A VLAN lets one physical switch behave like several separate ones, so your laptops, cameras, guests and smart devices stop sharing one flat network. This guide explains how VLANs work, how traffic moves between them, and the security mistakes we see most often.<\/p>\n\n\n\n
Networking guides \u00b7 VLANs<\/strong><\/p>\n\n\n\n Planning the addresses too? Use our free subnet calculator<\/a>.<\/p>\n\n<\/div><\/div>\n\n\n\n A VLAN is a way of making one switch act like several separate switches, so that groups of devices share the same cables and hardware but behave as if they were on different networks.<\/p>\n\n\n\n Picture a 24-port office switch. Without VLANs, every device plugged into it can see every other device: the reception PC, the accounts laptop, the printer, the camera and the meeting-room TV. With VLANs, you might put ports 1 to 12 in a "staff" VLAN, ports 13 to 16 in a "cameras" VLAN and port 17 in a "printers" VLAN. The switch now treats those groups as three isolated networks, even though it’s one box with one power cable.<\/p>\n\n\n\n The same idea stretches across several switches and across Wi-Fi.<\/p>\n\n\n\n A broadcast domain<\/strong> is the group of devices that hear each other’s broadcasts, which devices send all the time: "who has this IP address?" (ARP), "is there a DHCP server out there?", "is there a printer on this network?".<\/p>\n\n\n\n On a flat network, every device hears every broadcast. That has two costs:<\/p>\n\n\n\n Each VLAN is its own broadcast domain: broadcasts in the camera VLAN stay in the camera VLAN.<\/p>\n\n\n\n Security.<\/strong> VLANs let you separate devices by how much you trust them. Staff laptops, guest phones, cameras and smart-home gadgets carry very different risks. Cheap connected devices often run rarely patched software. If one is compromised, you want it stuck in a small, fenced-off network, not beside your accounting data. This is what people mean by network segmentation<\/strong>.<\/p>\n\n\n\n Performance.<\/strong> Smaller broadcast domains mean less background noise. You can also give priority to time-sensitive traffic, such as voice calls, by putting it in its own VLAN and applying quality of service (QoS) rules to it.<\/p>\n\n\n\n Organisation.<\/strong> When the cameras live in 10.10.50.0\/24, you know at a glance what an address belongs to, and you can move a device between groups by changing a port setting instead of re-running cables.<\/p>\n\n\n\n No, but they usually go together.<\/p>\n\n\n\n The normal design is one subnet per VLAN<\/strong>. VLAN 20 gets 10.10.20.0\/24, VLAN 30 gets 10.10.30.0\/24, and so on. Matching the third octet to the VLAN ID is a small habit that saves a lot of confusion later. The IDs themselves only mean something inside your own network: there’s no standard "camera VLAN", so pick a scheme and stick to it.<\/p>\n\n\n\n If you need help sizing each subnet, our subnet calculator and mask reference table<\/a> shows how many addresses each prefix gives you.<\/p>\n\n\n\n The standard that makes VLANs work between devices is IEEE 802.1Q<\/strong>. When a frame needs to carry its VLAN membership across a link, the switch inserts a 4-byte tag into the Ethernet header, just after the source address. The tag holds a 2-byte marker (0x8100) that says "this frame is tagged", a 3-bit priority field often used for voice and video, a 1-bit drop-eligible flag and a 12-bit VLAN ID<\/strong> (VID).<\/p>\n\n\n\n Twelve bits gives 4,096 possible values, numbered 0 to 4095. Two are reserved: 0 means "no VLAN, priority information only" and 4095 is reserved for implementation use. That leaves 1 to 4094<\/strong> for real use. Some equipment reserves extra IDs for internal use, so check its documentation before using very high numbers.<\/p>\n\n\n\n Switch ports come in two main flavours:<\/p>\n\n\n\n Some equipment calls these "untagged" and "tagged" port memberships instead.<\/p>\n\n\n\n A trunk can also carry one VLAN untagged<\/strong>. That’s the native VLAN<\/strong> (sometimes shown as the port’s "untagged VLAN" or "PVID"). Any frame arriving on the trunk without a tag is treated as part of the native VLAN.<\/p>\n\n\n\n On most switches the native VLAN defaults to VLAN 1<\/strong>, which is also the VLAN every port starts in out of the box. Keep that in mind; we come back to it in the security section.<\/p>\n\n\n\n Both ends of a trunk must agree on which VLAN is native. If one end thinks it’s VLAN 1 and the other thinks it’s VLAN 99, untagged traffic quietly leaks from one VLAN into the other.