How small businesses use UniFi to segment their network with VLANs
GNS Engineering Team 3 min read
A small business network is usually shared by staff, guests, CCTV, printers and IoT devices. Without separation, one compromised device can reach the whole network. VLANs are a low-cost way to reduce that risk. Here is how to segment a network properly with UniFi.
1. What a VLAN is, and why small businesses need one
A VLAN (virtual local area network) logically divides one set of hardware into separate zones. Each zone has its own IP subnet, and zones cannot reach each other by default unless a firewall rule allows it. A small business may not have dedicated IT staff, but as soon as guests, CCTV or POS devices share the network, segmentation stops one infected device from moving sideways.
2. Common VLAN groupings
- Staff: laptops, desktops and internal servers that may access company resources.
- Guest: internet access only, no access to internal systems, optionally behind a guest portal.
- IoT / CCTV / POS: cameras, printers and POS terminals that usually only need to talk to a specific system.
- Management: the admin interface of switches, access points and the gateway, for IT staff only.
3. Create the VLAN in UniFi Network
In the UniFi Network console, go to Settings → Networks and add a VLAN. You only need a name, a VLAN ID and a subnet such as 192.168.10.0/24. To restrict it further, enable the Isolate Network or Guest Network option to limit what that VLAN can reach.
4. Bind a Wi-Fi SSID to a VLAN
Each SSID can be bound to one VLAN. When you create a wireless network, choose the VLAN in the Network field. Devices on the staff Wi-Fi and the guest Wi-Fi then land on different subnets automatically, with no per-device setup.
5. Bind a switch port to a VLAN
Wired devices such as printers, CCTV or a specific desk can be bound to a VLAN by switch port. In the UniFi switch settings, set the port to Access and pick the VLAN; every device on that port then belongs to that subnet.
6. Control cross-VLAN traffic with firewall rules
After the VLANs exist, firewall rules decide who can reach whom. Start by blocking everything, then allow only what is needed — for example, the printer VLAN may reach the staff VLAN, and the CCTV VLAN may only reach the recorder. Then a breach in one zone cannot spread to the whole network.
7. Practical advice for small businesses
Do not build many VLANs at once. Start with the three most useful zones — staff, guest and IoT — move critical devices into their zones gradually, then add firewall rules. Record the current settings before each change so it is easy to roll back.
Summary
VLANs give a small business better security and clearer management at a reasonable cost. UniFi brings VLANs, SSIDs and switch ports into one console, so segmentation does not depend on complex commands. We design and configure VLANs, guest networks and firewall rules for offices, shops and schools in Hong Kong; the first site survey is free.
Frequently asked questions
When do I need a VLAN?
When guests, CCTV, POS or IoT devices share the same network, or when you need to separate staff from guests, a VLAN is worth using.
What is the difference between a VLAN and an SSID?
An SSID is the wireless network name; a VLAN is the logical zone that isolates traffic. Each SSID can be bound to a VLAN so connected devices land on the matching subnet.
I am not familiar with network settings — can you do it?
Yes. We design the VLANs, guest network and firewall rules around your business, and provide a record of the settings when finished.
Will adding VLANs slow the network down?
No. VLAN tags are handled in hardware, so the effect on everyday internet speed is negligible.
