What is Network Segmentation?
Updated: 3 days ago
Network segmentation is the practice of dividing a network into smaller, controlled zones so that devices, users and systems do not all share unrestricted access to one another. The boundaries can be physical or logical, and routers, firewalls, VLANs, subnets, access-control rules and other controls can be used to decide which traffic is allowed to cross them.
The key point is that segmentation creates boundaries, but the boundary only becomes a useful security control when communication between segments is deliberately restricted. A network can contain several VLANs or subnets and still be poorly segmented if routing and firewall policy allow almost everything between them.
How does network segmentation work?
A flat network gives many devices broad reachability within the same network environment. Segmentation divides that environment into zones based on trust, function, sensitivity or operational need. Traffic that needs to move from one zone to another is then sent through an enforcement point or governed by a policy that decides whether the communication is permitted.
The UK National Cyber Security Centre describes network segmentation as breaking a network into smaller networks so that traffic flows and access between them can be controlled. Its secure design guidance says a zoned or segmented approach can help contain compromise, protect more sensitive assets and make communication between segments easier to limit or examine.
Primary UK guidance: NCSC Network Security Fundamentals and NCSC Secure Design Principles.
Flat network vs segmented network
Flat network: devices and systems have relatively few internal boundaries between them, so a compromised device may have more potential paths to other resources.
Segmented network: devices and systems are grouped into separate zones and communication between those zones is intentionally controlled.
Isolated network: a stronger form of separation in which a segment may have no normal route to another network at all.
Microsegmented environment: policy is applied at a finer level, potentially around individual workloads, applications, services or devices rather than only large network zones.
Segmentation is therefore not simply about creating more network names. The important design question is which systems genuinely need to communicate, in which direction, over which protocols and ports, and under what conditions.
Why is network segmentation useful?
Limit lateral movement: reduce the number of systems an attacker can reach after compromising one device.
Protect sensitive systems: place servers, management interfaces, cameras or other important assets behind stricter controls.
Separate trust levels: keep guest, IoT, work and administrative devices from sharing the same unrestricted environment.
Control communication: allow only the flows that are actually required between zones.
Improve monitoring: traffic crossing important boundaries can be logged, inspected or alerted on.
Contain faults or incidents: a problem in one segment can have fewer direct paths into another.
The NCSC's October 2026 guidance on disruptive cyber attacks specifically states that network segmentation limits how far an attacker can move within an organisation and can help restrict access to sensitive systems and contain incidents.
Network segmentation vs VLANs
A VLAN is a Layer 2 mechanism for creating separate logical broadcast domains on shared Ethernet infrastructure. VLANs are commonly used as part of a segmentation design, but a VLAN is not the security policy itself.
For example, an office could place staff devices in VLAN 10 and IoT devices in VLAN 20. If a router or Layer 3 switch then permits unrestricted traffic between VLAN 10 and VLAN 20, the logical separation exists but the intended security boundary is weak. Firewall or access-control rules are what determine which routed traffic can cross.
Network segmentation vs subnets
A subnet defines an IP network at Layer 3. Subnets and VLANs are often paired, so one VLAN has one IPv4 or IPv6 subnet, but they remain different concepts.
A subnet provides an addressing and routing boundary. Segmentation is the broader architectural goal of controlling reachability and communication. Two subnets can be routed freely between each other, so creating a second subnet does not automatically create meaningful security separation.
What controls enforce segmentation?
Firewalls: inspect and permit or deny traffic according to policy.
Routers and Layer 3 switches: provide the routing boundary between IP networks and may enforce access-control rules.
VLANs: separate Layer 2 broadcast domains on VLAN-aware Ethernet networks.
Subnets: separate IP address spaces and provide Layer 3 routing boundaries.
Wireless SSID-to-VLAN mapping: places different wireless groups into different network zones.
Host firewalls: restrict traffic at the individual endpoint as an additional layer.
Cloud security groups and network controls: restrict traffic between cloud workloads and services.
Identity-aware or zero-trust controls: make access decisions using more than network location alone.
Practical home network segmentation
Network segmentation is not only for large enterprises. A technically capable home router, firewall, managed switch and VLAN-aware WiFi access points can create useful boundaries inside a home network.
Trusted devices: personal computers, phones and tablets.
Guest devices: visitors who need internet access but not access to local systems.
IoT devices: smart TVs, speakers, plugs, thermostats and appliances.
Cameras: CCTV cameras and network video recorders.
Work devices: employer-managed equipment that should not share unrestricted access with personal devices.
Management: router, switch, access-point and server administration interfaces.
A useful home design does not require every device type to have its own segment. The aim is to group devices with similar trust and communication requirements, then make the rules understandable enough to maintain.
Example: segmenting a home or small office
Practical example: imagine a network with trusted computers, guest WiFi, smart-home devices and a small server. The following policy is illustrative rather than a universal recommendation.
Trusted zone: can reach the internet and selected local services.
Guest zone: can reach the internet but cannot initiate connections to private local networks.
IoT zone: can reach only the internet and specific local services it genuinely requires.
Server zone: accepts only the application traffic required from trusted clients, with administration restricted more tightly.
The useful part is not the number of zones. It is the explicit communication policy between them. If the smart-home devices never need to initiate a connection to a laptop, there is little reason to allow that path.
Techie Broadband segmentation matrix
Techie Broadband analysis: a simple communication matrix makes segmentation policy easier to reason about before any firewall rules are written. For four zones there are 12 possible directed inter-zone relationships, because each of four source zones can potentially initiate traffic to three other zones. That is 4 × 3 = 12 policy relationships to consider, before protocols and ports are added.
This demonstrates why segmentation complexity grows quickly. With six zones there are 6 × 5 = 30 possible directed inter-zone relationships. More segments can improve control, but they also create more policy that must be documented, tested and maintained.
