How to set up VLANs on your business router to separate traffic and improve network security

Summary

This guide helps you troubleshoot and resolve: How to set up VLANs on your business router to separate traffic and improve network security. Follow the steps below to fix the issue.

Common Causes

Setting up Virtual Local Area Networks (VLANs) on your business router is one of the most effective ways to segment your office network, isolate sensitive devices like point-of-sale (POS) terminals or security cameras, and provide a separate network for guest Wi-Fi users. By dividing a single physical network into logical segments, VLANs reduce broadcast traffic, limit lateral movement by potential intruders, and make your network easier to manage. This guide walks you through planning, configuring, and verifying VLANs on a typical business-grade router.

Before You Begin

VLANs work by tagging network traffic with an identifier (a VLAN ID) so that devices in one VLAN cannot directly communicate with devices in another VLAN without a router or firewall permitting it. Before you start configuring, take some time to plan your network segments.

Identify Your Network Segments

Common VLAN groupings for small businesses include:

• Staff/Office VLAN — for workstations, printers, and shared resources
• POS or Payment VLAN — for eftpos terminals and POS systems, often with stricter firewall rules
• Security/IoT VLAN — for CCTV cameras, access control, and other smart devices
• Guest Wi-Fi VLAN — for visitors, isolated from your internal network
• Voice VLAN — for VoIP handsets, to prioritise call quality

Gather Your Information

For each VLAN you plan to create, write down:

• A VLAN ID (a number between 1 and 4094, excluding 1 which is usually the default)
• A name for the VLAN (e.g., "POS", "GuestWiFi")
• A unique subnet (e.g., 192.168.10.0/24, 192.168.20.0/24)
• The gateway address (usually the first usable address, e.g., 192.168.10.1)
• Which physical ports or SSIDs will be assigned to each VLAN

Quick Fix: A Minimal Two-VLAN Setup

If you just need a quick separation between your office network and a guest Wi-Fi network, this condensed process will get you there:

1. Log in to your router's admin interface (typically http://192.168.1.1 or http://192.168.0.1).
2. Navigate to LAN > VLAN or Network > VLAN Settings.
3. Create VLAN ID 30 named "Guest" with subnet 192.168.30.0/24.
4. Assign your guest Wi-Fi SSID to VLAN 30.
5. Save and apply the configuration.
6. Enable the guest network firewall rule that blocks access to other VLANs.

Detailed Instructions: Configuring VLANs Step by Step

The exact menu names vary between router brands (Cisco, MikroTik, Ubiquiti, TP-Link Omada, DrayTek, and so on), but the underlying process is the same. The steps below use generic terminology that maps to most business router interfaces.

Step 1: Back Up Your Current Configuration

Before making any changes, save a backup of your router's current configuration. Look under System Tools > Backup & Restore or Administration > Config Backup. Store this file somewhere safe in case you need to roll back.

Step 2: Log In to the Router

1. Connect your computer directly to the router with an Ethernet cable where possible.
2. Open a browser and enter the router's management address (commonly 192.168.1.1, 192.168.0.1, or 10.0.0.1).
3. Enter your admin username and password. If you do not know these, check the label on the router or your original setup documentation.

Step 3: Create the VLANs

1. Navigate to the VLAN section. This is usually under LAN, Switching, or Network.
2. Click Add New VLAN or Create.
3. Enter the VLAN ID, Name, and assign a Subnet with its gateway address.
4. Repeat for each VLAN you planned.
5. Click Save after each entry.

Step 4: Assign Ports and SSIDs to VLANs

Once your VLANs exist, you need to tell the router which physical ports and wireless networks belong to each one.

• Wired ports: In the VLAN settings, edit each port and set its PVID (Port VLAN ID) and untagged membership. For example, set LAN Port 4 to PVID 20 for your POS devices.
• Wi-Fi SSIDs: In the wireless settings, edit each SSID and look for VLAN ID or Wireless VLAN. Assign your guest SSID to VLAN 30, your staff SSID to VLAN 10, and so on.

Step 5: Configure Inter-VLAN Routing (If Needed)

By default, VLANs cannot talk to each other. If you want certain VLANs to reach others (for example, staff needing access to a shared printer on the IoT VLAN), you need to enable inter-VLAN routing and create firewall rules.

1. Go to Routing > Static Routes or Firewall > Policies.
2. Add a rule permitting traffic from the source VLAN to the destination VLAN.
3. Explicitly deny traffic from the guest VLAN to all internal VLANs.
4. Save and apply.

Step 6: Save and Apply

1. Review all your changes carefully.
2. Click Save and then Apply or Commit. Some routers reboot automatically; others apply changes live.
3. Wait for the router to finish applying changes before testing.

Verifying Your VLANs Are Working

After configuration, confirm that traffic is being separated correctly.

Check Device IP Addresses

Connect a device to each VLAN (via the appropriate port or SSID) and verify it receives an IP address from the correct subnet. On Windows, run ipconfig in Command Prompt. On macOS, run ifconfig in Terminal. On Linux, run ip a.

Test Isolation

From a device on the guest VLAN, try to ping or access a device on the staff VLAN. The request should fail. From the staff VLAN, confirm you can still reach the internet and any shared resources you intended to allow.

Review the Router Logs

Check System Logs or Firewall Logs to see whether traffic is being routed and blocked as expected.

Troubleshooting

Devices Cannot Get an IP Address

• Confirm DHCP is enabled for the relevant VLAN.
• Check that the VLAN is assigned to the correct port or SSID.
• Verify the device is set to obtain an IP automatically (DHCP).
• Confirm the DHCP pool range covers the subnet you assigned to the VLAN.

No Internet Access on a VLAN

• Make sure the VLAN's subnet has a default route pointing to the router's WAN or upstream gateway.
• Check that the firewall is not blocking outbound traffic from the VLAN.
• Verify DNS settings are configured for the VLAN (either via DHCP or manually).

Devices on Different VLANs Can Still See Each Other

• Confirm inter-VLAN routing is disabled or that firewall rules are correctly blocking traffic between the VLANs.
• Check that devices are actually connected to the correct port or SSID with the right VLAN assignment.
• Review firewall logs to identify which rule is allowing the traffic.

Lost Access to the Router After Changes

• Connect directly to the router using an Ethernet cable and the management VLAN port.
• If you cannot reach the management interface, perform a factory reset using the physical reset button (usually held for 10–30 seconds).
• Restore your backup configuration once you regain access.

Still Having Issues?