How to Set Up VLANs for a Small Business Network (2026 Guide)

by











How to Set Up VLANs for a Small Business Network (2026 Guide) | PCFixHub


How to Set Up VLANs for a Small Business Network (2026 Guide)


Category: Networking

I’ve been fixing and building small business networks for 16 years out of Cincinnati, and I can tell you that VLANs are one of those topics that sends business owners running for the door. The acronym alone sounds like something out of a network engineering textbook. But here’s the truth: VLANs are not complicated. Once you understand what they actually do, setting them up is just a series of clicks in a web interface.

In this guide, I’m going to walk you through how to set up VLANs for a small business — from understanding what they are, to picking the right hardware, to configuring them step by step in both TP-Link Omada and UniFi. I’ll also cover firewall rules, testing, and the mistakes I see clients make every single time. By the end, you’ll have a network that’s genuinely more secure than 90% of small businesses in your area.

No networking degree required. Let’s get into it.

What Is a VLAN and Why Should You Care?

VLAN stands for Virtual Local Area Network. The simplest way I explain it to clients is this: imagine your office building has multiple floors, and each floor requires a different security badge to access. Someone with a first-floor badge can’t just wander up to the executive suite on the third floor. VLANs work exactly the same way — they divide your single physical network into separate virtual networks, each with its own rules about who can talk to whom.

Without VLANs, your network is one big flat room where every device can see and potentially reach every other device. Your guest WiFi connects to the same network as your financial workstations. Your cheap IoT security cameras sit right alongside your file server. That’s a problem. Security cameras are notoriously insecure devices — they often run old firmware, have weak default passwords, and are frequently the entry point hackers use to get deeper into a network.

Here’s a concrete example of why this matters. A few years back, a client of mine had a guest WiFi network that wasn’t isolated. A visitor connected, and their laptop — unknowingly infected with malware — started probing every device on the network. It reached a network-attached storage drive and encrypted it. A VLAN would have contained that threat to the guest network with zero access to anything else.

With VLANs in place, your security cameras can’t reach your accounting software. Your guest WiFi users can get to the internet but nothing internal. Your staff machines are completely hidden from the IoT floor. You get the same level of separation you’d get from running three physically separate networks — without buying three separate sets of hardware.

That’s the power of network segmentation for small business: enterprise-grade protection at small business prices.

The 3 VLANs Every Small Business Needs

You don’t need to get exotic here. For the vast majority of small offices — whether you’re a law firm, a dental practice, a retail shop, or a contractor — three VLANs covers everything. Here’s what I recommend and why.

VLAN 10 — Corporate (Staff) Network

Subnet: 192.168.10.0/24 | VLAN ID: 10

This is your trusted network. Staff laptops, desktops, printers, servers, and NAS drives live here. Devices on this VLAN get full internet access and can communicate with each other freely. This is the floor with the highest security clearance. Access to all other VLANs is controlled by your firewall rules.

VLAN 20 — Guest Network

Subnet: 192.168.20.0/24 | VLAN ID: 20

Customers, visitors, and anyone who doesn’t need access to your internal systems goes here. They get internet access and nothing else. They cannot reach VLAN 10 or VLAN 30. You can also apply bandwidth limits here so a guest streaming video doesn’t slow down your staff. Think of this as the lobby — comfortable, functional, but with no access to the back office.

VLAN 30 — IoT / Cameras

Subnet: 192.168.30.0/24 | VLAN ID: 30

Security cameras, smart TVs, VoIP phones, thermostats, badge readers, and any other “smart” device goes on this VLAN. These devices are kept away from both your staff machines and your guests. The only devices that can initiate a connection to VLAN 30 are the ones on VLAN 10 (so your staff can pull up the camera feeds), and even that access can be locked down to specific IPs if you want to go further.

Three VLANs, three subnets, three separate badges. That’s the foundation of a well-structured small business network.

