Configure VLANs on a Manageable Switch in 2026: Isolate Your Network

A VLAN (IEEE 802.1Q standard) splits a single physical switch into several isolated logical networks. The family PC, guests and connected devices can then share the same hardware without seeing each other. This tutorial covers a complete, working setup: creating the VLANs, “access” and “trunk” ports, an IP address and DHCP for each VLAN, filtering rules between VLANs, and testing.

An important note about hardware. TP-Link classifies the TP-Link TL-SG108-M2 as an unmanaged switch. It is plug-and-play: it has no IP address, no web interface and no 802.1Q VLAN configuration. So it cannot be used to create VLANs. It is useful in only one case: behind an “access” port, where every device plugged into it ends up in the same VLAN. This guide uses the Ubiquiti UniFi Switch Flex 2.5G 8 (USW-Flex-2.5G-8) as its example. It is a managed Layer 2 switch with VLAN support, and it is managed with the UniFi Network application.

Second key point: a Layer 2 switch separates networks, but it gives them no IP addresses, no Internet access and no filtering rules. Those jobs belong to a VLAN-capable router or firewall. The example here uses OPNsense, but OpenWrt, pfSense or a UniFi gateway also work. A typical ISP box generally does not handle VLANs on the LAN side. VTP (VLAN Trunking Protocol), often mentioned by mistake, is a proprietary Cisco protocol that propagates the VLAN list between Cisco switches. It secures nothing and is useless here.

Prerequisites

A managed 802.1Q switch: here the USW-Flex-2.5G-8. According to its datasheet, it is powered over USB-C or PoE+ input. Check the datasheet for your revision.
A UniFi Network controller to adopt and configure the switch: a UniFi console, or a self-hosted server (UniFi OS Server or the UniFi Network application). Follow the official installation docs for your version, because Ubiquiti keeps changing its self-hosted offering.
A VLAN-capable router/firewall. This guide uses OPNsense, installed on a machine with two network ports (WAN and LAN).
A Linux PC for testing (iproute2, ping, curl).
Console or keyboard/monitor access to the router, in case you lock yourself out of the web interface.

Addressing plan used throughout this tutorial (adapt it to your network):

VLAN	Name	Subnet	Gateway	Use
1 (untagged)	Default / LAN	192.168.1.0/24	192.168.1.1	Management
10	PERSO	192.168.10.0/24	192.168.10.1	PCs, NAS
20	INVITES	192.168.20.0/24	192.168.20.1	Guests, isolated

Step-by-step installation

Step 1: Identify the router’s LAN interface

The link between the router and the switch will carry every VLAN: this is the trunk. On OPNsense, open the shell (option 8 in the console menu) and find the LAN NIC:

ifconfig -l
ifconfig igc1 | grep -E "flags|inet "

Replace igc1 with the name of your LAN interface: em1, igb1, vtnet1… Check: the interface shows UP and the address 192.168.1.1.

Step 2: Create the VLANs on OPNsense

In the web interface, go to Interfaces ‣ Devices ‣ VLAN and click +. For each VLAN, fill in:

Device      : vlan0.10           | vlan0.20
Parent      : igc1               | igc1
VLAN tag    : 10                 | 20
Description : PERSO              | INVITES

Click Save then Apply. Check from the shell:

ifconfig vlan0.10 | grep -E "vlan:|parent"
ifconfig vlan0.20 | grep -E "vlan:|parent"

Each command should show vlan: 10 (or 20) with parent interface: igc1.

