VLAN

One switch, three networks, zero extra hardware. A VLAN is the trick that lets your smart bulbs and your file server share a cable without sharing a network.

The short answer

A VLAN (virtual LAN) splits one physical network into separate logical ones. Each VLAN is its own broadcast domain and IP subnet, marked on the wire by an IEEE 802.1Q tag [1][2][5]. Devices in different VLANs can only talk through a router or Layer 3 switch [5]. Our assessment: VLANs are worth it once you want to keep guests and cheap IoT devices away from your servers. But a VLAN alone is not a security wall; the firewall rules between VLANs are.

How it works

1. The tag. 802.1Q inserts a 4-byte tag between the source address and the type field of an Ethernet frame, and the switch recalculates the frame check sequence [2]. The tag starts with the identifier 0x8100, followed by a 3-bit priority, one more bit and a 12-bit VLAN ID [2][3][4]. The IDs 0 and 4095 are reserved, which leaves 1 to 4094 for real VLANs [4]. A tagged frame can be as large as 1522 bytes [2].
2. Access and trunk ports. An access port carries one VLAN and sends untagged frames to a device such as a PC or camera. A trunk port carries several VLANs and sends tagged frames, typically between switches or to a router [4]. Cisco notes that 802.1Q leaves the native VLAN untagged on a trunk, and that both ends of the trunk must use the same native VLAN [2].
3. Separate subnets. VLANs separate devices into different broadcast domains and Layer 3 subnets. Devices in separate VLANs need a Layer 3 device to reach each other, either a router or a switch with routing features [5].
4. Policy lives at the router. Because all inter-VLAN traffic passes the Layer 3 device, that is where you can control it. Meraki describes access control lists on a Layer 3 switch for traffic between VLANs [5]. Our assessment: without rules there, a VLAN setup is just tidy.
5. What the hardware must do. A device that does not understand 802.1Q discards tagged frames [4], so a plain unmanaged switch in the middle of a trunk can break things. You need switches that can set a VLAN per port, a router that routes between the VLANs, and, for Wi-Fi, access points that tie an SSID to a VLAN, as in Meraki's guest-network example [5].
6. VLANs on a Linux host. ip link add link DEVICE name NAME type vlan id VLANID creates a VLAN interface on top of a physical one [6]. Hypervisors use the same mechanism for virtual machines.

A homelab example

Our inventory (as of 14 to 16 Oct 2026) lists a UniFi router and firewall and names the VLAN and DHCP setup as a gap, so we say nothing about our own VLANs here. As a generic example for your Linux server, put a service on VLAN 20:

sudo ip link add link eth0 name eth0.20 type vlan id 20
sudo ip addr add 192.168.20.5/24 dev eth0.20
sudo ip link set eth0.20 up

The switch port that eth0 plugs into must be a trunk that carries VLAN 20 tagged [4]. The VLAN number 20 and the addresses are examples.

Checklist

• Draw the groups first: trusted, servers, IoT, guests.
• Give each VLAN its own subnet and a gateway address on the router [5].
• Check that every switch between the devices supports 802.1Q [4].
• Set the same native VLAN on both ends of every trunk [2].
• Write firewall rules for traffic between VLANs; do not rely on the tag alone [5].
• Test from a device in each VLAN: it should reach what you allow and nothing else.
• Write the VLAN IDs and what they are for in your network notes.