Implementing VLAN Segmentation in UniFi: Isolating Network Traffic by Security Tier

Overview

This article implements VLAN segmentation in UniFi to isolate network traffic by security tier. You'll create 10 VLANs organized into four tiers, configure WiFi SSIDs for each zone, set up switch port profiles for wired devices, and enable MAC filtering to prevent physical attacks. All changes are made in the UniFi console - no cluster modifications yet.

Before You Begin

Prerequisites

• Home Lab V2 completed (working cluster)
• Access to UniFi console (unifi.ui.com or local)

What We're Setting Up

Why VLANs

V2's flat network means any device can reach any other device. A compromised game server pod can reach the UDM, NAS, and personal devices - no container escape required, just network access.

VLANs create layer 2 boundaries. Devices on different VLANs can only communicate if firewall rules explicitly allow it (configured in the next article).

How Zones Work

Custom zones provide default-deny security between network tiers¹. Unlike the built-in Internal zone (which allows all traffic between VLANs), custom zones block all traffic by default.

After creating intra-zone Allow policies (Core → Core, Lab → Lab, Trusted → Trusted), devices within the same zone can communicate. Isolated stays Block All for defense in depth. Cross-zone policies are added in article 02.

VLAN Configuration Notes

Toggle VLAN ID from Auto to Manual to unlock the checkbox settings². Assign each VLAN to a custom zone¹ and disable Auto-Scale³ when you need custom DHCP ranges.

Why Isolate on Isolated VLANs? Custom zones block traffic between zones. Isolate Network blocks traffic within the same VLAN (L2 isolation). For Isolated VLANs, both are needed.

Why mDNS on Trusted VLANs? AirPlay, HomeKit, Chromecast, and Matter use mDNS for device discovery⁴. Enable mDNS on VLANs with discoverable devices (Things-Trusted, Things-Isolated) and VLANs with devices that need to discover them (Unrestricted-Trusted). The mDNS Proxy forwards discovery traffic between VLANs. Things-Isolated devices like Philips Hue need mDNS so HomePods can discover them for Siri control - mDNS is multicast advertisement, not initiating connections, so isolation is preserved.

How mDNS/IGMP columns work: Enabling mDNS or IGMP per-VLAN automatically adds that VLAN to the Gateway mDNS Proxy and IGMP Snooping scope. UniFi sets Custom mode and only proxies between VLANs where you enabled these features - not globally.

Why 5 GHz for main/filtered? iPhones, Macs, and iPads all support 5 GHz⁵. Using 5 GHz only for primary networks frees up 2.4 GHz slots for IoT and restricted devices. Home uses dual-band for HomePod compatibility. Note that 5 GHz has shorter range through walls - ensure adequate AP coverage.

Why Internet on Drive but not Protect? UNAS Pro needs internet for external file sharing via drop.ui.com⁶. Protect cameras only communicate locally with the UDM controller - no internet required.

Why speed limits on Isolated networks? Isolated devices are untrusted by definition - guests, IoT, managed devices. Speed limits add another layer of defense. Trusted networks are your own devices and don't need limits.

Why 15 Mbps for Personal? 1080p streaming requires 5-8 Mbps⁷ and FaceTime needs 1-5 Mbps⁸. 15 Mbps down / 5 Mbps up supports both while preventing bandwidth hogging on guest and sandbox networks. WiFi Speed Limits apply per client⁹ - each device gets its own limit, not shared across the SSID.

Why 2 Mbps for IoT? Philips Hue Bridge uses 1-2 Mbps¹⁰, and smart plugs/sensors need even less. 2 Mbps covers legitimate use while ensuring compromised devices can't be useful for data exfiltration or botnet activity - defense in depth.

Why custom DHCP ranges? Network and Lab have Scale disabled to reserve IPs:

Keep other defaults: DHCP Server mode, Auto Default Gateway, Auto DNS Server, Lease Time 86400.

Create Firewall Zones

Navigate to Settings → Security → Zones → Create Zone for each zone.

Intra-Zone Policies

Navigate to Settings → Security → Zones → click the Block All cell → Create Policy.

Leave Isolated → Isolated as Block All.

Create VLANs

Navigate to Settings → Networks → Create New Network for each VLAN.

Core Tier

Exposed Tier

Things Tier

Users Tier

Navigate to Settings → Networks and verify 10 networks are listed.

Create WiFi Networks

Navigate to Settings → WiFi, scroll to the bottom, and click Create New under WiFi Speed Limit.

WiFi Speed Limits

WiFi Blackout Schedules

Blackout schedules are configured per-SSID. After creating each SSID, navigate to Advanced → WiFi Blackout Schedule → On and set the schedule.

Apply Downtime to guest, filtered, and sandbox SSIDs.

WiFi Configuration

Navigate to Settings → WiFi → Create New for each SSID¹¹.

Hidden networks are configured once on devices. IoT and sandbox use 2.4 GHz only - 5 GHz band is at capacity. Band Steering pushes dual-band devices to 5 GHz. Blackout schedules disable WiFi during set times for restricted networks.

Navigate to Settings → WiFi and verify 6 SSIDs exist with correct VLAN mappings.

Create Port Profiles

Navigate to Settings → Networks, scroll to the bottom, and click Create New under Ethernet Port Profiles.

AP-Trunk is Active because WiFi client traffic keeps its original source MAC - filtering would block all clients. All other profiles are Restricted with allowed MACs to prevent unauthorized devices.

Assign Port Profiles

Navigate to Devices → [Switch] → Ports, select a port, and set Port Profile.

Navigate to Settings → Networks → Ethernet Port Profiles and verify 8 profiles exist.

Next Steps

VLANs and zones are configured with default-deny between zones. Devices on different zones can't communicate until firewall rules allow it.

Expected: Cross-zone access is blocked - Unrestricted-Trusted (Users) cannot reach Drive (Core) until firewall rules are added.

See: Firewall Rules

Resources