VLAN Purpose Subnet Internet Access Can Reach Corp?
VLAN 10 — Corporate Staff devices, servers, printers 192.168.10.0/24 Yes N/A
VLAN 20 — Guest Visitors, customer WiFi 192.168.20.0/24 Yes No
VLAN 30 — IoT/Cameras Cameras, smart devices 192.168.30.0/24 Yes (limited) No (Corp can reach IoT)

What Hardware Supports VLANs

This is where I see a lot of small business owners get tripped up. You cannot implement VLANs on a consumer-grade, unmanaged switch — the kind you might buy at Best Buy for $30. An unmanaged switch has zero intelligence. It just forwards traffic. For VLANs, you need three things: a VLAN-capable router or gateway, a managed switch, and wireless access points that support multiple SSIDs mapped to different VLANs.

Managed Switches

A managed switch lets you tag and separate traffic between VLANs on each individual port. The two ecosystems I recommend most for small business are TP-Link Omada and Ubiquiti UniFi. Both have managed switches in the $100–$400 range that handle VLANs cleanly.

  • TP-Link TL-SG2428P — 24-port gigabit managed PoE+ switch. Integrates with the Omada controller. Great value for a small office that needs PoE to power access points and cameras. Check current price on Amazon.
  • TP-Link TL-SG3428 — Step up to Layer 2+ managed features, 4x SFP uplinks, ACLs, and IP-MAC-Port binding for tighter security. Good choice if you’re growing. View on Amazon.
  • Ubiquiti UniFi Switch 24 — 24-port Layer 2 managed switch that integrates directly into the UniFi controller. Seamless VLAN configuration through the same interface you use to manage your APs. View on Amazon.

VLAN-Capable Routers / Gateways

Your router (or gateway) needs to be able to route traffic between VLANs and enforce firewall rules between them. Both the TP-Link Omada ER605 and the Ubiquiti UniFi Dream Machine handle this natively within their respective controller ecosystems. If you’re mixing brands, you’ll need to make sure your router supports 802.1Q VLAN tagging.

Access Points (APs)

Your APs need to support multiple SSIDs — one per VLAN. Consumer-grade APs typically only support a single or dual SSID with no VLAN tagging. Business-class APs handle this easily.

  • TP-Link Omada EAP670 — Wi-Fi 6, AX5400, 2.5GbE port, up to 16 SSIDs. Excellent performance and great value at around $150. Integrates directly into the Omada controller. My go-to recommendation for Omada builds. Check price on Amazon.
  • TP-Link Omada EAP610 — Budget-friendly entry-level Wi-Fi 6 AP at around $90. Handles VLANs just as well as the EAP670 with slightly lower throughput. Good for smaller spaces. Check price on Amazon.
  • Ubiquiti UniFi U6 Pro — Wi-Fi 6, 5.3 Gbps aggregate throughput, 4×4 MIMO. $159 direct from Ubiquiti. Ideal for offices with a high density of connected devices. Deeply integrated into the UniFi ecosystem. Check price on Amazon.

My personal recommendation: if you want simplicity and value, go full Omada. If you want a more mature ecosystem with advanced features and don’t mind paying a bit more, go UniFi. I’ve covered this comparison in more depth in my Omada vs UniFi for Small Business guide — worth a read before you buy anything.

Setting Up VLANs on TP-Link Omada

Before you start, make sure your Omada controller is installed and your gateway, switch, and APs are all adopted. The controller can be software-based (free download, runs on a PC or Linux server), or a hardware controller like the OC200. All configuration happens in the same Omada web interface regardless.

Step 1: Create the VLAN Networks

  1. Log into your Omada controller and go to Settings > Wired Networks > LAN.
  2. Click Create New LAN.
  3. For VLAN 10 (Corporate), enter:
    • Name: Corporate
    • Purpose: VLAN
    • VLAN ID: 10
    • Gateway/Subnet: 192.168.10.1/24
    • DHCP Server: Enable, set range to 192.168.10.100–192.168.10.200
  4. Click Save. Repeat the process to create VLAN 20 (Guest, 192.168.20.1/24) and VLAN 30 (IoT, 192.168.30.1/24).

