VLAN (virtual LAN)
Also known as: VLAN, virtual LAN, virtual local area network
A VLAN, or virtual local area network, divides a single physical network into separate logical networks.
Devices on different VLANs can't talk to each other directly, even when they plug into the same switches, unless a router or firewall allows it. While VLANs are a cheap and powerful way to separate staff, guest, payment, and smart device traffic, a poorly planned VLAN setup can create confusing gaps or accidentally connect things that should stay apart.
VLAN (virtual LAN), explained at three levels
At home
A VLAN is like dividing one office floor into separate rooms using invisible walls. Everyone shares the same hallways and wiring, but people in one room cannot wander into another without going through a guarded door. On a network, the switches enforce those invisible walls, keeping groups of devices separate even though they plug into the same equipment.
At work
A VLAN, or virtual local area network, splits one physical network of switches and access points into several isolated networks. Each group, such as staff, guests, payment terminals, or security cameras, gets its own VLAN. Businesses use VLANs to limit how far an attack or problem can spread, and to meet rules such as PCI DSS without buying separate hardware for every group.
At home
A switch normally lets every connected device see broadcast traffic from all the others. With VLANs, the switch sorts its ports into groups, numbered 1 to 4094, and only forwards traffic between ports in the same group. Some home routers and mesh systems offer a separate IoT or guest network built on the same idea. Devices on different VLANs can only talk if a router or firewall passes traffic between them, so a hacked camera cannot easily reach your laptop.
At work
The 802.1Q standard adds a four-byte tag to each Ethernet frame carrying a VLAN ID. Access ports belong to one VLAN and send untagged frames to ordinary devices. Trunk ports carry many VLANs between switches, access points, and firewalls, with each frame tagged. Each VLAN usually maps to its own IP subnet and DHCP scope, and Wi-Fi SSIDs can map to VLANs. Traffic between VLANs passes through a router or firewall, where inter-VLAN rules decide what is allowed.
At home
A VLAN only separates traffic at the switch level. Once devices need to reach the internet or a shared printer, their traffic goes through the router, and if the router allows everything between VLANs, the separation is cosmetic. Real isolation comes from firewall rules on that routing step. While VLANs sound like the advanced part, in my view the firewall rules between them matter far more than the VLANs themselves.
At work
VLAN designs fail through misconfiguration. Leaving user devices on default VLAN 1, or allowing every VLAN on every trunk, invites VLAN hopping attacks such as switch spoofing and double tagging. Best practice is to disable automatic trunk negotiation, use an unused native VLAN, prune trunks, and document each VLAN's purpose. Larger organizations add private VLANs or microsegmentation for finer control. For PCI DSS, properly segmented VLANs with firewall rules can shrink which systems fall into assessment scope.
Real-world examples
At home
Marcus put his smart plugs and doorbell camera on a separate network at home. If one is compromised, the attacker can't easily reach the family computers.
At work
Fatima runs IT for a restaurant group in Halifax. She placed payment terminals on their own VLAN, separate from staff and guest Wi-Fi, to limit exposure and simplify payment security reviews.
How it compares
| feature | VLAN (virtual LAN) | Physical separate network |
|---|---|---|
| Separation | Logical, on shared gear | Separate cables and switches |
| Cost | Low | High |
| Flexibility | Change in software | Rewiring needed |
| Risk | Misconfiguration | Lower, but costly |
VLANs give most of the separation for a fraction of the cost.
For analysts
For any business with guests, cameras, or payment terminals, I'd ask whether they're separated by VLANs and firewall rules. It's one of the cheapest risk reductions available.
History & origin
As office networks grew in the 1980s and 1990s, every device on a network segment could see broadcast traffic from all the others, which hurt performance and security. Network vendors created proprietary ways to group ports logically. The IEEE published the 802.1Q standard in 1998, which adds a small 'tag' to Ethernet frames identifying their VLAN, letting switches from different vendors work together. VLANs became standard in business networks, and later in Wi-Fi, where each wireless network name can map to its own VLAN. In my view, VLANs are the single most useful security feature that small businesses already own but don't use.