Sanu VargheseIT & AI notes
Tutorials › UniFi
BeginnerUniFi · about 20 min · 27 October 2026

Create a VLAN in UniFi and put Wi-Fi and switch ports on it

A VLAN lets you split one physical network into separate virtual networks, so printers, cameras, staff laptops and guests don't all share the same space. In UniFi this takes three jobs: create the network, put Wi-Fi on it, and put switch ports on it. This guide walks through all three on a UniFi Gateway.

Before you start

  • You need admin access to the UniFi Network application, locally or through unifi.ui.com.
  • Take a backup first: Settings > Control Plane > Backups.
  • Decide your plan on paper: the network name, a VLAN ID (for example 20), and a subnet that doesn't clash with anything else (for example 192.168.20.0/24).
  • Do this from a device that will stay on your current main network. Don't change the port or Wi-Fi you're connected through.
This guide assumes a UniFi Gateway is your router. If you use a third-party router or firewall, create the VLAN, subnet and DHCP there first, then in UniFi choose Third-party Gateway under Router and use the same VLAN ID.

Part 1: Create the virtual network

  1. Open UniFi Network and go to Settings > Networks.
  2. Create a new virtual network.
  3. Give it a clear Name, for example Printers or CCTV.
  4. Set the VLAN ID you chose, for example 20.
  5. Set the subnet range and check that DHCP is on, so devices that join get an address automatically.
  6. If devices on this network shouldn't talk to your other networks, turn on network isolation. Content filtering and DNS options are on the same page if you need them.
  7. Click Apply Changes.
Creating a VLAN doesn't move any devices onto it. Nothing changes for users until you assign Wi-Fi or switch ports in the next two parts.

Part 2: Put a Wi-Fi network on the VLAN

Each Wi-Fi name (SSID) maps to one VLAN, so every client that joins it lands on that network.

  1. Go to Settings > WiFi.
  2. Create a new WiFi, or open an existing one you want to move.
  3. Open the Network dropdown and select the network you created in Part 1.
  4. Choose which access points broadcast it: all APs, specific APs, or AP groups.
  5. Leave the security on the default (WPA2/WPA3 Personal) unless you have older devices. For older IoT kit, Ubiquiti suggests a separate SSID set to WPA2 Personal under Advanced, which turns off 6 GHz for that SSID only.
  6. Save and apply the change.
Changing the Network on an existing Wi-Fi moves every connected client to a new subnet straight away. Anything relying on a fixed IP address or a DHCP reservation on the old network will break. Do it outside working hours and tell users first.

Part 3: Put a switch port on the VLAN

Use this for fixed devices such as printers, servers or cameras.

  1. Open your UniFi switch and go to the Ports tab.
  2. Select the port the device is plugged into.
  3. Set Native VLAN / Network to the network you created.
  4. Under Tagged VLAN Management, choose Block All (Access Port), so the port only passes this one network. That's what you want for a single device.
  5. Apply the changes.
Never change the uplink port to your gateway, or the ports your access points and other switches connect to, unless you know exactly what you're doing. Ubiquiti warns that restricting a VLAN on an uplink can cut off everything downstream, and that an AP port's native VLAN shouldn't match a network the AP broadcasts unless it's VLAN 1. Leave those ports on the default Allow All (Trunk Port).

Check it worked

  1. Connect a laptop or phone to the new Wi-Fi, or plug a device into the port you changed.
  2. Check its IP address. On Windows, open Command Prompt and run the command below. The address should be in the new subnet, for example 192.168.20.x.
ipconfig
  1. In UniFi Network, open the client list, find the device and check it shows the new network.
  2. Check it can reach the internet.
  3. If you turned on isolation, try to ping a device on your main network. It should fail.

If a device gets no address or loses its connection, the usual cause is VLAN tagging on a switch port between it and the gateway. Check the uplink ports are still set to Allow All (Trunk Port).

Sources

← All tutorials
Esc