# VLAN

> A way to split one physical network into several separate ones, using software rules.

- Level: Advanced
- Topics: Networks
- URL: https://tidbit.legios.com.ar/vlan/
- In Spanish: [VLAN](https://tidbit.legios.com.ar/es/vlan/)

A **VLAN** (virtual LAN) lets one set of cables and switches behave like several independent networks. An office might plug everyone into the same switches, yet put staff laptops in one VLAN, guest Wi-Fi in another, and security cameras in a third. Devices in one VLAN see each other as if they shared a private network, and do not see the others at all.

It works by labeling traffic. Each switch port is assigned to a VLAN, and when frames travel between switches over a shared link (a **trunk**), each one carries a small tag with its VLAN number, defined by the standard **802.1Q**. The tag has room for roughly 4,000 different VLANs. A switch never delivers a frame to a port of a different VLAN, so broadcasts and casual snooping stay inside their group.

To go from one VLAN to another, traffic has to pass through a router or a firewall, and that is the point: it becomes a checkpoint where you can write rules like 'cameras may talk to the recording server and nothing else'. This is called **network segmentation**. It limits the damage when one device is compromised, keeps noisy traffic contained, and lets teams reorganize who belongs where without rewiring the building.

VLANs are a tool for separation, not a security guarantee on their own. A misconfigured trunk can let traffic leak between groups, so sensitive segments also get firewall rules and monitoring. In the cloud the same idea shows up as virtual networks and subnets, configured entirely in software.

## An analogy

One office floor divided with movable partitions into separate departments. The building and the hallways are shared, but each department has its own door, and to go from one to another you have to pass the reception desk.

## Keep in mind

- One physical network, several logical ones, separated by switch configuration.
- Frames between switches carry an 802.1Q tag with the VLAN number.
- Traffic between VLANs must cross a router or firewall, where rules apply.
- Useful for segmentation, but needs careful configuration to be a real barrier.

## Go deeper

- [VLAN on Wikipedia](https://en.wikipedia.org/wiki/VLAN)
- [IEEE 802.1Q on Wikipedia](https://en.wikipedia.org/wiki/IEEE_802.1Q)

## Related terms

- [Wi-Fi](https://tidbit.legios.com.ar/wi-fi/): Networking over radio waves: the internet without the cable, within a few rooms.
- [Port](https://tidbit.legios.com.ar/port/): The numbered door on a computer that says which program a connection is for.
- [Router](https://tidbit.legios.com.ar/router/): The box that connects your devices to each other and to the internet.
- [Firewall](https://tidbit.legios.com.ar/firewall/): A gatekeeper that decides which network traffic gets in or out.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Cloud computing](https://tidbit.legios.com.ar/cloud-computing/): Renting computers over the internet instead of buying your own.
- [Subnet](https://tidbit.legios.com.ar/subnet/): A slice of a network's IP addresses, grouped so its devices can talk directly.