In plain words
A VLAN is like putting partitions in an open-plan office without moving anyone: everyone keeps their desk, but the accounting team no longer sees the front desk. To go from one room to another, you have to go through reception (the router), which checks who is allowed in.
Smart devices, the family computers, guests, a home server: all of them often share the same network. A poorly secured camera can then see and attack your NAS. VLANs let you separate these devices into several isolated networks, using the same hardware and the same cables.
The principle
A VLAN (Virtual LAN) splits one physical switch into several virtual switches. Two devices in different VLANs cannot see each other, as if they were plugged into two switches with no link between them.
Each VLAN has a number (the identifier, or VLAN ID, from 1 to 4094; 0 and 4095 are reserved by the standard) and usually maps to one IP subnet:
| VLAN | Name | Subnet | Devices |
|---|---|---|---|
| 10 | Trusted | 192.168.10.0/24 | Family computers and phones |
| 20 | Servers | 192.168.20.0/24 | NAS, home server |
| 30 | IoT | 192.168.30.0/24 | TV, cameras, smart plugs |
| 40 | Guests | 192.168.40.0/24 | Guest Wi-Fi, internet access only |
Tagged or untagged: the key idea
To carry several VLANs over the same cable, the switch adds a small tag to each Ethernet frame, defined by the IEEE 802.1Q standard. It says which VLAN the frame belongs to.
Each switch port works in one of two modes:
Untagged port (or "access" port)
The port belongs to a single VLAN. The switch removes the tag before sending the frame. The connected device (a PC, a printer) does not even know it is in a VLAN.
Use: workstations, printers, cameras, any end device.
Tagged port (or "trunk" port)
The port carries several VLANs at once, each frame with its tag. The device on the other end must understand 802.1Q.
Use: links between two switches, to the router or firewall, to a Wi-Fi access point that broadcasts several networks (one SSID per VLAN), to a hypervisor.
The native VLAN
On a tagged port, one VLAN can travel without a tag: the native VLAN (often VLAN 1 by default). Untagged frames received on that port are placed in it. Keep it identical on both ends of a link, otherwise frames end up in the wrong network.
Vendors use different words: access/trunk at Cisco, untagged/tagged at HPE Aruba or Netgear, Native VLAN and Tagged VLAN Management at UniFi. The principle is the same.
How do VLANs talk to each other?
On their own, VLANs cannot talk to each other, or even reach the internet. You need a router or firewall with an interface in each VLAN (often sub-interfaces on a single tagged port) that:
- acts as the gateway for each subnet;
- hands out addresses with DHCP in each VLAN;
- applies the filtering rules between VLANs.
This is where security happens. Example of a sensible policy:
| From | To | Allowed |
|---|---|---|
| Trusted | Servers | Yes, on the ports you need (file shares, web interface) |
| Trusted | IoT | Yes, to control the devices |
| IoT | Trusted, Servers | No |
| Guests | The whole local network | No, internet only |
| Servers | Internet | Yes, for updates |
Tip
Start by blocking everything between VLANs, then open only the flows you need. On most devices the firewall is stateful: allowing Trusted → IoT lets the replies through, without opening IoT → Trusted.
Common pitfalls
- Forgetting DHCP: a VLAN with no DHCP server leaves devices without an address (169.254.x.x on Windows).
- Locking yourself out: changing the VLAN of the port you use to manage the switch disconnects you. Keep a console or a spare port.
- mDNS and broadcast: automatic discovery (AirPlay, Chromecast, printers) does not cross VLANs. Enable an mDNS relay on the router, or accept connecting by IP address.
- VLAN 1 everywhere: avoid putting production devices in it, it is the default VLAN of every port.
Key takeaways
- One VLAN = one isolated network, usually one IP subnet.
- Untagged port: a single VLAN, for end devices. Tagged port: several VLANs, between network devices.
- The router or firewall connects the VLANs and decides what gets through: that is where the security comes from.