VLANs are how you stop a cheap smart plug or a hacked camera from being able to reach the computers that run your business. They put each type of device in its own lane on the same network. UniFi makes this very doable, and as a team that designs this separation for businesses every week, here is how we approach it. If the term is new, our plain-English guide to what a VLAN is sets the scene. Menu labels vary by firmware, so we have kept to what you are doing.
Step by step
- Plan your lanes first. Decide the groups before you touch the controller: typically staff, guest, VoIP phones, CCTV, IoT and card payments. A quick list now saves rework later.
- Create a network for each. Go to Settings → Networks → New Virtual Network and give each one a name and its own VLAN ID. This is the heart of the job, each becomes its own lane.
- Assign WiFi and ports. Point each wireless network at its VLAN under Settings → WiFi → [your network] → Network, and set switch ports to the right network under Devices → [your switch] → Ports.
- Lock the doors between lanes. Under Settings → Routing & Firewall → Firewall / Traffic Rules, block traffic between VLANs by default and open only the routes you need. This default-deny is what makes the separation real.
- Place every device on the right lane. Cameras on CCTV, phones on voice, smart gadgets on IoT, tills on payments, nothing critical sharing with guests or gadgets.
- Prioritise voice. If you run VoIP, give the voice lane priority so calls stay clear under load, as we cover in should your phones be on their own VLAN.
- Test the isolation. From a device on one lane, confirm you cannot reach a device on another. If a guest laptop can see the finance PC, tighten the rules.
The setting that does the real work is default-deny between VLANs, blocking traffic between lanes and opening only what you need. Creating the VLANs is half the job; the firewall rules between them are what actually keeps a compromised gadget away from your business.
Stuck at any step? VLANs and firewall rules are the part people most often get tangled in, and you do not have to be a network engineer to have them done right. We design this separation for businesses every week, so if a device lands on the wrong lane or the rules are not behaving, one call and we will take it from here.
Frequently asked questions
Why put CCTV and IoT on their own VLAN?
Cameras and cheap smart devices are common weak points. On their own VLAN, a compromised camera or gadget is boxed in and cannot reach your computers, files or payment systems, which contains the damage if one is ever exploited.
How many VLANs does a business need?
As many as you have distinct groups to separate. A common set is staff, guest, voice, CCTV, IoT and payments, but it depends on your setup. The principle is simple: anything you would not want talking to your core systems gets its own lane.
Will VLANs slow my network down?
No. Done properly they can actually improve performance by cutting background noise between groups, and they add a big security benefit. The work is in the configuration, not in any speed cost.
Do I need a managed switch for VLANs?
Yes, VLANs need managed switches (and access points) that understand them, which is exactly what UniFi kit is. A Dream Machine with UniFi switches and APs handles VLANs across the whole network from one controller.
How Synergy Max helps
Getting VLANs right, especially the firewall rules between them, is where this moves from fiddly to genuinely secure, and it is everyday work for us. We design and configure the separation on your UniFi network so staff, guests, phones, cameras and payments each sit in their own lane with only the doors you want open. Our UniFi for hotels and HMOs guide shows the common mistakes we fix, and if something is misbehaving, our UniFi troubleshooting guide helps.