How to Set Up UniFi IoT VLAN Isolation, Step by Step

Here is how to set up UniFi IoT VLAN isolation in five steps: create a virtual network in Settings > Networks (VLAN 30, 192.168.30.0/24), place it in a custom IoT firewall zone, bind a 2.4 GHz WPA2 SSID and Block All switch ports to it, allow Internal to IoT with return traffic, and scope the mDNS proxy to casting services.

The screens below assume a UniFi Cloud Gateway (UDM Pro, Cloud Gateway Ultra) or a standalone UniFi Gateway on UniFi Network 9.0 or newer with gateway firmware 4.1 or newer, Ubiquiti’s floor for the zone-based firewall. Older releases use LAN IN rules; the logic carries over, the menus do not.

Why isn’t a new UniFi VLAN isolated already?

A new virtual network is not isolated because it joins the built-in Internal zone, and Ubiquiti’s Zone Matrix sets Internal to Internal as Allow All. Until you change that, a smart plug on VLAN 30 can open connections to a NAS on VLAN 1. The VLAN separates broadcast domains; the firewall decides who talks to whom.

Network Isolation is a one-click toggle that generates inter-VLAN block rules, which suits a guest segment where nothing needs in. IoT always needs exceptions, so use a custom zone. Per WunderTech’s zone matrix walkthrough, a new custom zone reads Block All toward Internal, VPN, Hotspot, DMZ and itself, and Allow All toward External and Gateway: internet, DHCP and DNS, nothing else. Use one method per network, not both.

Step 1: Create the IoT virtual network

Plan addressing first. A /24 per segment is plenty for a house, and matching the third octet to the VLAN ID keeps packet captures readable.

VLAN 31 is optional: it holds cameras recording to a local NVR and devices driven entirely by Home Assistant.

In Settings > Networks, create a new virtual network:

1. Name it IoT.
2. Turn off Auto-Scale Network; set the host address to 192.168.30.1/24.
3. Under Advanced, choose Manual and set VLAN ID 30.
4. Set DHCP to 192.168.30.100–192.168.30.250, leaving low addresses for fixed IPs.
5. Leave Network Isolation off; the zone does that job.
6. Apply Changes.

That sequence follows LazyAdmin’s UniFi VLAN guide. Ubiquiti’s virtual network article adds the part people miss: VLANs on UniFi gateways “don’t automatically assign devices to them.” Step 4 does that.

Routing with pfSense on a Netgate 6100 instead? Build VLAN and DHCP there, then add the network in UniFi as Third-party Gateway with the same VLAN ID, and firewall on pfSense.

Step 2: Move the network into a custom IoT zone

Open the zone-based firewall (Settings > Security > Firewall in the 9.x interface, per HostiFi), create a zone named IoT, and move the IoT network into it. Each interface belongs to exactly one zone, and deleting a custom zone deletes every policy attached to it.

Read the matrix after the move rather than trusting defaults: the IoT row should show Block All to Internal and Allow All to External and Gateway. Repeat for IoT-Local if you built VLAN 31.

Step 3: Add exception policies in apply order

Policies evaluate top to bottom and the first match wins. Custom policies sit above the locked built-in ones, which you cannot edit but can override from above. Create these, then click the zone pair and use Reorder to confirm the sequence:

Policy 1 lets your phone control the TV while the TV can only reply. Policy 2 closes SSH and the web UI on every gateway interface, including 192.168.30.1. Keep it to those three ports: DHCP (UDP 67/68) and DNS (UDP/TCP 53) are served from the Gateway zone, and blocking that zone outright can break both. Policy 4 is the template for every IoT-initiated exception: one source IP, one destination IP, one port.

Shadowing risks:

• A broad allow above a narrow block wins. An “IoT to Internal, Any” policy added while debugging shadows everything below it; disable it before you close the tab.
• Auto Allow Return Traffic already creates the reply policy. A separate IoT-to-Internal allow “for replies” also permits new connections.

Leave UPnP off. A device that can create its own port forward walks around the zone you just built.

Step 4: Put devices on the IoT VLAN

Wi-Fi. In Settings > WiFi, create an SSID with Network set to IoT. Ubiquiti’s IoT connectivity guidance calls for a dedicated SSID with IoT enabled under WiFi Optimization, WPA2 rather than WPA3 on 2.4 GHz, PMF off (it cannot be disabled on WPA2/WPA3 or WPA3), Fast Roaming (802.11r) off, and signal better than -70 dBm. Restrict the SSID to 2.4 GHz if devices fail to join. On U7 access points, update firmware first, then fall back to a 2.4 GHz-only WPA2 SSID.

