Hands-on walkthrough: create a VLAN network, SSID, switch port profile, and trunk to access points.
VLANs Step-by-Step in UniFi OS
Build a Guest VLAN from scratch — repeat the pattern for IoT, cameras, or voice.
Goal
- Corporate stays on existing LAN/VLAN.
- Guest WiFi on VLAN 20 with internet only — no access to printers or servers.
Step 1 — Create the network (VLAN)
- Settings → Networks → Create new.
- Name:
Guest, VLAN ID: 20. - Gateway: your UniFi gateway (for DHCP on that VLAN).
- Enable DHCP with an appropriate range (e.g.
192.168.20.1/24). - Save.
Step 2 — Create the WiFi SSID
- Settings → WiFi → Create new.
- Name:
Company-Guest. - Network: select Guest (VLAN 20).
- Security: WPA2/WPA3 personal with a strong password or portal.
- Enable Guest isolation / Block LAN to WLAN as available.
- Save.
Step 3 — Switch port profiles (if using UniFi switches)
- Settings → Profiles → Switch ports (or Port Profiles).
- Ensure AP uplink ports are Trunk All or include VLAN 20 tagged.
- Access ports for printers/PCs stay on corporate VLAN untagged.
Step 4 — AP provisioning
- APs must receive tagged VLAN 20 on their uplink (automatic when SSID maps to VLAN 20 on UniFi switches).
- Third-party switches: configure AP ports as trunk with VLAN 20 allowed.
Step 5 — Firewall rules
- Settings → Security → Firewall & Security (or Traffic Rules).
- Allow Guest → Internet.
- Deny Guest → Corporate subnets (RFC1918 to your LAN ranges).
- Log denied traffic temporarily while testing.
Step 6 — Test
- Connect a phone to
Company-Guest. - Confirm internet works.
- Try pinging a corporate printer IP — should fail.
Common mistakes
| Mistake | Symptom |
|---|---|
| AP uplink access port only | Guest SSID clients get no IP |
| No firewall deny to LAN | Guest reaches internal servers |
| Same VLAN ID on two networks | DHCP and routing chaos |
For design theory, see WiFi, VLANs, and Network Design Tips.