A VLAN (Virtual LAN) lets you run multiple logically separate networks over the same physical switches and access points — the basis for keeping guest devices, security cameras, and staff computers apart even though they share the same cabling.

Steps to Create a VLAN

1. In the UniFi Network application, go to Settings > Networks and click Create New Network.
2. Name the network clearly, e.g. "Cameras" or "Guest."
3. Set a unique VLAN ID (a number from 1–4094) — this is what actually separates the traffic at the network level.
4. Assign a subnet for the VLAN (e.g. 192.168.20.0/24) distinct from your other networks.
5. Configure DHCP for the VLAN if devices on it should get IP addresses automatically.
6. Save the network.

Applying the VLAN

• Wired devices: on the relevant switch port's settings, set the port's network/VLAN to the one you created.
• Wireless devices: create a new Wi-Fi SSID under Settings > WiFi and assign it to the VLAN under that network's advanced options, so anything connecting to that SSID lands on the correct VLAN automatically.

Common Questions

Do VLANs alone keep traffic separated?

VLANs separate broadcast traffic and give each network its own subnet, but by default a UniFi gateway may still route between them. To actually block one VLAN from reaching another, add firewall rules between the VLANs (see our firewall rules guide).

How many VLANs does a small business actually need?

A common starting setup is three: one for staff/trusted devices, one for guest Wi-Fi, and one for IoT/cameras — expand from there only as a real need comes up, rather than over-segmenting from day one.