At this point, the Omada gateway automatically creates VLAN interfaces for each network. The gateway will serve as the router between VLANs, and you’ll control inter-VLAN access through firewall rules.

Step 2: Assign Switch Ports to VLANs

Every physical switch port needs to be told which VLAN(s) it belongs to.

  1. Go to Devices, click on your managed switch, then go to Ports.
  2. For a port connecting a staff computer (access port on VLAN 10): set the Native Network to Corporate (VLAN 10), and set Network Tags to Block All.
  3. For a port connecting a camera (access port on VLAN 30): set the Native Network to IoT (VLAN 30), set Network Tags to Block All.
  4. For a trunk port (connecting to your AP or another switch): set the Native Network to whatever the management VLAN is, and under Network Tags add Corporate, Guest, and IoT. This passes all three VLANs tagged over one cable.
  5. Click Apply.

Step 3: Create SSIDs Per VLAN

  1. Go to Settings > Wireless Networks > WLAN.
  2. Click Create New Wireless Network.
  3. For the Staff WiFi: name it “YourBusiness-Staff”, set a strong WPA2/WPA3 password, then expand Advanced Settings and set VLAN to Custom > By Network > Corporate.
  4. Repeat for Guest WiFi: name it “YourBusiness-Guest”, tie it to VLAN 20. Under Client Isolation, enable it so guests can’t see each other’s devices.
  5. Optionally create a third SSID tied to VLAN 30 for IoT devices that need WiFi (smart TVs, wireless cameras).
  6. Click Apply.

That’s the core of the Omada setup. For a deeper walkthrough of the full Omada controller configuration — including initial setup and device adoption — see my complete TP-Link Omada setup guide.

Setting Up VLANs on UniFi

UniFi’s interface has evolved a lot over the years, and as of 2025–2026 the Network application is clean and intuitive. Here’s how to build the same three-VLAN setup in UniFi.

Step 1: Create the Networks (VLANs)

  1. Open the UniFi Network application and go to Settings > Networks.
  2. Click Add New Network.
  3. For Corporate (VLAN 10):
    • Name: Corporate
    • Router: Your UniFi gateway
    • VLAN ID: 10
    • Gateway IP/Subnet: 192.168.10.1/24
    • DHCP: Enable, set range (e.g., 192.168.10.100–200)
  4. Save. Repeat for Guest (VLAN 20, 192.168.20.1/24) and IoT (VLAN 30, 192.168.30.1/24).

Step 2: Configure Switch Port Profiles

  1. Go to Settings > Profiles > Switch Ports and create port profiles for each VLAN type.
  2. For an access port profile (e.g., “Corporate Access”): set Native VLAN to Corporate, leave all other VLANs blocked.
  3. For a trunk/AP profile (e.g., “All VLANs Trunk”): set Native VLAN to your management network, and tag Corporate, Guest, and IoT in the Tagged VLANs field.
  4. Apply these profiles to your switch ports: go to Devices > [your switch] > Port Manager. Click each port and assign the appropriate profile.

Step 3: Create WiFi Networks Per VLAN

  1. Go to Settings > WiFi and click Add New WiFi Network.
  2. For Staff WiFi: enter the SSID name and password, then set Network to Corporate.
  3. For Guest WiFi: enter the SSID name and set Network to Guest. Enable Client Device Isolation to prevent guests from seeing each other.
  4. For IoT WiFi: create a third SSID tied to the IoT network. You can hide this SSID if you prefer — you’ll only connect devices to it once during setup.
  5. Save all three WiFi networks. UniFi will push the configuration to all adopted APs automatically.

UniFi’s strength here is that once you’ve saved these settings, every AP on your site picks them up instantly. You don’t need to touch each AP individually.

Firewall Rules Between VLANs

Creating the VLANs is only half the job. By default, most routers will allow traffic to flow freely between VLANs — which defeats the entire purpose of having them. You need firewall rules to enforce the separation. Here are the rules I configure on every small business network I set up.

The Rules You Need

Block Guest → Corporate: No device on VLAN 20 should ever be able to initiate a connection to any device on VLAN 10. This is your most important rule.

