VLANs and Segmentation
Learn how VLANs split one physical network into separate logical ones, why that improves security and performance, how access and trunk ports work, and how traffic moves between VLANs.
Why split a network at all
On a flat network, every device can reach every other device, and broadcast messages reach all of them. That is fine at home. In a company it creates problems. A guest laptop could try to connect to the finance server, and an unpatched smart TV could scan the staff computers.
Splitting a network into smaller, separate parts is called network segmentation. It gives you three benefits:
- Security. Guests cannot reach internal servers. A compromised camera cannot see staff laptops.
- Performance. Broadcast traffic stays inside its own segment instead of reaching every device.
- Organisation. Departments, cameras, printers and phones each get their own space with their own rules.
What a VLAN is
A VLAN (Virtual LAN) splits one physical switch into several separate logical networks. Devices in VLAN 10 cannot communicate directly with devices in VLAN 20, even when they are plugged into the same switch.
Without VLANs you would need one physical switch per group, which costs more and takes more space and cabling. With VLANs one switch can act as several.
A small example:
- VLAN 10: Staff
- VLAN 20: Guests
- VLAN 30: Cameras and IoT devices
How the switch knows which VLAN a frame belongs to
Frames that carry VLAN information get a small VLAN tag, defined by the standard 802.1Q. The tag contains the VLAN number, which can be from 1 to 4094.
Switch ports come in two kinds:
- Access port. Connects to one end device, such as a laptop or a printer. The port belongs to exactly one VLAN, and the device never sees tags. The switch adds and removes them.
- Trunk port. A link between two switches, or between a switch and a router. It carries many VLANs at once, and the tags tell the other end which VLAN each frame belongs to.
Talking between VLANs
By design, VLANs cannot talk to each other directly. When they have to, for example when staff need to reach a shared file server that sits in another VLAN, the traffic has to pass through a router or a layer 3 switch. This is called inter-VLAN routing.
That crossing point is a convenient place for firewall rules. For example: "Staff may reach the file server, guests may not."
A worked VLAN design
Each VLAN normally gets its own subnet. This is where the earlier lessons fit together:
VLAN 10 Staff 192.168.10.0/24 gateway 192.168.10.1
VLAN 20 Guests 192.168.20.0/24 gateway 192.168.20.1
VLAN 30 Cameras 192.168.30.0/24 gateway 192.168.30.1A laptop plugged into a port in VLAN 10 gets an address such as 192.168.10.45 from DHCP. A guest phone gets 192.168.20.17. They are in different subnets, so any traffic between them goes through the router, where rules can allow or block it.
A simple policy could be: staff can reach the cameras to watch them, the cameras can reach nothing, and guests can reach only the internet.
One cable, many VLANs
Small networks often use a single cable from the switch to the router that carries all the VLANs. The router separates them again using one virtual interface per VLAN. This design is called router on a stick, and the cable is a trunk.
Larger networks use a layer 3 switch that does the routing itself, which is faster.
Whichever way it is built, the principle is the same: VLANs keep the traffic apart, and a router joins it back together under rules you control.
Common uses
- Guest WiFi kept separate from the company network.
- IoT devices such as cameras, smart TVs and thermostats isolated, because they are often poorly secured.
- Servers separated from user machines.
- Voice over IP phones in their own VLAN so their traffic can be prioritised.
- Home networks: many routers offer a "guest network", which is a simple form of the same idea.