What is VLAN (Virtual Local Area Network)?
Updated: 3 days ago
A VLAN, or Virtual Local Area Network, is a way of dividing one physical Ethernet network into multiple logical Layer 2 networks. Devices can use the same switches, cabling and other infrastructure while remaining in separate broadcast domains. VLAN membership is controlled by the network configuration rather than by where a device is physically plugged in.
The important distinction is that a VLAN is not a separate broadband connection and it is not the same thing as an IP subnet. VLANs separate Ethernet traffic at Layer 2. IP subnets separate IP address ranges at Layer 3. In many real networks one VLAN is paired with one IP subnet, but that is a design choice rather than a definition.
How does a VLAN work?
A VLAN-aware switch associates Ethernet frames with a VLAN. On an access port, the switch normally places traffic from the connected device into the VLAN configured for that port. The end device can therefore behave like an ordinary Ethernet device without adding its own VLAN tag.
When several VLANs need to cross the same link between VLAN-aware devices, IEEE 802.1Q tagging can identify which VLAN a frame belongs to. The VLAN identifier in the tag is 12 bits. The conventional usable VLAN ID range is 1 to 4094, with particular values reserved by the standard. RFC 7348 also describes the practical VLAN scale limit as 4094.
For a standards-based explanation of the 12-bit VLAN identifier and the 4094 VLAN limit, see RFC 7348.
Access ports vs trunk ports
Access port: normally carries traffic for one access VLAN to or from an endpoint such as a desktop PC, printer, camera or other device.
Trunk port: carries traffic for multiple VLANs across one physical link, commonly between switches, routers, firewalls, servers, hypervisors or VLAN-aware wireless infrastructure.
802.1Q tag: identifies the VLAN associated with a tagged Ethernet frame on a VLAN-aware link.
Native VLAN: on equipment that uses this concept, untagged traffic on an 802.1Q trunk is associated with the configured native VLAN. Configuration must be deliberate and consistent.
Cisco's current VLAN trunking documentation explains that an 802.1Q trunk can receive tagged and untagged traffic, and that untagged traffic is handled through the configured native VLAN. See Cisco VLAN trunking documentation.
VLAN vs subnet: what is the difference?
A VLAN defines a Layer 2 broadcast domain. A subnet defines a Layer 3 IP network. Keeping those layers separate in your mental model makes VLAN design much easier to understand.
VLAN: controls which Layer 2 network a frame belongs to.
Subnet: defines an IP address range and determines which destinations are considered local at Layer 3.
Router or Layer 3 switch: moves IP traffic between different subnets and, in a typical VLAN design, between different VLANs.
Firewall policy: can permit, restrict or inspect traffic moving between VLANs.
For the IP side of this relationship, read What is Subnet?.
Why use VLANs on a home or small business network?
VLANs become useful when one physical network needs several different trust zones or operational groups. A capable managed switch, router or firewall and, where WiFi is involved, suitable access points can let you separate devices without installing a completely independent set of cables and switches for each group.
Main devices: laptops, desktops and trusted personal devices.
Guest WiFi: visitors can receive internet access without joining the same local network as trusted devices.
IoT devices: smart TVs, speakers, plugs and other connected equipment can be placed in a more restricted network.
Security equipment: cameras and recorders can be separated from ordinary user devices.
Work devices: business equipment can be isolated from personal devices in a home office.
Servers and infrastructure: management interfaces and important systems can have their own network policy.
Do VLANs improve security?
VLANs provide segmentation, but segmentation alone is not a complete security policy. Putting two devices into different VLANs separates their Layer 2 broadcast domains. If a router or Layer 3 switch is configured to route freely between those VLANs, however, the devices may still communicate at Layer 3.
The security value comes from combining segmentation with appropriate routing and firewall rules. For example, an IoT VLAN might be allowed to reach the internet and a local DNS resolver while being blocked from initiating connections to trusted computers. A guest VLAN might be prevented from reaching all private local networks.
What is inter-VLAN routing?
Devices in different VLANs normally need Layer 3 routing to communicate. This is called inter-VLAN routing. The routing function can be provided by a router, firewall or Layer 3 switch, depending on the network design.
A common design gives each VLAN its own IP subnet and a gateway interface. Traffic that stays within the same VLAN can be switched locally. Traffic that needs to reach another VLAN is sent to the relevant gateway, where routing and firewall policy determine whether it is allowed.
Devices may receive their IP configuration from DHCP, with a separate DHCP scope or relay arrangement for each VLAN where required.
VLAN example: one switch, four logical networks
Consider a managed switch serving a small office. The physical switch has 24 Ethernet ports, but the administrator creates four logical networks.
VLAN 10: staff devices using 192.168.10.0/24.
VLAN 20: security cameras using 192.168.20.0/24.
VLAN 30: guest WiFi using 192.168.30.0/24.
VLAN 40: servers and infrastructure using 192.168.40.0/24.
These IPv4 ranges are an illustrative design, not values required by VLAN technology. The VLAN IDs do not have to match the third octet of an IPv4 address. Matching them can make a small network easier for a human to read, but the switch does not derive one value from the other.
For the addressing principles behind this example, see What is IPv4? and What is IPv6?. VLANs can carry IPv4, IPv6 or both.
VLAN IDs and the 4094 limit
The VLAN ID field in an IEEE 802.1Q tag is 12 bits wide, which gives 4096 possible numerical values from 0 to 4095. Two values have special meaning, leaving VLAN IDs 1 to 4094 as the conventional range available for VLAN identification.