Block IoT → Corporate: No device on VLAN 30 should be able to reach VLAN 10. Your cameras can record and upload to cloud storage, but they can’t talk to your file server.

Block Guest → IoT: Guests shouldn’t be able to access your cameras either.

Allow Corporate → IoT: Staff on VLAN 10 need to be able to pull up camera feeds on VLAN 30. This rule allows that initiated connection.

Allow all VLANs → Internet (WAN): All three networks need internet access. This is typically the default allow rule, but confirm it’s in place.

Setting Firewall Rules in Omada

  1. Go to Settings > Network Security > ACL.
  2. Click Create New Rule.
  3. For “Block Guest to Corporate”: set Source to VLAN 20 (192.168.20.0/24), Destination to VLAN 10 (192.168.10.0/24), Action: Deny.
  4. Repeat for “Block IoT to Corporate” and “Block Guest to IoT” with the same Deny action.
  5. For “Allow Corporate to IoT”: set Source to VLAN 10, Destination to VLAN 30, Action: Permit. Make sure this rule appears before any broader deny rules that might match the same traffic.

Setting Firewall Rules in UniFi

  1. Go to Settings > Traffic & Security > Firewall Rules.
  2. Select the LAN In rule set (traffic arriving from LAN-side VLANs).
  3. Create a “Block Guest to Corporate” rule: Source = Guest network, Destination = Corporate network, Action = Drop.
  4. Create “Block IoT to Corporate” and “Block Guest to IoT” with the same Drop action.
  5. Create “Allow Corporate to IoT”: Source = Corporate, Destination = IoT, Action = Accept. Order matters — place allow rules above deny rules that would otherwise catch the same traffic.

DNS Rules

For the Guest and IoT VLANs, I recommend pointing DNS to a public resolver like Cloudflare (1.1.1.1) or Google (8.8.8.8) rather than your internal gateway DNS. This prevents VLAN users from discovering anything about your internal network through DNS queries. In Omada, you can set custom DNS per LAN under the network settings. In UniFi, override DNS under each network’s DHCP settings.

Testing Your VLAN Setup

Never assume the configuration worked. Testing takes about 15 minutes and will immediately expose any mistakes. Here’s exactly how I test every VLAN deployment.

Test 1: Verify VLAN Isolation

Connect a laptop to your Guest WiFi (VLAN 20). Open a command prompt and run ipconfig (Windows) or ifconfig (Mac/Linux). You should get an IP address in the 192.168.20.x range. If you’re getting an IP in the 192.168.10.x range, the AP port is not tagged correctly — revisit Section 4 or 5.

Now try to ping a known device on the Corporate network. For example, if your file server is at 192.168.10.50, run ping 192.168.10.50. You should get “Request timed out” or “Destination host unreachable.” If the ping succeeds, your firewall rules are not in place or are ordered incorrectly.

Test 2: Verify Internet Access from Each VLAN

From each VLAN, run ping 8.8.8.8 and then try loading a website. All three VLANs should have internet access. If a VLAN can’t reach the internet, check that there’s an “allow to WAN” rule and that the DHCP server is assigning the gateway address correctly (should be 192.168.x.1 for each respective subnet).

Test 3: Verify Corporate Can Reach IoT

From a device on VLAN 10 (Corporate), try to ping a camera or device on VLAN 30. You should get a response. If you can’t, check that your “Allow Corporate → IoT” firewall rule is placed above any deny rules that might match the same traffic.

Common Mistakes to Catch During Testing

  • Trunk vs. access port confusion: A port connecting to an AP needs to be a trunk port (carrying all tagged VLANs). A port connecting to a single device (workstation, camera) should be an access/untagged port on the appropriate VLAN only. Mixing these up is the #1 configuration error.
  • DHCP not responding on a new VLAN: If devices get a 169.254.x.x address, your DHCP server isn’t running on that VLAN. In Omada, verify the DHCP is enabled under that LAN’s settings. In UniFi, check the network’s DHCP mode is set to DHCP Server, not None.
  • Devices on the wrong VLAN: If a device is getting the wrong IP range, trace the physical port it’s connected to and verify the switch port assignment is correct.

