What Is a VLAN, and Do You Need One at Home?
Contents
A VLAN (virtual local area network) lets one set of switches and cables carry several networks that cannot see each other, as if each had its own hardware. Offices have used them for decades. At home you meet VLANs in two places: your fiber or DSL provider asks you to enter a “VLAN ID” in the router, or you want to keep smart-home gadgets and guests away from your computers. This guide explains both.
What a VLAN Is
Normally, everything plugged into the same switch or router is on one network: every device can see every other device, and broadcast traffic reaches all of them. A VLAN draws a line through that hardware. Ports or Wi-Fi networks assigned to VLAN 10 form one network; those in VLAN 20 form another. Devices in different VLANs cannot talk to each other directly — traffic between them has to go through a router or firewall, where you decide what is allowed.
Each VLAN usually gets its own IP range — for example 192.168.10.0/24 for computers and 192.168.20.0/24 for smart devices — and the router acts as the gateway for each. See what is a subnet mask for how ranges work.
How VLANs Work: Tags and Ports
VLANs are defined by the IEEE 802.1Q standard. When a frame needs to carry its VLAN membership across a link, the switch inserts a small tag into it: Cisco’s documentation describes a 4-byte tag inserted into the original Ethernet frame. Inside the tag is the VLAN ID, a number from 1 to 4094 (the 12-bit field allows 4096 values, two of which are reserved).
Ports come in two kinds:
- Untagged (access) port — belongs to one VLAN. The device plugged in sends ordinary frames and does not know VLANs exist; the switch adds and removes the tag. A PC, a TV or a printer is connected this way.
- Tagged (trunk) port — carries several VLANs over one cable, each frame keeping its tag. Cisco describes trunks as links that carry traffic belonging to multiple VLANs between devices. Used between switches, to the router, and to access points that broadcast several Wi-Fi networks.
One VLAN on a trunk can be left untagged — the native VLAN — and both ends must agree on which one it is.
Why Your Provider Asks for a VLAN ID
Many fiber and some DSL providers deliver internet on a specific VLAN. Their equipment expects your router’s internet (WAN) traffic to carry a particular VLAN ID; without it, the router never gets a connection. Dom.ru’s instructions for its Wave GPON router, for example, tell users to set VLAN ID 10 for a PPPoE connection. Providers that offer TV over the same line often use a separate VLAN for TV.
If you replace your provider’s router with your own, look for Internet VLAN, VLAN ID or 802.1Q tagging in the WAN or internet settings and enter the value from your provider. If the router lacks that option, it cannot replace the provider’s router on that service. See how to set up a new router and what is an ONT.
VLANs at Home: What They Are Good For
- Isolate smart-home and IoT devices. Cameras, plugs and TVs often run outdated software. On their own VLAN, a compromised gadget cannot reach your laptops and NAS.
- Separate guests. A guest VLAN with its own Wi-Fi network gives visitors internet but nothing else. Many routers do this without exposing the word VLAN; see guest Wi-Fi network.
- Separate work devices from the family network.
- Keep a home lab apart from everything else.
Isolation is only as good as the firewall rules between VLANs: by default, some routers route freely between them. Block traffic from the IoT and guest VLANs to your main network, and allow only what you need — for example, your phone reaching a camera. See how to secure your home network.
What You Need to Set Up VLANs
Full VLAN setups need equipment that understands 802.1Q end to end:
- A router or firewall that supports VLANs — it creates the VLAN interfaces, a DHCP range for each and the rules between them. Prosumer routers and firewall software (OPNsense, pfSense, OpenWrt, UniFi, MikroTik) support this; many consumer routers do not.
- Managed or “smart” switches if VLANs must run across more than one port or switch. An unmanaged switch passes everything through as one network; see Ethernet splitter vs switch.
- Access points that map Wi-Fi networks to VLANs, so that the IoT network and the main network go into different VLANs over the same cable.
Plan the VLAN numbers and IP ranges first, configure the router, then the switch ports (tagged toward the router and access points, untagged toward ordinary devices), and finally the Wi-Fi networks.
Simpler Alternatives
For most homes, a router’s guest network with “isolate from local network” enabled gives most of the benefit with no configuration: put smart devices and visitors on it, and keep your computers on the main network. Some mesh systems also offer a dedicated IoT network. Move to real VLANs when you want more than two groups, wired devices in each group, or precise rules between them.
Frequently asked questions
What is a VLAN in simple terms?
A way to split one physical network into several separate networks, so devices in one cannot reach devices in another unless the router allows it.
Do I need a VLAN at home?
Usually not. A guest network covers the common case of isolating visitors and smart devices. VLANs help when you need several separate groups or wired devices in them.
What is a VLAN ID?
The number from 1 to 4094 that identifies a VLAN in the 802.1Q tag. Providers sometimes require a specific VLAN ID on the router’s internet connection.
Does a VLAN make my network more secure?
It can, by limiting what each group of devices can reach — but only with firewall rules that block traffic between VLANs.
Can a normal switch handle VLANs?
An unmanaged switch cannot assign VLANs; it treats all ports as one network. You need a managed or smart switch.
Sources
- Inter-Switch Link and IEEE 802.1Q Frame Format — Cisco
- Настройка PPPoE Дом.ру Wave GPON — Dom.ru (in Russian)