How to Isolate Smart Home Devices on UniFi

Smart TVs scan your network, catalog your devices and send data home, and LG is just the one that got caught recently. The fix is to give those devices their own network and close the gates around it. On UniFi, that takes a few settings spread across several pages, and some of them don't do what you'd expect. This guide covers where each one lives and the tradeoffs that come with it.

One honest warning before you start: locking down a network isn't a beginner project. Get one of these settings wrong and you can break your network, so don't change anything you don't fully understand.

Start with three networks

For most homes I recommend three VLANs:

• Default: your trusted stuff. Network gear, your NAS, printers, and your own PCs and laptops. This network can reach the internet and your other networks, but nothing else should be able to reach into it.
• Guest: usually Wi-Fi only. Guests get internet access and nothing else. They can't see each other or any of your other networks.
• IoT: smart TVs, thermostats, robot vacuums and the like. These devices get internet access but can't see into your other networks. They do need to see each other, though. A TV you cast to and a hub that runs your smart bulbs both depend on it.

VLANs alone don't isolate anything on UniFi

This is where most people get caught. When you create VLANs, UniFi puts them all in the same firewall zone (Internal), and the default rule inside that zone is allow all. So until you change something, your IoT network can reach your main network. Plenty of other firewalls block this by default, but UniFi leaves it open so it's friendlier to set up.

Turn on network isolation

The fix is one checkbox. Go to Settings → Networks, open your IoT network, and check Isolate Network. UniFi creates the zone-based firewall rule for you. Open the zone-based firewall's Internal to Internal view and you'll see an “Isolated Networks” rule listing every network you've isolated.

What isolation does:

• Devices on the isolated network can still talk to each other. Casting and smart hubs keep working inside the IoT network.
• Devices on the isolated network can't start a connection to your other networks.
• Your default network can still reach in, as long as it isn't isolated itself. In my house, Home Assistant lives on the IoT network, and I can open it from my PC on the default network because I started that connection. Home Assistant can't reach back into my default network on its own.

Isolate guest and IoT, and leave your default network un-isolated. Isolating a network only stops it from reaching your other networks. Devices inside it can still talk to each other either way. So if you isolated the default network, your PCs and phones would still reach each other and the printer, but you couldn't open Home Assistant or a camera on the IoT network from them.

Guest network: also turn on Wi-Fi client isolation

Under Settings → WiFi, open your guest SSID and turn on Client Device Isolation, so guests can't see each other's devices. Don't turn it on for IoT. Your phone and the TV need to see each other for casting, and smart devices need to reach their hubs.

Casting: keep it inside one network

Casting across VLANs is where most locked-down setups fall apart. The simplest fix is to put the phone or tablet you cast from on the same network as the TV.

UniFi has a setting called Gateway mDNS Proxy (on the main Networks settings page) that advertises devices across VLANs. But if the IoT network is isolated, the TV can show up on your phone and the cast still times out, because the firewall blocks the actual stream. For most homes I'd turn mDNS forwarding off and do the casting within one network.

Device isolation probably won't do what you think

UniFi also has Device Isolation (ACL), which blocks devices on the same network from seeing each other. ACL stands for access control list: a set of rules that the switch itself enforces about which devices can talk to which. Two catches:

• It only works on switches that support ACLs. If your TV plugs into a small switch that doesn't, it can still see everything else on that switch. UniFi lists the incompatible switches right under the setting.
• Even when it works, it breaks casting, and it'll stop you printing if you turn it on for your default network.

The strongest step: lock down DNS

Isolation stops your TV from poking around your network, but it can still phone home. The most effective way to stop that is DNS filtering with something like Pi-hole. It lets the TV reach Netflix while blocking the telemetry domains. Doing it right takes three things:

1. Have DHCP hand out your Pi-hole as the DNS server on each network.
2. Allow the isolated networks to reach the Pi-hole on port 53 (that's a hole through the isolation).
3. Block port 53, and DNS over TLS on port 853, to every other DNS server, so a device with hard-coded DNS can't get around it.

Two warnings. A device with a hard-coded DNS server stops resolving names as soon as this is on. And devices keep their old DNS settings until their DHCP lease renews, so expect things to break until they reconnect. DNS over HTTPS can't be blocked this way.

Doing it all in one place: House Arrest

I built House Arrest into my free, open-source UniFi Toolkit to put all of these settings in one grid. That covers network isolation, device isolation, internet access, mDNS, Wi-Fi client isolation, and DNS lockdown. It uses UniFi's own settings, so every change shows up in your UniFi dashboard. It shows you exactly what it's going to apply before you apply it, and any change can be rolled back with one click.

Watch the full walkthrough