Network Segmentation for Small Business Offices: A VLAN Guide for UK SMEs

Most small business networks look the same: one Wi-Fi network, one password, everything connected to everything else. The laptop running the accounts software is on the same network as the smart TV in the meeting room, the CCTV recorder, and the card payment terminal. A contractor working from the office uses the same network as the company’s file server.

This setup is a security problem. When an attacker compromises one device — through a phishing email, a vulnerable IoT device, or a contractor’s infected laptop — they have network-level access to everything else. The question isn’t whether any device on a flat network can be compromised, it’s when.

Network segmentation means dividing your network into separate zones so that a compromise in one zone doesn’t automatically give an attacker access to everything else. You don’t need enterprise networking equipment or an IT department to do this. Consumer and prosumer networking gear handles VLANs well, and the configuration principles are the same regardless of brand.

Why Segmentation Matters for Small Businesses

In 2025–2026, the NCSC’s Small Business Guide and CISA’s equivalent guidance both identify network segmentation as a foundational control — not an advanced one. The reason is that most attacks that affect small businesses don’t stop at the device they first compromised.

Ransomware lateral movement: Ransomware typically spreads from the initially infected machine to other network-accessible systems. A flat network lets it reach file servers, backup drives, and other computers. A segmented network contains it to the zone of the initially infected device.

IoT device compromise: Smart TVs, CCTV cameras, smart thermostats, and printers are consistently among the most vulnerable devices on office networks — they receive infrequent security updates and often run outdated firmware. Keeping these on a separate IoT VLAN means a compromised camera doesn’t provide a stepping stone to your accounts server.

Card payment isolation: PCI DSS requirements for card processing environments include network isolation as a standard control. Even if you’re using a standalone card terminal that connects over cellular, having a payment VLAN is good practice and simplifies any PCI compliance conversation.

Guest and contractor access: Giving guests and contractors network access is routine and necessary. Giving them access to your internal file servers is not. A guest VLAN provides internet access while blocking all internal network resources.

Equipment Requirements

You need three things to implement VLANs:

A managed (not unmanaged) switch: Unmanaged switches forward all traffic to all ports. A managed switch understands VLANs and can keep traffic from different zones separate. Entry-level managed switches capable of VLAN configuration start at under £50 — Netgear GS308E (8-port, around £40–£50) and TP-Link TL-SG108E (8-port, similar price) both support 802.1Q VLANs.

A router/firewall that supports VLANs: Most consumer routers don’t support VLANs or have very limited support. For a properly segmented small business network, prosumer options work well: Ubiquiti UniFi (Dream Machine or Dream Router), pfSense or OPNsense on a mini-PC, or Mikrotik are common choices. Ubiquiti’s Dream Router (£150–£180) is the most approachable for non-technical users — the UniFi interface handles VLAN creation with minimal complexity. OpenWrt firmware on compatible consumer routers is a lower-cost option for technically capable users.

VLAN-capable access points: Your Wi-Fi needs to support multiple SSIDs mapped to different VLANs. Unmanaged access points typically broadcast one SSID. Access points that support multiple SSIDs include Ubiquiti UniFi APs, Netgear Orbi Pro, and TP-Link Omada — most enterprise-grade and prosumer Wi-Fi equipment supports this.

Designing Your Network Zones

For a typical small business office, four zones cover most scenarios:

Staff LAN is your primary trusted network. Staff computers, any on-premises file servers, printers used by staff (as opposed to IoT-type printers), and the router’s management interface typically live here.

Guest/Contractor Wi-Fi is internet access only. A guest connecting to this SSID can browse the internet and reach external services but has no path to your file server, your NAS, or any other internal system. The VLAN firewall rule for this zone is straightforward: permit traffic to the WAN interface, deny traffic to all other VLANs.

IoT/Infrastructure isolates devices that can’t be fully trusted. Smart TVs that get infrequent firmware updates, IP cameras that may have known vulnerabilities, the office heating controller, network-connected printers with their own web interfaces. These devices can access the internet (for firmware updates, cloud connectivity) but cannot initiate connections to the staff LAN.

Payment zone is for PCI compliance purposes. If your card terminal connects to your network rather than cellular, isolate it. The terminal needs to reach your payment processor’s servers over the internet — nothing else.

Setting Up VLANs with Ubiquiti UniFi

UniFi is the most accessible managed networking platform for small businesses. The controller interface walks you through configuration with minimal networking knowledge required.

