SearchSuomeksi. Lue tämä sivu suomeksi
Menu
Independent publication. Nothing to sell.What to do if you shared information or already made a payment.

VLAN

VLAN stands for Virtual Local Area Network. It lets one switch, cable or wireless access point carry several logically separate local networks.

Choose this approach when you want to decide separately whether computers, smart devices and guests may start connections to one another's networks. If you only need an isolated Wi-Fi network, start with the simpler guest network.

Network design diagram

Router and firewall
Managed switch or access point
VLAN 10: trusted
VLAN 20: smart devices
VLAN 30: guests
  • AllowedAll three networks can be allowed to reach the internet.
  • CheckThe trusted network can be allowed to control the smart devices it needs.
  • BlockedNew connections from the smart-device and guest networks to the trusted network are blocked.
  • BlockedThe smart-device and guest networks cannot start connections to each other.
VLAN tags keep traffic separate inside shared equipment. The router and its firewall rules decide what may cross from one network to another.

How one connection carries several networks

A VLAN divides the same physical network equipment into separate logical local networks. Source Virtual means that each network does not need its own switch and its own cable along the whole path.

Each network has a number called a VLAN ID, such as 10, 20 or 30. A link between a router, managed switch and wireless access point can carry several tagged networks over one cable.

An ordinary computer, camera or bulb does not usually handle the tag itself. A switch port or Wi-Fi network name places the device in the right network, where it receives an IP address for that network.

How a VLAN relates to a guest network

A guest network is a router feature visible to the person setting it up. A VLAN is a way for network equipment to separate traffic inside shared cables, switches and access points.

One router can build a guest network with a separate IP network and firewall zone, without VLAN tags. Source In that case, all separation happens inside the same device.

A system with separate access points can attach guest Wi-Fi to a VLAN and carry it through a managed switch to the router. Source In either design, the firewall ultimately defines the rules between networks.

What a working VLAN design needs

The router or firewall must support VLAN interfaces and rules between them. Wired devices need a managed switch when one switch carries more than one network.

For several Wi-Fi networks, the access point must map each network name to the correct VLAN ID. Every device along that path must use matching IDs.

  1. Name the networks by purpose: trusted, smart devices and guests.
  2. Give each one a VLAN ID and a separate IP address range.
  3. Attach switch ports and Wi-Fi network names to the correct networks.
  4. Allow only the connections you need between networks and to the internet.
  5. Test from every network to see what works and what is blocked.

What can reach where

The example has three networks and six connection directions. Select a direction to see what changing that firewall rule does. The same information appears as text below the controls.

Trusted

Computers, phones and network storage.

IoT

Cameras, bulbs, plugs and televisions kept apart from personal computers.

Guest

Visitors' phones. Devices you do not control at all.

What each network can reach

Current connections

  • From the trusted network to the IoT network: allowed
  • From the trusted network to the guest network: blocked
  • From the IoT network to the trusted network: blocked
  • From the IoT network to the guest network: blocked
  • From the guest network to the trusted network: blocked
  • From the guest network to the IoT network: blocked

Changing these controls only changes the example. It does not connect to or change your network.

The concepts, by platform

OpenWrt
  1. Create a new network and give it a separate address range.
  2. Bind a wireless network to it under its own network name.
  3. Write a firewall rule that allows traffic out from the new network but not in.
UniFi
  1. Create a new network and give it its own identifier.
  2. Attach the network name to that network.
  3. Block traffic from the new network to the other internal networks.
OPNsense
  1. Create an interface for the new network and give it an address range.
  2. Turn on address assignment for that interface.
  3. Write rules that block access to the other internal networks.
MikroTik
  1. Create a network identifier and attach it to the bridge.
  2. Give the network its own address range and address assignment.
  3. Restrict traffic to the other internal networks in the firewall.

What this does not protect against

It does not stop a device sending data to the internet. Add outbound firewall rules if the device does not need unrestricted access.

It does not fix faults in the device. A device without updates is still a device without updates inside its own network.

It does not help if the rules point the wrong way. One permissive rule in the wrong direction defeats the whole separation, and no error message appears.

It does not protect devices from one another inside the same network unless you block those connections with client isolation or firewall rules.

Checked