Keep cameras and IoT off the staff WiFi

Who it is for

This is for a small shop or office that runs UniFi (a UniFi gateway or Cloud Gateway plus UniFi access points) and has collected the usual pile of “smart” gear: security cameras, a video doorbell, a thermostat, smart plugs, a TV in the waiting room, and a printer or two. Out of the box, all of that lands on the same WiFi as the register and staff laptops. That is a problem for two reasons. Cheap IoT devices rarely get security updates, so one weak camera can become a way into your business network. And cameras and chatty devices use up airtime and bandwidth, which slows down the WiFi your staff actually depends on.

Plan on an hour or two, ideally after hours, because every IoT device will need to rejoin WiFi.

The idea in one sentence

Give IoT devices their own network and WiFi name, let staff devices reach into that network when they need to (to print or view cameras), and block IoT devices from reaching out to staff computers.

Steps

1. Sort your devices into three groups

Keep this simple. Most small shops need only three networks:

If you have more than about a dozen cameras, you can give them a separate Cameras network later. Start with one IoT network. A design you can maintain beats a perfect one that nobody understands six months from now.

Printers are the judgment call. Put them on IoT if staff only print from computers. Keep them on Staff if an old scanner-to-email or scan-to-folder setup breaks when they move, and come back to it later.

2. Create the IoT network

1. Open UniFi Network → Settings → Networks → Create New (Creating Virtual Networks).
2. Name it plainly, for example IoT. Staff and visitors never see this label, but whoever works on the network next will.
3. Set VLAN ID 30 (or your chosen unused ID).
4. Set the gateway/subnet to something that does not overlap Staff or Guest, for example 10.30.0.1/24, and leave DHCP on.
5. Leave Network Isolation off for now. Isolation would also block staff from reaching the printer and camera recorder. Step 5 uses firewall policies to block traffic in one direction only.
6. Apply changes.

3. Create the IoT WiFi name

1. Go to Settings → WiFi → Create New (Creating UniFi WiFi SSIDs).
2. Pick a WiFi name that does not advertise what is on it. ShopName-Devices is fine. ShopName-Cameras tells a stranger exactly what to go after.
3. Under Network, choose the IoT network from step 2. If you skip this, devices join the Staff network and nothing is separated.
4. Use WPA2 Personal with a long passphrase. Many cameras and plugs still cannot join WPA3-only WiFi.
5. Under advanced settings, consider limiting this WiFi to 2.4 GHz. Most smart plugs and doorbells only work on 2.4 GHz, and some fail to join when the same name is also on 5 GHz.
6. Broadcast from the access points that cover the devices. Keep the total to three WiFi names (Staff, Guest, IoT) or fewer, because each extra name uses airtime.
7. Save and let the access points provision.

4. Move wired cameras and the recorder to the IoT network

Wired cameras, a camera recorder (NVR), and wired printers are assigned by switch port, not by WiFi name.

1. In UniFi Network, open the switch and go to the Ports tab (Switch Port VLAN Assignment).
2. For each port that has a camera, recorder, or printer plugged in, set Native VLAN / Network to IoT.
3. Leave ports that connect to access points or other switches alone. They need to carry every VLAN (trunk / “Allow All”). Never set an access point’s port to the IoT network as its native VLAN. If you do, the access point loses its connection.
4. If a non-UniFi switch sits anywhere between the gateway and an access point or camera, that switch must also allow VLAN 30, or devices will join and never get an address.
5. Apply changes. Unplug and replug each wired device, or reboot it, so it picks up a new 10.30.x.x address.

UniFi Protect cameras and a UniFi recorder can also live on the IoT network. Adopt and manage them the way you normally do. Just make sure the staff devices you view them from are allowed through by the rule in step 5.

5. Block IoT from reaching staff (one direction only)

On UniFi Network 9.0 or newer with a UniFi gateway, this is done with the zone-based firewall (Zone-Based Firewalls in UniFi):

1. Go to Settings → Zones (or Settings → Security → Firewall, depending on version) and create a custom zone called IoT. Move the IoT network into it. Staff stays in the built-in Internal zone, and Guest stays in Hotspot or its own isolated network.
2. Create a policy from IoT → Internal: Block. This stops a camera or plug from starting a connection to any staff computer.
3. Create a policy from Internal → IoT: Allow. This lets staff print and open the camera app. Make sure return traffic is allowed (UniFi’s policies offer this as an option, and it is how replies get back to staff).
4. Leave IoT → External (internet) allowed for now, because most cameras and plugs need their cloud service to work. Later you can block internet for devices that run fully local, such as a recorder that nobody views from outside.
5. Check that Guest still cannot reach Staff or IoT.

On older UniFi versions, look for Traffic & Firewall Rules and make the same two rules: block IoT → Staff, allow Staff → IoT with established/related return traffic.

6. Turn on device isolation for the IoT WiFi (optional)

On the IoT WiFi, Client Device Isolation stops devices on that WiFi from talking to each other (Implementing Network and Client Isolation). That limits how far a single hacked plug can spread. Skip it if your doorbell needs to talk to a chime or hub on the same WiFi. Turn it on, test, and turn it back off if something breaks.

7. Fix printing and casting if they stop working

Printers and TVs announce themselves with a broadcast (mDNS / Bonjour) that normally stays on one network. If staff laptops can no longer “see” the printer after the move:

• Add the printer by its IP address instead (best: give it a fixed DHCP reservation on the IoT network), or
• Turn on Multicast DNS between the Staff and IoT networks in UniFi Network’s settings so the printer shows up again. Only bridge the networks that need it.

8. Move devices over and clean up

1. Rejoin each WiFi device to the new IoT WiFi name using its app.
2. Change any device still on a factory-default password, and update firmware while you are in each app.
3. In UniFi Network → Client Devices, give each device a clear name (for example Cam - Back Door, Plug - Window Sign) so you can spot strangers later.
4. Once everything is moved, change the staff WiFi passphrase. That kicks off anything you forgot and anything an old IoT device remembered.

Cautions

• Do this after hours. Every IoT device drops off when it moves, and a few stubborn ones need a factory reset to rejoin.
• Do not trust a hidden WiFi name as security. It only hides the name from the list. Use the separate network and firewall policies.
• Do not turn on Network Isolation on the IoT network and stop there. It blocks staff from printing and viewing cameras, and people will “fix” that by moving devices back to Staff.
• Some point-of-sale card readers and alarm panels have vendor rules about which network they live on. Check with the vendor before moving them, and if in doubt, leave them on Staff.
• Opening ports on the gateway so you can view cameras remotely undoes much of this work. Use the camera vendor’s app or UniFi’s remote access instead of port forwarding.
• Menu names change between UniFi Network versions. If a label moved, search Settings for “Zones,” “Networks,” or “Multicast DNS” instead of following an old screenshot.