Step 3: Assign the VLANs and give them an IP address

In Interfaces ‣ Assignments, add vlan0.10 and then vlan0.20. Leave the parent interface assigned to LAN, as it already is. Then open each new interface from the Interfaces menu and set it up as follows:

Enable           : checked
Description      : PERSO
IPv4 Configuration Type : Static IPv4
IPv4 address     : 192.168.10.1 / 24

Do the same for INVITES with 192.168.20.1/24, then click Save and Apply changes. Check:

ifconfig vlan0.10 | grep "inet "
ifconfig vlan0.20 | grep "inet "

Step 4: Enable DHCP for each VLAN

On recent OPNsense releases, the setup wizard uses Dnsmasq for DHCPv4. Go to Services ‣ Dnsmasq DNS & DHCP ‣ DHCP ranges and add one range per VLAN:

Interface     : PERSO      | INVITES
Start address : 192.168.10.100 | 192.168.20.100
End address   : 192.168.10.200 | 192.168.20.200
Lease time    : 86400

Click Save then Apply. Also check in Services ‣ Dnsmasq DNS & DHCP ‣ General that the new PERSO and INVITES interfaces are selected in the Interface field if a list is set there, and that they are not listed under Interface [no dhcp]. If your installation uses ISC DHCP or Kea, configure the equivalent in that service (check the documentation for your version). Check: the service is listening on port 67.

sockstat -4l | grep ":67"

Step 5: Write the inter-VLAN filtering rules

The router isolates the VLANs, not the switch. First, create an alias in Firewall ‣ Aliases, named RESEAUX_PRIVES, of type Network(s):

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

Then, in Firewall ‣ Rules ‣ INVITES, add these rules in this order (the first matching rule applies):

1. Pass  | Source: INVITES net | Destination: This Firewall | Port: 53 (TCP/UDP)  -> DNS
2. Block | Source: INVITES net | Destination: RESEAUX_PRIVES | Port: any         -> no LAN access
3. Pass  | Source: INVITES net | Destination: any          | Port: any          -> Internet

Rule 2 also blocks guests from reaching the router’s web interface. For PERSO, a single Pass rule PERSO net → any is enough if this VLAN is allowed to reach the others. On OPNsense, inbound traffic is blocked by default on an interface with no rules. Depending on your version, these menus may be called Firewall ‣ Rules [new]. The Firewall ‣ NAT ‣ Outbound tab must stay in automatic mode so that the new networks can reach the Internet. Check it in that tab.

Step 6: Adopt the switch and declare the VLANs in UniFi

Connect the USW-Flex-2.5G-8 to the router’s LAN port, then adopt it in UniFi Network (UniFi Devices section). The controller and the switch must be on the same network; otherwise you need remote adoption. Install the firmware update it offers.

Next, in Settings ‣ Networks, create a new virtual network for each VLAN. Since OPNsense provides DHCP, set the router to Third-party Gateway:

Name    : PERSO    | INVITES
Router  : Third-party Gateway
VLAN ID : 10       | 20

Labels vary between UniFi Network versions: check them in your interface. Check: both networks appear in the list with the correct VLAN ID.

Step 7: Configure the access ports and the trunk

Start with the port that links the switch to the router. Never change the port you use to manage the switch first. In UniFi Devices ‣ (your switch) ‣ Ports, open each port:

Port 1 (to OPNsense)    : Native VLAN/Network = Default | Tagged VLAN Management = Allow All
Ports 2-5 (PERSO)       : Native VLAN/Network = PERSO   | Tagged VLAN Management = Block All
Ports 6-7 (INVITES)     : Native VLAN/Network = INVITES | Tagged VLAN Management = Block All
Port 8 (management)     : Native VLAN/Network = Default | Tagged VLAN Management = Block All

A port that carries tagged VLANs is a trunk. A port with no tagged VLANs is an access port: its frames are untagged and belong to its Native VLAN. To allow only some VLANs on the trunk, choose Custom instead of Allow All. Check: the VLAN Viewer tool in the Ports tab should show VLAN 10 as native on ports 2 to 5, and VLANs 10 and 20 tagged on port 1.

