Reference layout for a typical single-site office: ISP, gateway, switch, APs, VLANs, and your hosted controller.
Small Office Network Topology
A common single-site office layout using UniFi and an i2unifi hosted controller.
Diagram (typical layout)
[ Hosted UniFi Controller ]
[ (i2unifi cloud) ]
^
| HTTPS / inform
|
[Internet] ---> [ISP Modem] ---> [UniFi Gateway] ---> [PoE Switch] ---+--- [AP - Lobby]
| | | +--- [AP - Office]
(bridge mode | | +--- [AP - Warehouse]
recommended) | |
+--- [Optional: Server/NVR VLAN]
Role of each layer
| Device | Role |
|---|---|
| ISP modem | Hands off public IP (or CGNAT) to your gateway |
| UniFi Gateway (UDM, UXG, USG) | NAT, firewall, DHCP, DNS, inter-VLAN routing |
| PoE Switch | Powers APs; carries VLAN trunks to access points |
| Access Points | WiFi for staff, guest, IoT SSIDs mapped to VLANs |
| Hosted controller | Management only — not in the data path for client traffic |
Recommended VLANs (starter set)
| VLAN | Purpose | WiFi SSID example |
|---|---|---|
| 1 or native | Corporate LAN | Company-Secure |
| 20 | Guest | Company-Guest |
| 30 | IoT / printers | IoT (hidden) |
| 40 | Cameras/NVR | wired only |
Traffic flow (simplified)
- Client associates to SSID on an AP.
- AP tags traffic with the SSID’s VLAN.
- Switch trunks VLANs to the gateway.
- Gateway applies firewall rules between VLANs and to the internet.
Design rules of thumb
- One gateway per site for routing — avoid accidental double NAT.
- Wire APs when possible; use mesh only as a last resort.
- Put guest and IoT on separate VLANs with client isolation and deny access to corporate subnets.
- Keep NVR/cameras off the guest WiFi.
Scaling up
- Multiple switches: connect with a single uplink path; avoid loops without STP planning.
- Multiple sites: use separate UniFi sites on one controller, or separate controllers per customer if you are an MSP.
Next steps
- VLANs Step-by-Step in UniFi OS — build this topology in software
- Choosing and Placing UniFi Access Points — physical layout
- Gateway and Firewall Basics — secure the edge