced setups, you may configure Inter-VLAN routing on a UniFi Security Gateway (USG) or UniFi Dream Machine (UDM).

Step 7: Test Your VLANs

• Connect a device to a port or SSID assigned to the VLAN
• Check IP address: ipconfig (Windows) or ifconfig (Linux/macOS)
• Confirm it matches the VLAN subnet
• Ping devices in other VLANs to test isolation (if configured)

Step 8: Monitor VLAN Traffic

• Go to UniFi Dashboard → Clients
• Filter by VLAN to see which devices are connected
• Check traffic usage to ensure VLANs are properly segmented

Tips for a Smooth VLAN Setup

1. Always document VLAN IDs and subnets before starting.
2. Start with one VLAN, test, then expand.
3. Use consistent VLAN IDs across switches and APs.
4. Enable DHCP per VLAN for easier IP management.
5. Regularly check logs and traffic to spot misconfigurations early.

✅ Conclusion

Setting up VLANs on a UniFi network helps secure, organize, and optimize your environment. By following this step-by-step guide, you can segment your network for staff, guests, and IoT devices while maintaining control and flexibility.

UniFi official help center: Creating Virtual Networks