How to Set Up a VLAN for Smart Home IoT Devices

Why IoT Devices Need Their Own VLAN

Most consumer IoT devices are built with features, not security, as the priority. A budget smart plug, thermostat, or camera firmware may have known vulnerabilities, outdated OpenSSL libraries, or phone-home behaviour you can't disable. Putting all these devices on the same network as your laptops and NAS creates a real attack surface — if a compromised camera can reach your file server, you have a problem.

An IoT VLAN solves this by network segmentation: IoT devices can still reach the internet for cloud features and firmware updates, but they can't initiate connections to your main LAN devices. Your laptop can't be compromised by a rogue smart bulb. Your NAS can't be scanned by a camera with outdated firmware.

The practical setup is: IoT VLAN → internet allowed, IoT VLAN → main LAN blocked, main LAN → IoT VLAN allowed (for HA control). That asymmetry is the key — your trusted devices can reach IoT devices, but IoT devices can't spontaneously reach your trusted devices.

How VLANs Work

A VLAN (Virtual LAN) creates logically separate networks on the same physical hardware. Devices on VLAN 10 can't communicate directly with devices on VLAN 20, even if they're plugged into the same switch — the switch enforces the separation.

Tagged vs untagged ports:

• Untagged (access) port: A switch port configured for one VLAN only. The device plugged in doesn't need to know about VLANs — it just sees a normal network. Use untagged ports for IoT devices, cameras, and end devices that don't support VLAN tagging.
• Tagged (trunk) port: A port that carries traffic from multiple VLANs, tagged with VLAN IDs. Use trunk ports to connect switches to your router, and for Wi-Fi access points that need to broadcast multiple SSIDs (one per VLAN).

For a smart home IoT VLAN, you create a separate Wi-Fi SSID (e.g., "HomeIoT") that maps to VLAN 20, and configure switch ports for wired IoT devices as untagged VLAN 20. Your IoT devices connect to "HomeIoT" and land in VLAN 20 automatically.

Setting Up an IoT VLAN in UniFi

UniFi (Ubiquiti) makes VLAN setup relatively straightforward through the UniFi Network application.

1. Create the network: Go to Settings → Networks → Create New Network. Set Name: "IoT", VLAN ID: 20, IP subnet: 10.0.20.1/24, enable DHCP server (range: 10.0.20.100–10.0.20.254).
2. Create a Wi-Fi network for IoT: Go to Settings → WiFi → Create New WiFi. Set SSID: "HomeIoT", password, select "Advanced" and assign it to the IoT network (VLAN 20). Enable "IoT" toggle if available (limits client isolation).
3. Configure switch ports: For wired IoT devices (cameras, PoE switches), go to Devices → [Switch] → Ports. For each port connecting to an IoT device, set Port Profile to "IoT" (VLAN 20, untagged).
4. Add firewall rules: Go to Settings → Firewall & Security → Firewall Rules. See the firewall rules section below.

Setting Up an IoT VLAN in TP-Link Omada

Omada (TP-Link's controller-managed system) uses a slightly different interface but the same concepts.

1. Create VLAN network: In Omada Controller → Settings → Wired Networks → LAN → Create new network. Set Name: "IoT_VLAN", VLAN ID: 20, subnet: 10.0.20.1/24, enable DHCP.
2. Create IoT SSID: Go to Settings → Wireless Networks → Add SSID: "HomeIoT". Under VLAN, set VLAN ID to 20. This creates an isolated wireless network tagged to VLAN 20.
3. Configure switch ports: In Omada Controller → Devices → [Switch] → Config → Port Config. Set PVID (native VLAN) to 20 for ports connecting to IoT devices. Set Allowed VLANs to 20 only.
4. ACL rules: Go to Settings → ACL → Create rules for IoT → main LAN blocking. See firewall rules section.

Firewall Rules: Allow IoT → Internet, Block IoT → Main LAN

The essential firewall rules for an IoT VLAN (using UniFi rule syntax as reference — adapt for other platforms):

# Rule 1: Allow IoT devices to reach DNS (so devices can resolve hostnames)
Action: Accept
Source: IoT VLAN (10.0.20.0/24)
Destination: 10.0.20.1 port 53 (VLAN gateway DNS)
Protocol: TCP/UDP

# Rule 2: Allow IoT devices to reach the internet
Action: Accept
Source: IoT VLAN (10.0.20.0/24)
Destination: any (0.0.0.0/0)
Note: This rule is usually implicit if inter-VLAN blocking is the exception

# Rule 3: BLOCK IoT devices from reaching the main LAN
Action: Drop
Source: IoT VLAN (10.0.20.0/24)
Destination: Main LAN (192.168.1.0/24)
Protocol: all
Direction: LAN In

# Rule 4: Allow established/related connections back through
Action: Accept
State: Established, Related
Direction: LAN In
Note: Required so return traffic from IoT internet connections flows back

Letting Home Assistant Talk Across VLANs

Your Home Assistant server sits on the main LAN (or a dedicated server VLAN). It needs to reach IoT devices to control them — but IoT devices should not initiate connections back to HA (except for necessary callbacks like webhooks).

Create a firewall rule that allows traffic from the HA server's IP to the IoT VLAN:

# Rule: Allow Home Assistant to reach all IoT devices
Action: Accept
Source: 192.168.1.50 (Home Assistant server IP — assign a static IP)
Destination: IoT VLAN (10.0.20.0/24)
Protocol: all
Direction: LAN In
Priority: Above the "Block IoT → main LAN" rule

This allows HA to poll camera streams, send commands to smart plugs, and receive webhook callbacks from IoT devices. The "Block IoT → main LAN" rule still prevents any IoT device from spontaneously contacting your other LAN devices.

Assign your HA server a static IP — either via a DHCP reservation in your router or a static IP configured in HA OS (Settings → System → Network).

mDNS / Avahi Bridging for Cross-VLAN Device Discovery

Many IoT devices are discovered via mDNS (multicast DNS) — the protocol that lets you find devices by hostname (like mydevice.local) without knowing their IP. mDNS is multicast, and multicast traffic doesn't cross VLAN boundaries by default.

This means devices on VLAN 20 won't be automatically discovered by Home Assistant on VLAN 10 unless you set up mDNS forwarding.

UniFi: Enable mDNS (sometimes called "Multicast DNS") in Settings → Networks for each relevant network. UniFi's mDNS repeater bridges mDNS between VLANs automatically.

pfSense/OPNsense: Install and configure the Avahi package. Enable it on your IoT and main LAN interfaces. Avahi relays mDNS queries between configured interfaces.

Omada: Limited native mDNS bridging — use a separate Linux machine or your HA server running Avahi if needed.

[server]
use-ipv4=yes
use-ipv6=no

[publish]
disable-publishing=no

[reflector]
enable-reflector=yes
reflect-ipv=no

[rlimits]
rlimit-core=0
rlimit-data=4194304
rlimit-fsize=0
rlimit-nofile=768
rlimit-stack=4194304
nss-mdns-port=5353

FAQ

SmartWired participates in the Amazon Associates Programme. We may earn a commission from qualifying purchases at no extra cost to you.