107 Digital Life Security #11: VLANs in the Real World — Following a Packet Through a Segmented Network

Digital Life Security Series ...Practical ways to protect your devices, accounts, privacy, information and home

In the previous topic, we divided one large network into several smaller networks.

We created places for:

• Trusted computers
• Guests
• IoT devices
• Security cameras
• Network management

We learned that VLANs can create those logical networks even when they share some of the same physical switches and Ethernet cables.

But that raises a very reasonable question.

How does the network actually know which traffic belongs to which VLAN?

Let's follow a packet and find out.

First, Let's Build a Small Network

Imagine a property with a router/firewall and a managed Ethernet switch.

We have created three logical networks:

VLAN 10 — Trusted

192.168.10.0/24

VLAN 20 — Cameras

192.168.20.0/24

VLAN 30 — Guest

192.168.30.0/24

The particular numbers are not important.

They simply give us something concrete to work with.

What Does /24 Mean?

We have just introduced another piece of networking notation:

/24

This is called CIDR notation.

CIDR stands for Classless Inter-Domain Routing.

For our purposes, the important point is that the /24 tells us which portion of an IPv4 address identifies the network.

For a typical /24 network, addresses might look like:

192.168.10.1

192.168.10.25

192.168.10.100

Those addresses belong to the same 192.168.10.0/24 network.

But:

192.168.20.25

belongs to a different network in our example.

VLANs and Subnets Often Work Together

In a typical segmented network, each VLAN is associated with its own IP subnet.

For example:

VLAN 10 → 192.168.10.0/24

VLAN 20 → 192.168.20.0/24

VLAN 30 → 192.168.30.0/24

This makes the logical structure easy to understand.

Trusted devices live in one IP network.

Cameras live in another.

Guests live in another.

Now routing and firewall policies can control communication between them.

Our Laptop Connects

Let's connect a laptop to switch port 1.

We configure port 1 as an access port belonging to VLAN 10.

The laptop receives:

192.168.10.25

Its default gateway might be:

192.168.10.1

The laptop knows its IP address.

It knows its subnet.

It knows its default gateway.

But here is the interesting part:

The laptop may know absolutely nothing about VLAN 10.

The Switch Knows

The laptop sends an ordinary Ethernet frame into switch port 1.

Because port 1 has been configured as an access port for VLAN 10, the switch associates traffic arriving on that port with VLAN 10.

The endpoint does not necessarily need to add a VLAN tag.

The network infrastructure handles the VLAN membership.

This is one reason VLANs can be used with ordinary computers, printers, cameras, and other devices without those devices needing special VLAN configuration.

Untagged Traffic

Traffic from an ordinary endpoint connected to an access port commonly arrives at the switch untagged.

There is no VLAN identifier added by the endpoint.

The switch already knows:

Traffic arriving on this access port belongs to VLAN 10.

The port configuration provides the context.

Now the Traffic Needs to Cross a Shared Link

Suppose our managed switch connects to the router/firewall with one Ethernet cable.

But that single cable needs to carry traffic for:

VLAN 10.

VLAN 20.

VLAN 30.

How can the equipment tell those networks apart?

We need a way to label the traffic.

Meet IEEE 802.1Q

Ethernet VLAN tagging is commonly performed using a standard known as IEEE 802.1Q.

802.1Q allows VLAN information to be inserted into an Ethernet frame.

That information includes a VLAN identifier.

Now the receiving network equipment can determine which logical network the frame belongs to.

Conceptually:

Ethernet frame + VLAN 10 tag

or:

Ethernet frame + VLAN 20 tag

The traffic can travel over the same physical Ethernet connection while remaining logically distinguishable.

This Is Tagged Traffic

When VLAN information is carried with the Ethernet frame, we commonly describe the traffic as tagged.

So now we have two useful concepts:

Untagged traffic — commonly seen between an ordinary endpoint and an access port.

Tagged traffic — commonly used when multiple VLANs need to travel across the same physical link.

The Trunk Carries Multiple VLANs

The connection between the managed switch and router/firewall may be configured as a trunk.

The trunk can carry traffic for multiple VLANs.

Our physical network might look like:

Laptop
↓
Access Port — VLAN 10
↓
Managed Switch
↓
802.1Q Trunk — VLANs 10, 20, 30
↓
Router / Firewall

One cable.

Three logical networks.

Now Let's Follow the Laptop to the Internet

The laptop at:

192.168.10.25

wants to visit a website on the Internet.

The destination is not part of its local 192.168.10.0/24 network.

Therefore, the laptop sends the traffic toward its default gateway:

192.168.10.1

The Ethernet frame enters the switch through the VLAN 10 access port.

The switch knows the frame belongs to VLAN 10.

When that traffic crosses the trunk toward the router/firewall, the VLAN information identifies it as VLAN 10 traffic.

The Router Receives VLAN 10 Traffic

The router/firewall has a logical interface associated with VLAN 10.