Step 8: Test from a client

Connect a Linux PC to port 2 (PERSO):

ip -4 addr show
ip route | grep default
ping -c 3 192.168.10.1
curl -sI https://www.debian.org | head -1

Expected result: an address in 192.168.10.1xx, a default route via 192.168.10.1 and an HTTP response. Now move the PC to port 6 (INVITES):

ip -4 addr show                 # expected: 192.168.20.1xx
ping -c 3 -W 2 192.168.10.1     # expected: 100% packet loss
ping -c 3 -W 2 192.168.1.1      # expected: 100% packet loss
curl -sI https://www.debian.org | head -1   # expected: HTTP/... 200

Verification checks

Router side: in Services ‣ Dnsmasq DNS & DHCP ‣ Leases (depending on your version), each client appears with an address from its VLAN’s subnet.
Switch side: the VLAN Viewer shows no tagged VLANs on the access ports.
Trunk test without changing ports: connect the PC to a port set to Allow All and create a tagged sub-interface:

sudo ip link add link eth0 name eth0.20 type vlan id 20
sudo ip link set eth0.20 up
sudo dhclient -v eth0.20    # or your distribution's DHCP client
ip -4 addr show eth0.20
sudo ip link delete eth0.20

Replace eth0 with your interface (ip -br link). If the sub-interface gets an address in 192.168.20.x, VLAN 20 is crossing the trunk end to end.

Security and best practices

Never expose to the Internet the OPNsense web interface, the UniFi controller or SSH access to your devices. To manage them remotely, use a VPN (WireGuard on OPNsense, for example).
Keep management (router, controller, switch) on a dedicated network that INVITES and IoT cannot reach. The “Block RESEAUX_PRIVES” rule takes care of this.
Disable unused ports, or put them in a VLAN with no access.
On access ports, allow no tagged VLANs (Block All). This limits VLAN hopping attempts.
Update the switch firmware and OPNsense regularly. Back up the OPNsense configuration (System ‣ Configuration ‣ Backups) and the UniFi controller configuration.
Use strong, unique passwords. If you want two-factor authentication, enable it on the router or on the controller account, depending on the options your version offers: a switch generally does not offer it on its own.

Troubleshooting common errors

The client gets no IP address. The VLAN is not tagged on the trunk (port 1 set to Block All, or Custom without this VLAN), the OPNsense interface is not enabled, or no DHCP range exists for it. Check these three points in that order.
Guests can reach the LAN. The Pass any rule sits above the Block rule, or the rules were created on the wrong interface tab. The client may also be plugged into a port whose Native VLAN is Default.
You lost access to the switch after a change. You changed the Native VLAN of the management port or the trunk. Plug into a port still on Default. As a last resort, reset the switch and adopt it again: the reset procedure is described in Ubiquiti’s documentation for the model.
No Internet even though DHCP works. The Pass rule to any is missing, or outbound NAT is in manual mode with no rule for the new subnet.
An unmanaged switch (such as the TL-SG108-M2) is in the chain. Place it only behind an access port: all its devices will be in that VLAN. Do not use it as a trunk, because its behavior with tagged frames is not documented as a supported feature.

FAQ

Can the TP-Link TL-SG108-M2 create VLANs?

No. TP-Link classifies it as an unmanaged switch: it has no configuration interface. It works for adding 2.5 Gbit/s ports within a single VLAN, behind an access port of a managed switch.

Is my ISP box enough as an inter-VLAN router?

Generally not: most ISP boxes cannot create 802.1Q sub-interfaces on the LAN side. Place a VLAN-capable router or firewall behind the box, or in its place if your ISP allows it.

Do I need to enable VTP?

No. VTP is Cisco-specific and only synchronizes the VLAN list between Cisco switches. With UniFi, the controller pushes the configuration to adopted switches.

Do VLANs increase throughput?

No. They isolate networks and reduce the reach of broadcasts. Traffic between two VLANs goes through the router, so the router’s capacity limits that traffic.

How do I add a VLAN later?

Repeat steps 2 to 5 on the router and create the network in UniFi (step 6). If the trunk is set to Allow All, the new VLAN is tagged on it automatically. If it is set to Custom, add it by hand, then assign it to the ports you want.