On a "flat" network every device can see every other: the work laptop, the smart TV, the cheap camera bought online, the guest's phone. If one of them is compromised, it can reach all the others directly. Segmenting the network means splitting it into separate zones and deciding explicitly who can talk to whom. The main tool for doing this is the VLAN.
What a VLAN is
A VLAN (Virtual LAN) is a separate logical network that shares the same cables and switches with other networks. To a connected device, a VLAN behaves exactly like its own physical network: it has its own address range, its own broadcast traffic, and it cannot see devices on other VLANs.
Moving from one VLAN to another is possible only through a router or firewall, which applies the rules you set. That is precisely the value of segmentation: traffic between zones goes through a control point.
How tags work
The standard describing VLANs on Ethernet is IEEE 802.1Q. Each VLAN has a number from 1 to 4094. When a frame has to travel over a link shared by several VLANs, the switch adds a 4-byte label (tag) carrying the VLAN number.
Ports on a managed switch can be configured in two ways:
| Port type | Traffic | Typical connection |
|---|---|---|
| Access (untagged) | A single VLAN, no tag | PC, printer, camera |
| Trunk (tagged) | Several VLANs, tagged | Switch-to-switch links, uplink to the router or an access point |
A trunk port can also have a native VLAN, whose traffic travels untagged. It is good practice to use a VLAN no device uses as the native one, so that untagged traffic does not land on the wrong network.
Wi-Fi and VLANs
Modern access points can broadcast several Wi-Fi networks (several SSIDs) and map each to a VLAN. The link between access point and switch becomes a trunk: the "Home" network leaves on VLAN 10, "Guests" on VLAN 30, "IoT" on VLAN 20. Many home routers offer an already isolated guest network: it is a simplified form of the same principle.
An example layout
| VLAN | Name | Subnet | Contents | Can reach |
|---|---|---|---|---|
| 10 | Trusted | 192.168.10.0/24 | PCs, personal phones | Internet, servers, IoT (to manage it) |
| 20 | IoT | 192.168.20.0/24 | TV, smart plugs, appliances | Internet only |
| 30 | Guests | 192.168.30.0/24 | Visitors' devices | Internet only |
| 40 | Servers | 192.168.40.0/24 | NAS, home server | Internet for updates |
| 50 | Cameras | 192.168.50.0/24 | Video surveillance | Only the recorder, no Internet |
Firewall rules follow a "deny by default" logic: the trusted network can open connections to the others, but not the other way round. Cheap cameras, which often try to contact external services, stay confined.
The discovery services problem
Once networks are separated, some features stop working: the phone can no longer find the TV to cast video, the PC no longer sees the printer. These services rely on discovery protocols such as mDNS and SSDP, which work only within the same network.
The solutions:
- enable an mDNS repeater (also called a reflector) on the router between the relevant VLANs, then allow only the necessary traffic through the firewall;
- put devices that must work closely together in the same VLAN;
- configure printers by direct IP address rather than automatic discovery.
What you need
- A router or firewall that supports VLANs, with rules between interfaces. Many high-end home routers and all dedicated firewalls allow this.
- Managed (or "smart") switches that support 802.1Q. The cheapest unmanaged switches usually do not handle tags reliably.
- Access points with multi-SSID and VLAN support, if you want to separate the Wi-Fi too.
Practical tips
- Design the networks on paper before touching the configuration: number of VLANs, subnets, who can reach what.
- Always keep a management port reachable: if you misconfigure a trunk you can lose access to the switch.
- Separate the management interfaces of network equipment too, making them reachable only from the trusted network.
- Do not use VLAN 1 for devices: it is the default on many devices and easily ends up everywhere by mistake.
- In my incident analysis work, a segmented network often makes the difference between a single compromised device and an entire network to clean up.
In short
- A VLAN is a separate logical network sharing cables and switches with others.
- The 802.1Q tag identifies the VLAN on trunk ports; access ports serve a single segment.
- Traffic between VLANs goes through a router or firewall, where the rules are set.
- Separate at least trusted devices, IoT, guests and cameras.
- Plan for discovery services such as mDNS before separating everything.
