UniFi VLAN Segmentation & Firewall Design

A practical, opinionated UniFi design for isolating Home, Guest, IoT, and VPN networks with proper north–south exposure (Plex, WireGuard, Reverse Proxy) and strict east–west segmentation. This layout mirrors my homelab but also applies to SMB and enterprise.

1. Design Goals

Fully isolate Home from IoT & Guest networks.
Allow controlled access (e.g., IoT cameras → NVR, TVs → Plex).
Force internal DNS usage via AdGuard/Unbound.
Expose only required services to WAN (WireGuard, NGINX/Proxy).
Keep firewall policies clean, predictable, and maintainable.

2. VLAN & Subnet Layout

Below is the structure used in my environment. Adjust IDs, names, and subnets to fit yours.

VLAN Definitions

VLAN	Name	Subnet	Use Case
1	Home	10.10.10.0/24	PCs, Servers, Lab, Admin Devices
2	Guest	192.168.20.0/24	Guests → Internet Only
3	PrivateInternetAccess	192.168.30.0/24	Forced egress through VPN
4	IoT	192.168.40.0/24	TVs, Cameras, Smart Devices

3. Create Networks in UniFi

Open UniFi Network.
Go to Settings → Networks → Create New Network.
For each VLAN:
- Name (e.g. Home)
- Purpose: Corporate
- VLAN ID: matches table above
- Gateway/Subnet: x.x.x.1/24
- DHCP: enable for client VLANs

VLANs exist now, but without firewall rules everything can still talk freely.

4. Assign VLANs to Switch Ports & Wi-Fi

Switch Ports

Create Port Profiles for Home, Guest, IoT, VPN.
Use trunk uplinks between switches/APs.
Assign ports based on device role: IoT → IoT, Servers → Home.

Wi-Fi SSIDs

Home → VLAN 1
Guest → VLAN 2 (with guest isolation)
IoT → VLAN 4 (WPA2 only if required)

5. Firewall Strategy

UniFi processes rules top-to-bottom. I structure my rules into logical “zones”:

LAN IN — VLAN → VLAN traffic
LAN LOCAL — VLAN → Gateway
WAN IN — Internet → LAN
WAN OUT — LAN → Internet

The fundamental rule-set is:

Deny inter-VLAN by default
Allow only required flows
Allow management devices to reach UniFi / gateway

6. Example Firewall Rules

These are templates — adapt as needed.

Deny East/West by Default

Rule Name: Block IoT → Home
Direction: LAN IN
Interface: IoT
Action: Drop
Source: 192.168.40.0/24
Destination: 10.10.10.0/24
Comment: Prevent IoT access into Home

Rule Name: Block Guest → RFC1918
Direction: LAN IN
Interface: Guest
Action: Drop
Source: 192.168.20.0/24
Destination: Any RFC1918
Comment: Guest → Internet only

Allow Required Flows

Rule Name: Home → IoT Cameras
Direction: LAN IN
Interface: IoT
Action: Accept
Source: 10.10.10.0/24
Destination: Camera VLAN / IPs
Ports: 80, 443, 554
Comment: Permit camera viewing

Rule Name: IoT → DNS/NTP
Direction: LAN OUT
Action: Accept
Source: 192.168.40.0/24
Destination: Internal DNS + NTP
Ports: UDP 53, 123
Comment: Controlled egress only

7. DNS & Egress Control

Prevent DNS bypass:

Set DHCP DNS to internal resolvers (AdGuard, Unbound).
Create a WAN OUT drop rule:

Rule Name: Block Direct DNS to Internet
Direction: WAN OUT
Action: Drop
Source: All RFC1918
Destination: Any
Ports: TCP/UDP 53, 853
Comment: Force internal DNS usage

8. Testing & Validation

Guest devices: confirm internet works, LAN access blocked.
Home devices: confirm cameras & Plex work as expected.
Verify DNS path with:

nslookup google.com
tracert 8.8.8.8