A VLAN lets you separate guest, camera, server and staff devices on the same physical network. This article covers a sample plan, rules between VLANs and a step-by-step transition.
In a small office, computers, printers, cameras, the server and guests' phones often all sit on the same network. That arrangement makes setup easy, but it also means every device can reach every other device. A VLAN is the most common way to separate these groups of devices without running extra cables.
What is a VLAN?
A VLAN (virtual LAN, or virtual local area network) lets you split a single physical network into several logical networks. Two computers plugged into the same switch cannot see each other directly if they are on different VLANs, as if they were in separate buildings. Each VLAN has its own address range; traffic between VLANs cannot pass directly and has to go through a router.
Think of the floors in an office building: the building, stairs and lifts are shared, but each floor has its own door, and security at the entrance decides who may move between floors. With VLANs, that job is usually done by the firewall or by a switch capable of routing (a layer 3 switch).
Tags, access ports and trunk ports
The switch marks which VLAN each packet belongs to by adding a small tag to it, according to a standard called 802.1Q. VLAN numbers are chosen between 1 and 4094. A port connecting a device that belongs to a single network, such as a computer or printer, is set as an "access" port assigned to one VLAN; the device doesn't even know the tag exists. Links between switches, or between a switch and the firewall or an access point, are "trunk" ports that carry several VLANs, tagged.
Why does a small business need one?
The value of VLANs comes from the fact that not every device on the network deserves the same level of trust. Typical separations in a small office are:
- Guest network: Visitors' phones and laptops only reach the internet; they don't see the file server, printers or the accounting computer.
- Camera network: IP cameras often run for years without updates. When they sit on their own VLAN and can only talk to the recorder, a vulnerability in one camera doesn't open the door to the whole network.
- Server network: File, accounting or ERP servers are kept in their own segment, and staff only reach the services they need.
- Printers and other devices: Printers, meeting room displays and door access systems are grouped in their own segment.
- Management network: The management interfaces of switches, access points and the firewall can only be reached from this network, and only by authorised people.
Alongside security, you gain order. When each segment has its own address range, it becomes easier to guess what a device is just by looking at its IP address. Broadcast traffic (messages sent to every device on the network) also stays within its own VLAN, which reduces unnecessary traffic on a busy network.
A sample VLAN plan
The table below is a sample starting plan for an office of 20 to 50 people. The numbers and addresses are not mandatory; what matters is that the groups and their access needs are clear.
| VLAN | Use | Sample address range | What can it reach? |
|---|---|---|---|
| 10 | Staff | 10.10.10.0/24 | Internet, required services on the servers, printers |
| 20 | Servers | 10.10.20.0/24 | Update sources and the backup target |
| 30 | Printers and devices | 10.10.30.0/24 | File server for scanned documents, if needed |
| 40 | Cameras | 10.10.40.0/24 | The recorder only |
| 50 | Guests | 10.10.50.0/24 | Internet only |
| 99 | Management | 10.10.99.0/24 | Network device interfaces; only authorised admin computers connect |
Matching the VLAN number to the third part of the address (for example 10.10.40.x for VLAN 40) isn't required, but it makes the network easier to read. On the wireless side, each network name (SSID) is mapped to a VLAN: the "Office" network to the staff VLAN, the "Guest" network to the guest VLAN. If staff need to view camera footage, grant access to the recorder only, not to the whole camera network.
The real work: rules between VLANs
A common misconception is that creating VLANs provides protection on its own. Many routers and layer 3 switches route traffic between VLANs freely by default. Without rules, the networks look separate on paper, but devices can still reach each other.
A safer starting point is to block traffic between VLANs by default and open only what is needed: file sharing from staff to the file server, the relevant application port on the accounting server, printing ports to the printers, and so on. Rules should be narrow enough to specify source, destination and port. Don't allow connections initiated from the camera and guest networks towards the internal network.
Printers and screen-mirroring devices usually announce themselves on the network using broadcast and multicast messages. Because these messages don't cross VLAN boundaries, printers may stop appearing in the list on computers after separation. Adding the printer by its IP address, or, if your equipment supports it, enabling the feature that relays these announcements in a controlled way, usually solves the problem.
The infrastructure you need
- Managed switches: They must support 802.1Q; unmanaged switches don't understand VLAN tags.
- A routing and rule point: A firewall or layer 3 switch that can route traffic between VLANs and apply rules.
- Wireless access points: They must be able to map several network names to different VLANs.
- Address assignment: Each VLAN needs its own DHCP pool; the firewall can provide a separate one per VLAN, or requests can be forwarded to a central DHCP server (DHCP relay).
The "guest network" feature on home routers may be enough at first to separate guests in an office of a few people. Once needs such as separating cameras, servers and management arise, the infrastructure above is usually required.
Make the transition step by step
Splitting an existing flat network overnight can lead to surprises such as printers disappearing and applications failing to connect. A calmer approach looks like this:
- List the devices on the network; write down which group each one belongs to and what it needs to talk to.
- Separate the guest and camera networks first. Neither needs much communication with the internal network, and the gain is high.
- Next, set up the management network and move the management interfaces of network devices onto it.
- Finally, separate the servers, having first identified which services staff use and on which ports.
When changing the management VLAN, there is a risk of losing remote access to the device. Do this work at a time when you can physically reach the device, and back up the configuration beforehand. Not using VLAN 1, which comes as the default on most switches, for user or management traffic, and assigning unused ports to an empty VLAN and disabling them, are widely accepted good practices.
Checklist
- Have devices on the network been grouped, with what each group needs to reach written down?
- Can the guest network reach only the internet?
- Can cameras talk only to the recorder?
- Is traffic between VLANs blocked by default, with only what is needed opened?
- Can the management interfaces of network devices be reached only from the management network?
- Do the switches, firewall and access points support 802.1Q and multiple network names?
- Have unused ports been disabled and VLAN 1 removed from user traffic?
- Have printing, scanning and critical applications been tested after separation?