Techie Broadband calculation: 2^12 = 4096 possible bit patterns. Removing the two special endpoint values leaves 4094 conventional VLAN IDs. Equipment can impose additional platform-specific restrictions, so a device's supported VLAN count can be lower than the numerical ID range.
VLANs and WiFi
Business and prosumer WiFi equipment often lets an SSID map to a VLAN. That makes it possible for several wireless networks to use the same access points while applying different network policies.
For example, a trusted SSID might map to VLAN 10 while a guest SSID maps to VLAN 30. The access point and upstream switch link must be configured so the required VLANs can traverse the network correctly. Consumer mesh systems and ISP-supplied routers vary considerably in how much VLAN control they expose.
VLANs and UK broadband
A VLAN inside your home or business network is independent of whether your broadband service uses FTTP, FTTC, cable, fixed wireless or another access technology. Your internal VLANs normally exist on the LAN side of your router or firewall.
There is a separate issue at the broadband WAN edge: some UK providers require a particular VLAN tag or other Ethernet configuration for a customer-owned router to reach their service. That provider-facing VLAN is not automatically the same thing as the VLANs you create to segment your own LAN. Requirements depend on the ISP, access network, product and location, so the provider's current setup information should be checked before replacing its router.
What equipment do you need for VLANs?
Managed switch: must support the VLAN features required by the design.
Router, firewall or Layer 3 switch: required when traffic must move between VLANs or reach other routed networks.
VLAN-aware WiFi access point: required if different SSIDs need to map to different VLANs.
Correct trunk configuration: required on links that need to carry multiple VLANs.
DHCP design: each routed client network needs suitable address configuration, whether static, local DHCP or relayed DHCP.
Firewall rules: required when VLAN boundaries are intended to enforce different trust or access policies.
Common VLAN mistakes
Assuming a VLAN is the same as a subnet: they operate at different network layers.
Creating VLANs but allowing unrestricted routing between them: this weakens the intended security separation.
Mismatching VLAN IDs or native VLAN configuration across a trunk: this can cause connectivity problems or traffic to enter the wrong logical network.
Forgetting to allow a required VLAN on a trunk: the VLAN can exist on both devices but still fail to cross the link.
Putting an unmanaged switch in a path without understanding how it handles tagged frames: behaviour and suitability vary by device.
Changing VLAN settings remotely without a recovery path: a management VLAN mistake can disconnect you from the switch, router or access point.
How to troubleshoot a VLAN
Confirm the endpoint is connected to the intended switch port or SSID.
Check the access VLAN configured on the endpoint-facing port.
Check that the VLAN exists on every VLAN-aware device that needs to carry it.
Check trunk links and confirm the VLAN is allowed end to end.
Check native VLAN settings where untagged trunk traffic is intentionally used.
Confirm the device has the expected IP address, subnet prefix, gateway and DNS settings.
Test communication with another device in the same VLAN before testing another VLAN.
Check the gateway interface for the VLAN if routed connectivity is required.
Check firewall or access-control rules for inter-VLAN traffic.
Check DHCP scopes or relay configuration if clients cannot obtain an address.
Only after the local VLAN path works should you troubleshoot the broadband or wider internet path.
VLAN vs VPN
VLAN and VPN sound similar but solve different problems. A VLAN segments a local Layer 2 network. A VPN creates a logical network connection or encrypted tunnel across another network, depending on the VPN technology.
For the separate remote-networking concept, see What is VPN (Virtual Private Network)?.
VLAN FAQs
Can devices on different VLANs communicate?
Yes, if a Layer 3 device routes between the VLANs and the relevant firewall or access-control policy permits the traffic. Without inter-VLAN routing, they remain separate Layer 2 broadcast domains.
Does a VLAN need its own subnet?
VLAN and subnet are different concepts, but normal routed network design usually assigns a separate IP subnet to each VLAN. Reusing the same IP subnet across isolated VLANs creates additional design complications and is not the ordinary small-network model.
Does a VLAN make broadband faster?
Not by itself. VLANs organise and segment Ethernet traffic. They do not increase the line rate of your broadband connection. Better network design can reduce unnecessary broadcast exposure or improve policy control, but the broadband service speed remains governed by the actual access link, ISP network and end-to-end path.
Can an unmanaged switch create VLANs?
Normally no. Creating and assigning VLANs requires VLAN-aware configuration. Some unmanaged switches may forward tagged Ethernet frames transparently, but that is not the same as providing managed VLAN membership, trunk configuration or access-port control.
Is VLAN 1 always the native VLAN?
No. Many platforms use VLAN 1 as a default, but the native VLAN on an 802.1Q trunk can be configured differently on equipment that supports that model. Both ends of a trunk must be configured consistently.
Key takeaway
A VLAN lets one physical Ethernet infrastructure behave as several separate logical Layer 2 networks. The switch keeps broadcast domains apart using VLAN membership and, where multiple VLANs share a link, 802.1Q tagging. VLANs become most useful when they are combined with sensible IP subnetting, routing, DHCP and firewall policy. They can separate trusted devices, guests, IoT equipment, cameras, work systems and infrastructure without requiring a completely separate physical network for every group.
To explore the related technical concepts used in this VLAN (Virtual Local Area Network) guide, visit our broadband terminology guide.
