Most small-business networks are flat: one LAN, everything on it — computers, phones, cameras, guest Wi-Fi, printers, the POS terminal. It works until it doesn’t. And when a camera or a guest device gets compromised, the entire business network is the blast radius.
The 30-second version
- Cameras belong on their own VLAN with no route to the rest of the network.
- Guest Wi-Fi belongs on its own VLAN with internet-only access.
- Your office devices belong on a third VLAN with normal access.
- The gateway enforces the boundaries. Nothing else should.
Why cameras are a special case
Cameras are, bluntly, the least-patched devices on most networks. They sit on walls, they run firmware nobody updates, and they’re frequently reachable from the internet through sloppy port-forwarding. A camera is not a computer you trust — it’s a sensor that happens to have a network stack.
Putting cameras on the same VLAN as your workstations means any camera compromise is one hop away from your files. Isolated on their own VLAN with a firewall rule that only allows the NVR to pull their streams, a compromised camera can’t see your file server, can’t hit your Wi-Fi, can’t be reached from your workstations. It becomes a nuisance instead of an incident.
Guest Wi-Fi is the same story
Guests bring devices you know nothing about. A guest VLAN with internet-only access (plus maybe printer access if you’re generous) means their laptop’s malware doesn’t become your ransomware. This is the single cheapest security improvement you can make to a network — it costs nothing but configuration time.
How UniFi makes this easy
UniFi’s built-in VLANs (Corporate / Guest / Camera / IoT) map directly to this. On a UDM or Dream Machine, enabling Guest and Camera networks is a few clicks. The subtle work is in the firewall rules and the DHCP/management story:
- Camera VLAN: no route to office VLAN, NVR-only management access.
- Guest VLAN: no route to anything, isolated from your local subnets.
- IoT (printers, thermostats): no route to office, allowed to talk to each other where needed.
Where this goes wrong in practice
The three most common failure modes we see on “segmented” networks:
- Cameras still on the office VLAN — segmentation was done for guests only.
- VLANs exist but inter-VLAN routing is wide open — the firewall rules were never written, so segmentation is decorative.
- No documentation — a year later, nobody knows which VLAN is which, and the next person just flattens it.
The takeaway
Segmentation isn’t about buying gear — it’s about design discipline and firewall rules. On a flat network, the highest-leverage upgrade isn’t a new access point; it’s putting cameras and guests in their own VLANs and enforcing it at the gateway.
If that sounds like your environment, scope a plan — we’ll design the segmentation, migrate it without breaking your day, and document it so it stays that way.