UniFi VLAN Segmentation & Firewall Design

A practical, opinionated UniFi design for isolating Home, Guest, IoT, and VPN networks with proper north–south exposure (Plex, WireGuard, Reverse Proxy) and strict east–west segmentation. A reference design that applies equally to homelab, SMB, and enterprise environments.

1. Design Goals

Fully isolate Home from IoT & Guest networks.
Allow controlled access (e.g., IoT cameras → NVR, TVs → Plex).
Force internal DNS usage via AdGuard/Unbound.
Expose only required services to WAN (WireGuard, NGINX/Proxy).
Keep firewall policies clean, predictable, and maintainable.

2. VLAN & Subnet Layout

Below is a reference segmentation structure. Adjust IDs, names, and subnets to fit your environment.

VLAN Definitions

VLAN	Name	Subnet	Use Case
1	Home	10.0.10.0/24	PCs, Servers, Lab, Admin Devices
2	Guest	10.0.20.0/24	Guests → Internet Only
3	PrivateInternetAccess	10.0.30.0/24	Forced egress through VPN
4	IoT	10.0.40.0/24	TVs, Cameras, Smart Devices

3. Create Networks in UniFi

Open UniFi Network.
Go to Settings → Networks → Create New Network.
For each VLAN:
- Name (e.g. Home)
- Purpose: Corporate
- VLAN ID: matches table above
- Gateway/Subnet: x.x.x.1/24
- DHCP: enable for client VLANs

VLANs exist now, but without firewall rules everything can still talk freely.

4. Assign VLANs to Switch Ports & Wi-Fi

Switch Ports

Create Port Profiles for Home, Guest, IoT, VPN.
Use trunk uplinks between switches/APs.
Assign ports based on device role: IoT → IoT, Servers → Home.

Wi-Fi SSIDs

Home → VLAN 1
Guest → VLAN 2 (with guest isolation)
IoT → VLAN 4 (WPA2 only if required)

5. Firewall Strategy

UniFi processes rules top-to-bottom. I structure my rules into logical “zones”:

LAN IN — VLAN → VLAN traffic
LAN LOCAL — VLAN → Gateway
WAN IN — Internet → LAN
WAN OUT — LAN → Internet

The fundamental rule-set is:

Deny inter-VLAN by default
Allow only required flows
Allow management devices to reach UniFi / gateway

6. Example Firewall Rules

These are templates — adapt as needed.

Deny East/West by Default

Rule Name: Block IoT → Home
Direction: LAN IN
Interface: IoT
Action: Drop
Source: 10.0.40.0/24
Destination: 10.0.10.0/24
Comment: Prevent IoT access into Home

Rule Name: Block Guest → RFC1918
Direction: LAN IN
Interface: Guest
Action: Drop
Source: 10.0.20.0/24
Destination: Any RFC1918
Comment: Guest → Internet only

Allow Required Flows

Rule Name: Home → IoT Cameras
Direction: LAN IN
Interface: IoT
Action: Accept
Source: 10.0.10.0/24
Destination: Camera VLAN / IPs
Ports: 80, 443, 554
Comment: Permit camera viewing

Rule Name: IoT → DNS/NTP
Direction: LAN OUT
Action: Accept
Source: 10.0.40.0/24
Destination: Internal DNS + NTP
Ports: UDP 53, 123
Comment: Controlled egress only

7. DNS & Egress Control

Prevent DNS bypass:

Set DHCP DNS to internal resolvers (AdGuard, Unbound).
Create a WAN OUT drop rule:

Rule Name: Block Direct DNS to Internet
Direction: WAN OUT
Action: Drop
Source: All RFC1918
Destination: Any
Ports: TCP/UDP 53, 853
Comment: Force internal DNS usage

8. Testing & Validation

Guest devices: confirm internet works, LAN access blocked.
Home devices: confirm cameras & Plex work as expected.
Verify DNS path with:

nslookup google.com
tracert 8.8.8.8