Wired. In the Ports tab, select the port, set Native VLAN / Network to IoT and Tagged VLAN Management to Block All, which makes it an access port in Ubiquiti’s trunk and access port terms. Uplinks and AP ports stay Allow All, or Custom with VLAN 30 included. Never make an AP port’s native VLAN the network that AP broadcasts (VLAN 1 excepted); clients will fail to join. If a device gets no lease, trace the path to the gateway with VLAN Viewer, as the VLAN troubleshooting guide describes.

Keep APs and switches managed on Default. Pushing infrastructure onto the IoT VLAN with Network Override is a reliable way to strand it; the adoption failed guide covers recovery. Adding a PoE switch for wired IoT gear? Size it with the PoE budget and switch planning guide.

Step 5: Restore discovery with the mDNS proxy

AirPlay, Google Cast, HomeKit and AirPrint find each other over mDNS: UDP 5353 to 224.0.0.251 or FF02::FB, for names RFC 6762, “Multicast DNS” defines as link-local. Queriers must only accept responses that originate on the local link, so a phone on VLAN 1 never sees a TV on VLAN 30 without a proxy.

The UniFi gateway mDNS proxy has three modes. Auto retransmits common services across all VLANs, Off stops it, and Custom lets you pick the VLAN scope and services, including your own in _service._protocol.local form such as _airplay._tcp.local. Ubiquiti enables it automatically on newly created networks, so check what is already being reflected. Use Custom, scoped to Default and IoT, with only the services you cast to. Watch the per-model cap on mDNS-enabled networks: 2 on the Express and UXG Lite, 30 on the UDM and UDR.

The proxy carries discovery only. The stream is unicast and rides policy 1. When the receiver fetches media from the phone, as some local-file casting does, the connection starts in IoT; add a policy-4-style rule for that receiver rather than opening the zone.

IGMP snooping is not your mDNS problem. RFC 4541 requires snooping switches to forward non-IGMP packets addressed to 224.0.0.X on all ports, so toggling it changes nothing for discovery. On the IoT SSID, Ubiquiti’s guidance sets Multicast Enhancement and Multicast and Broadcast Control off.

Test it before you call it done

From a laptop on the IoT SSID or an IoT access port:

ipconfig getifaddr en0        # macOS, expect 192.168.30.x (Linux: ip -4 addr)
ping -c 4 192.168.30.1        # IoT gateway answers
dig ui.com | grep SERVER      # expect 192.168.30.1#53
mtr -rwc 20 1.1.1.1           # clean internet path
ping -c 4 192.168.1.10        # Default-VLAN NAS: expect 100% loss
nc -vz -w 3 192.168.1.10 22   # expect timeout
nc -vz -w 3 192.168.30.1 443  # gateway UI: expect timeout
nc -vz -w 3 192.168.1.1 22    # gateway SSH, other interface: expect timeout

From a laptop on Default:

ping -c 4 192.168.30.50       # IoT device answers, if it replies to ICMP
dns-sd -B _airplay._tcp       # macOS; Linux: avahi-browse -rt _googlecast._tcp
iperf3 -c 192.168.30.60 -t 10 # vs iperf3 -s on VLAN 30: inter-VLAN routing rate

Then cast from your phone. If the TV appears but playback stalls, the fault is policy, not mDNS.

FAQ

do i need a separate ssid for iot devices on unifi

Not always, but it is the simplest route, because it lets you run 2.4 GHz-only WPA2 with Fast Roaming off for picky devices without changing your main SSID. To avoid another SSID, PPSK assigns the VLAN by password, though it requires WPA2 and is unavailable on 6 GHz. Virtual Network Override assigns it by MAC address instead.

should iot devices have internet access

Many need it, because cloud-dependent plugs, speakers and thermostats stop responding without their vendor’s servers, so keep the IoT zone’s default Allow All toward External. Put local-only gear, such as cameras recording to a local NVR or devices driven entirely by Home Assistant, in a second zone with a Block All policy toward External.

why can’t i see my chromecast on another vlan in unifi

Because discovery runs on mDNS, link-local multicast on UDP 5353 that never crosses a router by itself. Set the UniFi gateway’s mDNS proxy to Custom, include both the phone’s network and the IoT network in its VLAN scope, and select or add the _googlecast._tcp service. Discovery alone is not enough: an Internal-to-IoT allow policy must exist too.

is network isolation the same as client device isolation in unifi

No. Network Isolation is a per-network gateway setting that generates firewall rules blocking traffic between VLANs. Client Device Isolation is a Wi-Fi setting that stops clients on the same access point from reaching each other, and Device Isolation (ACL) does the equivalent on switches. Devices sharing one VLAN never pass through the gateway firewall at all.