To set up a VLAN in pfSense, create it under Interfaces > Assignments > VLANs, assign it as an interface with a static IP, turn on DHCP for it, then add firewall rules. That last step matters, because a new pfSense VLAN interface blocks everything until a rule allows it. Each step of the pfSense VLAN configuration is below, with an IoT VLAN as the example.
I went through a pfSense VLAN setup, with DHCP and firewall rules, on a fresh CE 2.8.1 build for a video I published in July 2026. CE 2.9.0 (August 2026) is the newest release as of October 2026, and it adds one field to the VLAN form, VLAN Tag Type, which step 3 covers. Most of the screenshots are from an older release, but the menu paths and field names match what 2.8.1 showed. If you’re on OPNsense, here’s how to set up a VLAN in OPNsense.
pfSense VLAN Setup: Create and Assign the VLAN
Before you create anything, decide how many pfSense VLANs you need. For most people that’s three (a default network, IoT and guest), or four if you have cameras. The two I’d skip in a home lab are a storage VLAN, whose benefits get way overstated unless you have the dedicated network infrastructure for it, and a backup VLAN, which an individual firewall rule usually handles.
I normally number VLANs in increments of 10 (IoT is 10, Guest is 20, etc), and on the demo build the Guest VLAN used 10.10.20.0/24 to match its tag.
Create the VLAN
1. Select Interfaces, then Assignments.
2. Select the VLANs tab, then Add to create a new VLAN.
3. Set the Parent Interface to your LAN interface (only VLAN capable interfaces are listed), leave VLAN Tag Type at C-Tag if you’re on 2.9.0, enter an unused VLAN Tag between 1 and 4094, give it a Description, then Save.
Step 3 skips the pfSense VLAN Priority field, which takes an 802.1Q priority between 0 and 7. Most home setups leave it blank unless they run QoS.
Assign and Enable the Interface
4. Go back to the Interface Assignments tab. The new VLAN shows under Available network ports, so select it and choose Add.
5. It gets a name like OPT1 or OPT2, so select that name to configure it.
6. Check Enable, give it a Description (IOT in this example), and set IPv4 Configuration Type to Static IPv4.
7. Under Static IPv4 Configuration, enter the address pfSense will use on this VLAN with a /24 (the screenshot uses 192.168.200.1; pick a subnet your LAN and other VLANs don’t use), and leave the upstream gateway as None. Leave Block private networks and loopback addresses and Block bogon networks unchecked (they’re meant for WAN interfaces), then Save and Apply Changes.
Enable DHCP on the VLAN Interface
pfSense VLAN DHCP isn’t turned on when the interface is created, so anything that joins the VLAN sits there without an address.
1. Select Services, then DHCP Server, and open your VLAN’s tab (IOT). The tab only shows up once the interface has a static IP, which step 7 above set.
2. Check Enable DHCP server on IOT interface.
3. Under Address Pool Range, enter a From and To address inside the VLAN’s subnet (the page lists the subnet and its usable range just above).
4. Save the settings.
pfSense has two DHCP backends, Kea and ISC DHCP, and the tab and the options above are the same in both. Netgate has deprecated ISC DHCP and plans to remove it, and you can switch backends under System > Advanced on the Networking tab. The fresh 2.8.1 install in my video showed ISC DHCP.
pfSense VLAN Firewall Rules and Routing Between VLANs
An older version of this guide said VLANs in pfSense can talk to each other by default, and that is wrong. A new VLAN interface has no rules, so the firewall blocks every incoming connection on it until you add a pass rule. A VLAN with DHCP and no rules hands out addresses and passes nothing.
pfSense VLAN routing between your networks comes down to these rules. They’re created on the interface where the traffic starts and run from top to bottom, and the first match wins. Unlike a new VLAN, a fresh install’s LAN tab has a default allow LAN to any rule, so your LAN can reach the VLAN unless you block it.
For a VLAN that should reach the internet and nothing else on your network, the order is: allow DNS to pfSense, reject anything else to pfSense, block the private networks, then allow everything else. The DNS rule goes first because the reject rule under it would otherwise catch DNS to pfSense.
