VLANs are the single highest-leverage improvement you can make to a small-business network — and the one most often done wrong. This guide is the practical version: how to plan it, how to do it on UniFi, and how to verify it actually works.
The 30-second version
- Office devices — computers, phones, printers, POS — on their own VLAN.
- Cameras on their own VLAN with no route to anything but the NVR.
- Guest Wi-Fi on its own VLAN with internet-only access.
- IoT (thermostats, TVs, appliances) on its own VLAN.
- The gateway enforces every boundary with explicit firewall rules.
Step 1: Plan before you click
Draw the map first. One table — VLAN, purpose, devices, what it can reach — is worth an hour of clicking. For most small businesses that’s four VLANs (above). Don’t invent eight; every VLAN you add is rules you have to maintain.
Decide management access: who can reach the UniFi console, and from where? The answer should be “office VLAN only,” not “everywhere.”
Step 2: Create the networks in UniFi
In UniFi Network, Settings → Networks is where VLANs are born. Create one network per row in your plan and assign a VLAN ID (10s for office, 20s for cameras, 30s for guests, 40s for IoT keeps it readable). Tag them so the names match what they actually are — “Cameras” not “VLAN2”.
Step 3: Write the firewall rules
This is where segmentation actually happens. UniFi’s default is permissive, so you must add explicit rules:
- Camera VLAN → Office VLAN: deny (cameras never initiate to workstations)
- Guest VLAN → anything: deny except the internet
- IoT VLAN → Office VLAN: deny, with narrow exceptions (e.g., printer discovery) only where needed
- Office VLAN → Camera VLAN: allow only to the NVR/management IPs, not the whole subnet
Rule order matters. UniFi evaluates in order, so put the broad denies before narrow allows.
Step 4: Verify it actually isolates
Segmentation you can’t prove is decoration. After applying:
- From a guest Wi-Fi device, try to ping a printer or camera — it should fail.
- From the office VLAN, confirm you can still reach the internet, the file server, and the NVR console.
- Confirm cameras still record (the NVR pulls streams from the camera VLAN — that’s the one flow that must survive).
If pings pass when they shouldn’t, the rules are wrong — fix them before moving on.
Where this goes wrong
The three failure modes we see most:
- VLANs created, rules never written — traffic still flows everywhere, and the network is “segmented” on paper only.
- Cameras sharing the office VLAN — the most common blind spot, and the riskiest.
- No documentation — six months later nobody remembers which VLAN is which, and the next change flattens it.
The takeaway
VLAN setup on UniFi is a few hours of work — planning, four networks, a handful of rules, and a verification pass. Done right, it shrinks your blast radius from “whole business” to “one device.” Done wrong, it’s a checkbox with no security.
If your network has grown into a flat LAN, scope a plan — we’ll design the segmentation, migrate it without breaking your day, and document it so it stays that way.