Common Mistakes and Troubleshooting

I’ve done enough of these deployments to know what goes wrong. Here are the scenarios I troubleshoot most often — and how to fix them.

“My Printer Disappeared After I Set Up VLANs”

This is the #1 complaint I get after a VLAN deployment. The printer was on VLAN 1 (default), and now the staff computers are on VLAN 10 — so they can’t see it. The fix is simple: move the printer to VLAN 10 (plug it into a port configured for VLAN 10) or, if it’s a wireless printer, connect it to the Staff WiFi SSID that’s on VLAN 10. Either way, printer and computers need to be on the same VLAN.

“AirPrint (and Google Cloud Print) Doesn’t Work Across VLANs”

AirPrint uses mDNS (multicast DNS) to discover printers, and mDNS doesn’t cross VLAN boundaries by default. If you want mobile devices on VLAN 20 to print to a printer on VLAN 10, you need an mDNS repeater or reflector. Both Omada and UniFi have a built-in mDNS repeater feature — in Omada, it’s under Settings > Services > mDNS. In UniFi, it’s a toggle called mDNS Repeater under the network settings. Enable it and specify the VLANs that need mDNS bridging. This also fixes Chromecast and Apple TV discovery across VLANs.

“DHCP Isn’t Working on My New VLAN”

Two common causes. First, the DHCP server might not be enabled for that VLAN — double-check the LAN settings in your controller. Second, the inter-VLAN DHCP requests might be getting blocked by a firewall rule. DHCP requests travel as broadcast traffic that gets converted to unicast when they leave the subnet — make sure your firewall isn’t dropping DHCP traffic (UDP port 67/68) between VLANs. Most controllers handle this automatically when the gateway is running the DHCP server, but custom firewall rules can interfere.

“Some IoT Devices Won’t Connect to the IoT WiFi”

Many cheap IoT devices — especially older cameras and smart plugs — only support 2.4GHz and don’t support WPA3. Make sure your IoT SSID is set to 2.4GHz only (or dual-band with WPA2/WPA3 mixed mode) and is using WPA2-PSK rather than WPA3-only security. Some really old devices can’t even handle WPA2 with CCMP — they need WPA2 with TKIP, which you’d set under the SSID’s advanced security options.

“I Can’t Access the Switch Web Interface from a Different VLAN”

By default, managed switches are accessible from the management VLAN only. If you’re on VLAN 10 (Corporate) trying to reach the switch web interface, and the switch management IP is on VLAN 1 or a dedicated management VLAN, you’ll need either a firewall rule permitting that access or a dedicated management VLAN that your admin machine is also on. Some administrators keep a single port on every switch in an untagged management VLAN and use a dedicated management laptop — that’s the cleanest approach if security is a priority.

Wrapping Up

Setting up VLANs for your small business is one of the highest-impact things you can do for your network security — and as I hope this guide has shown, it’s absolutely something a non-engineer can do. You don’t need a CCNA. You need a managed switch, a VLAN-capable gateway, business-class APs, and about an afternoon of configuration time.

The three-VLAN model — Corporate, Guest, IoT — covers the security needs of the overwhelming majority of small businesses I work with. Get that foundation right, add the firewall rules, test thoroughly, and you’ll have a network that’s meaningfully more secure than anything running on flat consumer-grade hardware.

If you’re still deciding between TP-Link Omada and UniFi, check out my full comparison guide to see which ecosystem fits your budget and skill level. And if you need a step-by-step walkthrough of the initial Omada controller setup before any of this makes sense, my Omada setup guide will get you there.

As always, if you’re in the Cincinnati area and you’d rather have someone set this up for you, reach out to Cincinnati PC Repair LLC. We’ve built hundreds of these networks and can have yours running in a day.


Picking your hardware? If you’re still deciding on networking gear for your small business, check our TP-Link Omada vs UniFi comparison — it covers which platform handles VLANs more cleanly.

Leave a Comment