Network segmentation and lateral movement
Lateral movement is the process of moving from an initially compromised system towards other systems, accounts or data. Segmentation can make that movement harder by removing unnecessary network paths.
The NCSC's Preventing Lateral Movement guidance recommends grouping and isolating critical business systems and applying appropriate network security controls. Systems and data that do not need to interact should be separated.
Network segmentation vs zero trust
Network segmentation and zero trust are related, but they are not interchangeable. Segmentation controls network paths and boundaries. Zero trust goes further by removing implicit trust based solely on network location and making access decisions around users, devices, resources and policy.
NIST SP 800-207 states that zero trust grants no implicit trust merely because an asset or account is on a particular physical or network location. See NIST Zero Trust Architecture.
A well-segmented network can support a zero-trust architecture, but being inside a trusted VLAN should not by itself be treated as proof that a user or device is trustworthy.
What is microsegmentation?
Microsegmentation applies segmentation at a finer level than broad network zones. Instead of only separating departments or large VLANs, controls can be applied around individual workloads, applications, services, devices or small groups of resources.
The NCSC describes microsegmentation in operational technology as dividing zones into smaller units based on workloads, applications or device functions, allowing more targeted communication policies. The same general idea is widely used in data-centre and cloud security architectures.
Does segmentation affect broadband speed?
Network segmentation does not increase the speed of the broadband line. FTTP, FTTC, cable or another access technology still provides the same underlying internet connection. Segmentation changes how traffic is organised and controlled on the local network.
Performance can be affected by the equipment enforcing the boundary. If inter-segment traffic passes through a firewall or router that cannot process packets at the required rate, that device can become a bottleneck. This matters increasingly on 1 Gbps, 2.5 Gbps and faster local networks, where security inspection and routing performance can be lower than raw Ethernet interface speed.
Network segmentation and IPv4 or IPv6
Segmentation can be used with IPv4, IPv6 or a dual-stack network. The policy needs to account for every protocol actually enabled. Filtering IPv4 while leaving equivalent IPv6 paths unrestricted can undermine the intended boundary.
Client addressing may be provided by DHCP for IPv4 and by the appropriate IPv6 mechanisms for IPv6. Each routed segment needs a coherent addressing and gateway design.
Common network segmentation mistakes
Creating VLANs but allowing unrestricted routing between all of them.
Assuming a different IP subnet automatically means traffic is securely isolated.
Building too many segments without documenting the communication they require.
Blocking legitimate supporting services such as DNS, DHCP relay, NTP or required discovery traffic without understanding the dependency.
Leaving management interfaces reachable from ordinary user or guest networks.
Applying IPv4 controls but forgetting equivalent IPv6 traffic.
Using broad any-to-any firewall rules as permanent fixes when an application fails.
Failing to log or review important inter-segment traffic.
Treating the internal network as automatically trusted.
How to troubleshoot network segmentation
Confirm the source device is in the intended VLAN, subnet, SSID or security zone.
Confirm it has the expected IP address, prefix, default gateway and DNS configuration.
Test communication to another device inside the same segment.
Test reachability to the segment gateway.
Identify the exact destination IP address, protocol and port required across the boundary.
Check routing so both forward and return paths exist.
Check firewall or access-control rules in the correct direction.
Check logs for an explicit deny, drop or policy mismatch.
Check whether the application depends on multicast, broadcast or discovery traffic that does not naturally cross routed boundaries.
Check IPv4 and IPv6 separately where both are enabled.
Temporarily narrow the test to one known source and destination rather than opening broad access.
Document the final required rule once the working dependency is understood.
Do not start by disabling the firewall or merging the segments. First identify which exact dependency is failing. Otherwise a troubleshooting shortcut can quietly remove the security boundary the design was intended to create.
Does a VPN provide network segmentation?
A VPN and network segmentation solve different problems. A VPN creates a logical network connection or encrypted tunnel across another network, depending on the VPN technology. Segmentation controls which parts of a network can communicate.
A remote-access VPN can place connected users into a dedicated network segment, and firewall rules can then restrict what that VPN segment can reach. The segmentation comes from the surrounding routing and access policy, not from the word VPN itself.
Network segmentation FAQs
Is a VLAN the same as network segmentation?
No. A VLAN is one technology that can be used to create logical Layer 2 boundaries. Network segmentation is the broader design practice of separating systems and controlling communication between zones.
Can network segmentation stop an attacker?
It cannot guarantee that an attacker is stopped, but good segmentation can remove unnecessary paths, make lateral movement harder and limit the systems exposed after a compromise. It should be combined with identity controls, patching, endpoint security, monitoring and other defences.
How many network segments should I create?
There is no universal number. Create segments around meaningful differences in trust, sensitivity, function or communication need. Every extra segment creates policy and operational overhead, so the design should be as granular as the risk justifies and as simple as the organisation can reliably maintain.
Does guest WiFi count as network segmentation?
It can. If guest clients are placed into a separate network and prevented from reaching trusted local resources, guest WiFi is a practical form of segmentation. A separate SSID alone does not prove that the underlying traffic is isolated.
Is network segmentation only for businesses?
No. Home users can use segmentation to separate guests, IoT devices, cameras, work equipment and trusted personal devices. The available controls depend on the router, firewall, switches and WiFi equipment being used.
Key takeaway
Network segmentation divides a network into smaller zones and deliberately controls what may communicate between them. VLANs, subnets, firewalls and routing are tools that can implement the design, but simply creating separate networks is not enough. The security benefit comes from removing unnecessary paths, enforcing explicit communication rules, protecting sensitive systems and maintaining those rules as the network changes.
To explore the related technical concepts used in this Network Segmentation guide, visit our broadband terminology guide.
