Your smart home on its own VLAN, without breaking everything
A separate IoT network is safer, but it breaks device discovery. How to set up VLANs with UniFi and keep Home Assistant connected.
- Published
- Reading time
- 3 min read
- Level
- Advanced
- Tested on HA
- 2026.10
That ten-euro smart plug will never see another firmware update. Your camera talks to a server in a country you could not point to on a map. And both of them sit on the same network as your laptop and your NAS. Move them onto their own VLAN and they can no longer reach any of it, which leaves a compromised plug locked up neatly among the other lights.
You do pay a price for that, because local discovery stops at the same boundary and half your integrations lean on it. That is entirely fixable, but you have to do it deliberately.
A simple layout
| VLAN | What | Access |
|---|---|---|
| Main | Laptops, phones, NAS | Everything |
| IoT | Lights, plugs, TVs, speakers, printer, Home Assistant | Internet and each other only |
| Cameras | Cameras, doorbell | NVR and Home Assistant only |
Put Home Assistant in the IoT VLAN, not with your laptops. Most integrations rely on local discovery that will not cross a VLAN boundary, and with HA sitting among the devices that problem disappears in one move. Your phone then reaches HA from the main network through a single firewall rule.
Firewall rules (UniFi)
- Main → IoT: allow. Your phone needs to reach HA and your speakers.
- IoT → Main: block, except replies on existing connections ("established/related"). Without that exception, everything breaks.
- Cameras → Main and IoT: block, except to your NVR and HA addresses.
Discovery across VLANs: mDNS
AirPlay, Chromecast, HomeKit and printers find each other over mDNS, and a router keeps those multicast messages inside a single network by default. So enable Multicast DNS in UniFi for the networks involved. If you want less noise on your network, use an mDNS proxy that only passes the services you actually need.
Fixed addresses
Give HA, your printer, NAS and cameras a fixed IP through a DHCP reservation in UniFi rather than setting it on the device itself. You then manage addresses in one place, and after a power cut everything is still where your firewall rules expect it.
Testing
Work through three things once you have it set up. Does AirPlay from your phone reach the speakers? Does HA still see all its devices? And can an IoT device genuinely not reach your NAS? That last one is the only one you have to actively try, with a ping from a device on the IoT network. A firewall rule that does not work is something you otherwise never find out about.
Frequently asked questions
Do I need a VLAN-capable router? Yes, plus switches and access points that support VLANs. UniFi, Omada and MikroTik handle it; most ISP modems do not.
Does Chromecast still work after splitting? With mDNS forwarding and a firewall rule from your main network to the Chromecast, usually yes. Test it right after setup, because you do not want to discover this on an evening you planned to stream something.
Does Home Assistant have to be in the IoT VLAN? It is the simplest choice, which makes it the best one. Sonos and AirPlay across VLANs covers how to keep your speakers and HA together.