UniFi · Network policy
UniFi VLAN and Network Segmentation Fundamentals
A separate network name is only the beginning. Good segmentation gives each device the connections it needs and verifies that unwanted access is blocked.
In plain English
A VLAN separates a local network into groups. A subnet is an address range. Routing connects those ranges; an access policy decides which communication should be permitted. A trunk carries multiple VLANs between compatible devices.
Reviewed September 2026 · 3 minute read
Write a small access plan first
Group devices by purpose: staff, guests, business servers, building devices and administration. Record what each group needs to reach. Creating many VLANs without a clear purpose adds support work without proving better protection.
| From | Allow | Restrict |
|---|---|---|
| Guests | Approved internet and necessary network services. | Internal business systems and administration. |
| Staff | Required applications and printing. | Unnecessary access to infrastructure settings. |
| Building devices | Named controllers and required update services. | Unrelated business networks. |
| Administrators | Approved management connections. | Access beyond the assigned role. |
Connect the VLAN from gateway to client
A VLAN identifies a separate Layer 2 network. Each routed network normally has its own nonoverlapping IP subnet. Record its VLAN ID, gateway, DHCP settings and DNS. If another vendor’s router handles it, configure addressing and access policy there as well.
- Endpoint port: an ordinary untagged device joins the port’s native VLAN. An access port typically carries only that network.
- Uplink: a trunk carries the required tagged VLANs between VLAN-aware devices. The permitted list must agree with the downstream requirements.
- Wireless: the SSID places clients on its assigned network. The AP uplink must carry those client VLANs while preserving the AP’s management path.
Review the official port-assignment guide before changing AP or switch uplinks. An incorrect native/tagged combination can strand equipment even when the cable is good.
Apply restrictions where traffic actually passes
Routing can connect VLANs. A different subnet is not proof of isolation. On a supported UniFi gateway, zone-based rules govern traffic between grouped interfaces; check the actual zone assignments, rule order and existing permissions. Configure the router doing the work, including any Layer 3 switch paths.
Allow required services with specific sources, destinations and protocols. Preserve essential DHCP and DNS when restricting gateway access. Printing or casting may need both discovery and application traffic; enabling discovery alone does not grant a working service. See UniFi’s firewall reference.
Use the appropriate routing/firewall policy for that path.
Evaluate supported switch ACLs and wireless client isolation for device-to-device traffic.
Gateway rules cannot filter traffic that never reaches the gateway. An AP isolation option also should not be assumed to cover every wired or other-AP path. Ubiquiti’s isolation guide separates these controls.
Test the policy, not just the settings
Use representative wired and wireless clients. For each important source-to-destination pair, record the application or port, expected result and observed result. Confirm addressing, DNS, required internet access and authorized business services.
Also test that guests cannot reach sensitive systems or administration. One failed ping proves little about other protocols. Include IPv6 when enabled and verify any same-network isolation requirement.
Control who can reach what
| From | To | Expected result |
|---|---|---|
| Staff | Approved printer service | Allow; verify the print job. |
| Guests | Approved internet service | Allow; verify name lookup and the task. |
| Guests | Printer / staff / administration | Block the defined paths and verify. |
Your practical challenge
For a staff laptop, guest phone and printer, write three required results: staff can print, guests can browse, guests cannot reach the printer or administration. Include the DNS and DHCP services each group needs. Test IPv6 behavior if enabled.
Explain your result, the evidence you used and what remains untested. Use the reference library when you need a chart or worked example.
Put it into practice
Check what you learned
Choose an answer for each question, then check your understanding. Your answers stay in this browser.
Read the answers and explanations
- Addressing is separate, but the access policy or its enforcement needs work.
Separate subnets do not by themselves establish blocked access.
- The port’s native/untagged VLAN assignment and the path carrying it.
Network assignment must match the intended endpoint and uplink configuration.
- Required apps succeed and prohibited access is blocked from representative devices, including IPv6 where used.
Acceptance must test each role’s intended behavior.
Sources and further reading
Keep your momentum
Ready for the next step?
If you can explain the example and your answer, try the next lesson. Revisit the feedback whenever you need it.
FryAVSI · Updated September 10, 2026
Reference this lesson or use a section’s direct link for a particular chart or example. How to cite an example.
FryAVSI · Northeast Ohio and beyond
A clear next step for your project.
Share the location, the challenge and your target timing. Our team will help define the work.