Creating VLANs in UniFi

1. Settings → Networks → New Virtual Network
2. Create four networks:
   • Staff — VLAN 10, IP range 192.168.10.0/24
   • Guest — VLAN 20, IP range 192.168.20.0/24
   • IoT — VLAN 30, IP range 192.168.30.0/24
   • Payment — VLAN 40, IP range 192.168.40.0/24
3. Enable the DHCP server for each VLAN (UniFi handles this automatically)

Creating Wi-Fi Networks

1. Settings → WiFi → Create New WiFi Network
2. Create separate SSIDs for each wireless zone:
   • “OfficeStaff” mapped to VLAN 10 (hidden or visible)
   • “OfficeGuest” mapped to VLAN 20 (visible, simple password, rotated regularly)
   • “IoTDevices” mapped to VLAN 30 (hidden)
3. Assign access points to broadcast the appropriate SSIDs (all APs broadcast all SSIDs by default in UniFi)

Firewall Rules

UniFi’s firewall rules control traffic between VLANs. The default in UniFi is that all VLANs can communicate with each other unless you add deny rules. You want to reverse this for security:

1. Settings → Security → Firewall Rules → LAN In
2. Add rules to block inter-VLAN traffic. The cleanest approach:
   • Rule 1: Drop — Source: Guest Network → Destination: Any LAN Network
   • Rule 2: Drop — Source: IoT Network → Destination: Staff LAN
   • Rule 3: Drop — Source: IoT Network → Destination: Payment Network
   • Rule 4: Allow — Source: Any → Destination: WAN (internet)

UniFi automatically blocks client isolation within the Guest network (preventing one guest from accessing another guest’s device). Enable this on your IoT network as well.

Setting Up VLANs with pfSense/OPNsense

pfSense and OPNsense run on mini-PCs (Protectli, Minisforum, or similar hardware, typically £150–£300) and give you more control than Ubiquiti at lower hardware cost, with the trade-off of a steeper learning curve.

Creating VLANs in pfSense:

1. Interfaces → Assignments → VLANs → Add
   • Parent interface: your LAN NIC
   • VLAN Tag: 10 (Staff), 20 (Guest), 30 (IoT), 40 (Payment)
2. Interfaces → Assignments — assign each VLAN interface and enable it
3. Services → DHCP Server — configure DHCP for each VLAN interface
4. Firewall → Rules — add rules per interface:
   • Guest (VLAN 20): Allow traffic to WAN only; deny traffic to all RFC1918 addresses
   • IoT (VLAN 30): Allow traffic to WAN; deny traffic to Staff LAN range

The pfSense documentation has detailed VLAN guides and the community forum (Netgate forum) is active with small business configurations.

Practical Considerations

Start with guest Wi-Fi. If your network currently has one SSID, adding a separate guest SSID on a dedicated VLAN is the highest-impact first step. It protects your internal network from every visitor, contractor, and anyone who has previously been given your Wi-Fi password. This one change is achievable in an afternoon even with limited networking experience.

Don’t rely on SSIDs alone. Some older Wi-Fi setups use separate SSIDs without proper VLAN backing — the guest network is a different SSID but shares the same underlying network. This provides no actual isolation. The VLAN configuration at the switch and router level is what creates the security boundary, not just the SSID name.

IoT device management: Devices on the IoT VLAN typically need internet access for firmware updates and cloud features. Some (smart TVs, cameras) need specific cloud services. If you have devices that need to be controlled from the staff LAN — a printer, for instance — you’ll need to either move the printer to the staff LAN or create a specific firewall rule permitting traffic from staff devices to that printer’s IP address.

Printer placement: Shared office printers are awkward to segment. A networked printer on the IoT VLAN isn’t reachable from the staff LAN without a firewall rule. Moving it to the staff LAN makes it unreachable from guest or IoT devices but means it’s on your trusted network. The pragmatic approach: printers used by staff go on the staff LAN; printers in reception or meeting rooms that guests use go on the guest VLAN.

Test your segmentation. After configuration, connect a device to the guest VLAN and attempt to access your internal resources (file server IP, router admin page). You should get no response. Test from the IoT VLAN similarly. A segmentation that hasn’t been tested may have accidental holes.

Keep management interfaces off all user VLANs. Your router and switch management interfaces should only be accessible from the staff LAN, or ideally from a dedicated management VLAN if you have the equipment for it. A compromised device on the guest VLAN should have no route to your router’s admin interface.

What Segmentation Doesn’t Protect Against

Network segmentation contains lateral movement after a breach. It doesn’t prevent the initial breach. A staff member’s device on the staff LAN that’s compromised via phishing can still access all staff LAN resources — segmentation doesn’t help there. You still need:

• MFA on all accounts and remote access
• Endpoint protection on staff devices
• Regular software and firmware updates
• Staff phishing awareness training
• Offline or cloud backups for critical data

Segmentation is one layer of a layered defence. It’s an important layer — particularly for containing IoT device compromises and limiting guest access risks — but it works in combination with, not instead of, the other controls.

The NCSC’s Cyber Essentials certification (and Cyber Essentials Plus) includes boundary firewalls and network filtering as required controls. Proper VLAN segmentation supports compliance with these requirements and provides a documented security architecture you can present to customers or insurers who ask about your network security posture.