<\/p>\n\n\n\n Not directly. Traffic between VLANs has to be routed<\/strong> by a layer 3 device, which decides whether to pass it on. This is called inter-VLAN routing<\/strong>, and there are two common ways to do it.<\/p>\n\n\n\n Router-on-a-stick.<\/strong> One trunk link runs from the switch to a router or firewall. The router has a virtual interface (a sub-interface) in each VLAN, acting as the default gateway for that VLAN’s subnet. Traffic from VLAN 10 to VLAN 20 goes up the trunk, through the router’s rules and back down. It’s simple and common in homes and small offices. The limit is that all inter-VLAN traffic shares that one link.<\/p>\n\n\n\n Layer 3 switch.<\/strong> A switch that can route does the inter-VLAN routing itself, in hardware, at full speed. It suits larger networks with heavy traffic between VLANs. The trade-off is that switches usually filter with simple, stateless access lists rather than a firewall’s full rule set, so think carefully about where the access rules live.<\/p>\n\n\n\n Creating VLANs does not, by itself, stop anything.<\/strong> If your router happily routes between every VLAN with an "allow all" policy, which is the default on plenty of equipment, you’ve organised your network but not secured it.<\/p>\n\n\n\n The security comes from the rules between VLANs. A sensible starting point is default deny<\/strong>: nothing crosses between VLANs unless you’ve written a rule allowing it. Then add only what’s needed:<\/p>\n\n\n\n Wi-Fi access points that support VLANs can map each SSID<\/strong> (the network name you see on your phone) to a VLAN. The access point connects to the switch on a trunk port and tags each wireless client’s traffic with the right VLAN ID.<\/p>\n\n\n\n So "Office" might map to VLAN 10, "Office-Guest" to VLAN 60 and "Office-IoT" to VLAN 80, all from the same access points.<\/p>\n\n\n\n Two things to know:<\/p>\n\n\n\n Here’s a reasonable plan for a small office. It uses the same numbering as our 25-person office example; the home example uses a smaller set. What matters is that the plan is written down and consistent.<\/p>\n\n\n\n Notice VLAN 1 isn’t used for anything. Each VLAN needs its own DHCP scope (or a DHCP relay) so devices get an address in the right subnet; a missing DHCP scope is a common cause of "it connects but has no internet".<\/p>\n\n\n\n To see it in practice, read our worked examples: setting up VLANs on a home network<\/a>, and a VLAN design for a 25-person office<\/a>.<\/p>\n\n\n\n Want VLANs set up properly the first time?<\/strong> We design, build and look after secure networks for Sydney businesses: VLANs and segmentation, firewall rules, Wi-Fi and remote access, documented so the next person understands it.<\/p>\n\n\n\n\n\n
TL;DR<\/h3>\n\n\n\n
\n\n
In this post<\/h3>\n\n\n\n
\n\n
What is a VLAN, in one sentence?<\/h2>\n\n\n\n
\n\n\n\nWhat is a broadcast domain, and why does it matter?<\/h2>\n\n\n\n
\n\n
\n\n\n\nWhy would you use VLANs?<\/h2>\n\n\n\n
\n\n\n\nIs a VLAN the same as a subnet?<\/h2>\n\n\n\n
\n\n
\n\n\n\nHow does a VLAN actually work?<\/h2>\n\n\n\n
The 802.1Q tag<\/h3>\n\n\n\n
Access ports and trunk ports<\/h3>\n\n\n\n
\n\n
The native VLAN<\/h3>\n\n\n\n
\n\n\n\nHow do devices in different VLANs talk to each other?<\/h2>\n\n\n\n
The firewall rules are the real security<\/h3>\n\n\n\n
\n\n
\n\n\n\nHow do VLANs work with Wi-Fi?<\/h2>\n\n\n\n
\n\n
\n\n\n\nWhat does a typical VLAN plan look like?<\/h2>\n\n\n\n
\n\n
\n \nVLAN ID<\/th>\n Name<\/th>\n Subnet example<\/th>\n Purpose<\/th>\n<\/tr>\n<\/thead>\n \n 10<\/td>\n Staff<\/td>\n 10.10.10.0\/24<\/td>\n Staff laptops and desktops<\/td>\n<\/tr>\n \n 20<\/td>\n Servers<\/td>\n 10.10.20.0\/24<\/td>\n File server, NAS, internal applications<\/td>\n<\/tr>\n \n 30<\/td>\n Voice<\/td>\n 10.10.30.0\/24<\/td>\n IP phones, with QoS priority<\/td>\n<\/tr>\n \n 40<\/td>\n Printers<\/td>\n 10.10.40.0\/24<\/td>\n Printers and scanners<\/td>\n<\/tr>\n \n 50<\/td>\n Security<\/td>\n 10.10.50.0\/24<\/td>\n Cameras, video recorder, door access<\/td>\n<\/tr>\n \n 60<\/td>\n Guest<\/td>\n 10.10.60.0\/24<\/td>\n Visitor Wi-Fi, internet only<\/td>\n<\/tr>\n \n 70<\/td>\n Remote access<\/td>\n 10.10.70.0\/24<\/td>\n VPN users, kept apart from on-site staff<\/td>\n<\/tr>\n \n 80<\/td>\n IoT<\/td>\n 10.10.80.0\/24<\/td>\n Smart TVs, meeting-room displays, building devices<\/td>\n<\/tr>\n \n 99<\/td>\n Management<\/td>\n 10.10.99.0\/24<\/td>\n Switch, access point and firewall admin interfaces, and the admin workstation<\/td>\n<\/tr>\n \n 999<\/td>\n Unused \/ parking<\/td>\n none<\/td>\n Unused ports, deliberately goes nowhere<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n