Create an Alias for the Private Networks
1. Select Firewall, then Aliases, and Add a new alias.
2. Name it RFC1918, set the Type to Network(s), add the three private ranges below, using Add Network for each extra row, then Save and Apply Changes.
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16One block rule to this alias keeps the VLAN off your LAN and off any VLAN you add later.
Add the Rules in Order
1. Select Firewall, then Rules.
2. Select the tab for your VLAN (IOT), which has no rules yet.
3. Use the Add button with the down arrow, which adds a rule to the bottom of the list, for every rule here. The first is the DNS rule: Action Pass, Protocol TCP/UDP, Source IOT subnets, Destination This Firewall (self), and Destination Port Range DNS (53), then Save.
4. Add a rule with Action Reject, Protocol Any, Source IOT subnets and Destination This Firewall (self), then Save. This keeps IoT devices off the pfSense web GUI on its WAN address.
5. Add a third rule and set the Action to Block, the Address Family to IPv4 (the alias only holds IPv4 networks) and the Protocol to Any. The older screenshot below shows IPv4+IPv6 from the original version of this rule.
6. Give the rule a Description, such as “Block IoT to RFC1918”.
7. Set the Source to IOT subnets and the Destination to Address or Alias, entering RFC1918, then Save. The screenshot shows the original rule with LAN net (now LAN subnets) as the destination, which only blocks the LAN.
8. Add a fourth rule: Action Pass, Protocol Any, Source IOT subnets, Destination Any, description “Allow IoT to Internet”, then Save.
9. Check that the IOT tab reads, top to bottom: DNS pass, reject to This Firewall, block to RFC1918, internet pass. If one is out of place, drag it and Save. Then select Apply Changes.
The source on that last rule has to be the VLAN’s own subnets. A pass rule on the IOT tab with LAN subnets as the source never matches IoT traffic, and the VLAN ends up with no internet.
To go further than this, here’s how to create firewall rules in pfSense.
If you don’t want the LAN to reach the VLAN either, add a rule to the top of the LAN tab with the up-arrow Add: Action Block, Protocol Any, Destination IOT subnets, then Save and Apply Changes.
A Camera VLAN With No Internet Access
When I ran pfSense, I had a camera VLAN that kept the camera traffic local with internet access blocked, and I connected to my VPN to view the cameras from outside the house. To build one, use the rules above minus the internet pass rule. An NVR on your LAN can still reach the cameras (unless you added the LAN block above), because the LAN’s allow rule covers that connection and pfSense lets the replies back in.
A local-only VLAN has trade-offs, as clock sync, firmware updates and app pairing can break once a device can’t get out. For one or two devices, a block rule for each is generally easier than a whole VLAN.
Trunk the VLAN to a Managed Switch and Access Point
VLANs on pfSense only handle routing and the firewall, so to use them across your network you need a managed switch and access points that support 802.1Q VLAN tagging. Netgate’s VLAN documentation is clear that VLANs can’t be used with an unmanaged switch, but any decent managed switch made in the last 25 years can trunk them.
The switch port that connects to pfSense has to be a trunk port with the VLAN tagged on it. The ports your devices plug into are access ports, untagged on their VLAN, and some switches also need the PVID on those ports set to the VLAN ID. If pfSense runs as a virtual machine, the hypervisor’s bridge is part of that path too (here’s how to configure VLANs in Proxmox).
On UniFi, open Settings, then Networks, and create a new network. Under Router, select Third-party Gateway (older versions called this a VLAN-only network) and enter the same VLAN ID you used in pfSense. The VLAN has to exist on pfSense first, and from there you attach it to an SSID the same way as when setting up a Guest WiFi network.
Overall, I ran this setup for years with UniFi switches and access points, and it worked very, very well with pfSense. I moved from pfSense to a UniFi Cloud Gateway in late 2024 (the reasons are in pfSense vs UniFi), but the switch side works the same either way.
Once the switch is set, connect a device to the VLAN and check that it gets an address from your pool, loads a website and can’t reach anything on your LAN. That’s how you know DHCP and the rules are doing their job.
Security changes all the time, so treat these rules as a starting point rather than a guarantee.
