← all notes
ciphersense --note

Why cameras and guest Wi-Fi shouldn't share a VLAN

August 1, 2026 segmentationvlanunifi

Most small-business networks are flat: one LAN, everything on it — computers, phones, cameras, guest Wi-Fi, printers, the POS terminal. It works until it doesn’t. And when a camera or a guest device gets compromised, the entire business network is the blast radius.

The 30-second version

  • Cameras belong on their own VLAN with no route to the rest of the network.
  • Guest Wi-Fi belongs on its own VLAN with internet-only access.
  • Your office devices belong on a third VLAN with normal access.
  • The gateway enforces the boundaries. Nothing else should.

Why cameras are a special case

Cameras are, bluntly, the least-patched devices on most networks. They sit on walls, they run firmware nobody updates, and they’re frequently reachable from the internet through sloppy port-forwarding. A camera is not a computer you trust — it’s a sensor that happens to have a network stack.

Putting cameras on the same VLAN as your workstations means any camera compromise is one hop away from your files. Isolated on their own VLAN with a firewall rule that only allows the NVR to pull their streams, a compromised camera can’t see your file server, can’t hit your Wi-Fi, can’t be reached from your workstations. It becomes a nuisance instead of an incident.

Guest Wi-Fi is the same story

Guests bring devices you know nothing about. A guest VLAN with internet-only access (plus maybe printer access if you’re generous) means their laptop’s malware doesn’t become your ransomware. This is the single cheapest security improvement you can make to a network — it costs nothing but configuration time.

How UniFi makes this easy

UniFi’s built-in VLANs (Corporate / Guest / Camera / IoT) map directly to this. On a UDM or Dream Machine, enabling Guest and Camera networks is a few clicks. The subtle work is in the firewall rules and the DHCP/management story:

  • Camera VLAN: no route to office VLAN, NVR-only management access.
  • Guest VLAN: no route to anything, isolated from your local subnets.
  • IoT (printers, thermostats): no route to office, allowed to talk to each other where needed.

Where this goes wrong in practice

The three most common failure modes we see on “segmented” networks:

  1. Cameras still on the office VLAN — segmentation was done for guests only.
  2. VLANs exist but inter-VLAN routing is wide open — the firewall rules were never written, so segmentation is decorative.
  3. No documentation — a year later, nobody knows which VLAN is which, and the next person just flattens it.

The takeaway

Segmentation isn’t about buying gear — it’s about design discipline and firewall rules. On a flat network, the highest-leverage upgrade isn’t a new access point; it’s putting cameras and guests in their own VLANs and enforcing it at the gateway.

If that sounds like your environment, scope a plan — we’ll design the segmentation, migrate it without breaking your day, and document it so it stays that way.

Need this applied to your network?

That's what we do. Two minutes to scope, then we make it boring again.

Scope a plan →