That interface might have the address:

192.168.10.1

This is the laptop's default gateway.

The router examines the destination.

The traffic is headed toward the Internet.

The firewall applies its policy.

If the connection is allowed, the router sends the traffic toward the WAN and the Internet.

Returning traffic is recognized by the stateful firewall and routed back toward the laptop.

Now the Laptop Wants to View a Camera

This is where things get more interesting.

The laptop is:

192.168.10.25

on VLAN 10.

The camera is:

192.168.20.50

on VLAN 20.

The laptop can immediately tell that the camera is not on its local subnet.

So it sends the traffic toward its default gateway.

Again:

If the destination isn't on my local network, send it to the router.

The Switch Does Not Simply Move It Into VLAN 20

This is important.

A normal Layer 2 switch does not simply take traffic from VLAN 10 and quietly deliver it into VLAN 20.

The VLAN boundary exists for a reason.

Communication between different IP networks requires routing.

So the traffic goes to the router or Layer 3 device capable of routing between those networks.

This Is Inter-VLAN Routing

Communication routed between VLANs is commonly called inter-VLAN routing.

The router knows about both networks:

192.168.10.0/24

and:

192.168.20.0/24

Technically, it knows how to route between them.

But that does not necessarily mean it should.

Before forwarding the traffic, the firewall gets to make a decision.

The Firewall Controls the Door

Remember our analogy:

VLANs create the rooms.

Firewall rules control the doors.

Our policy might say:

Trusted VLAN 10 → Camera VLAN 20: Allow approved camera-management traffic.

So the firewall permits the connection.

The router routes the traffic into VLAN 20.

The traffic crosses the trunk again, now associated with VLAN 20.

The switch receives it and forwards it toward the camera's access port.

Before delivering it to an ordinary camera on an access port, the switch presents it as normal endpoint Ethernet traffic.

The camera receives the communication.

The Camera Replies

The camera sends its response.

The response enters the switch on a VLAN 20 access port.

The switch associates it with VLAN 20.

Because the destination laptop is on another subnet, the communication goes toward the camera network's gateway.

The router/firewall recognizes the response as belonging to the connection initiated by the trusted laptop.

The stateful firewall permits the response.

The router sends it into VLAN 10.

The switch delivers it to the laptop.

We have now followed traffic between two VLANs.

Now Reverse the Situation

Suppose the camera suddenly decides to initiate a new connection toward the laptop.

The traffic reaches the firewall.

Our policy might say:

Camera VLAN 20 → Trusted VLAN 10: Deny new connections.

The firewall blocks it.

This does not contradict the earlier communication.

The laptop was allowed to initiate a connection to the camera, and the stateful firewall allowed the camera's replies.

But the camera is not permitted to initiate unrelated connections toward trusted computers.

Direction matters.

This Is Least Privilege in Network Form

The camera receives the access it needs.

It does not receive access it does not need.

That is least privilege applied to network communication.

The same principle we used for phone application permissions is now controlling packets between networks.

This is why learning security concepts is more valuable than memorizing product settings.

The technology changes.

The principles keep returning.

What If a Guest Tries to Reach the Camera?

Our guest device is on:

VLAN 30

Perhaps its address is:

192.168.30.75

The guest tries to reach:

192.168.20.50

The traffic reaches the router/firewall because the camera is on another network.

The firewall policy says:

Guest VLAN 30 → Camera VLAN 20: Deny.

The connection stops there.

The physical network exists.

The router knows how to reach both networks.

But policy says the communication is not permitted.

Routing Capability Is Not Permission

This distinction is fundamental.

A router may know how to reach a destination.

That does not mean the firewall should allow the communication.

Routing answers: Where does this traffic go?

Firewall policy answers: Should this traffic be allowed to go there?

Two different questions.

Now We Add Another Switch

Suppose the property has another building connected by Cat 6.

There is a managed switch in the main building and another managed switch in the remote building.

We want both buildings to support:

• Trusted devices
• Cameras
• Perhaps IoT devices

Do we need three Ethernet cables between the buildings?

Not necessarily.

A trunk between the managed switches can carry multiple VLANs over one physical Ethernet connection.

The Remote Switch Separates Them Again

The link between the buildings might carry:

VLAN 10 — Trusted

VLAN 20 — Cameras

VLAN 40 — IoT

At the remote switch:

Port 1 might be assigned to VLAN 10.

Port 2 might be assigned to VLAN 20.

Port 3 might be assigned to VLAN 20.

Port 4 might be assigned to VLAN 40.

The endpoint devices simply see their own networks.

The trunk quietly carries the logical separation between switches.

This Is Why Infrastructure Planning Matters

A physical Ethernet run between two locations can become much more valuable when the networking equipment at each end supports the architecture you want to build.

The cable does not have to be dedicated forever to one specific type of device.

It can become infrastructure carrying multiple logical services.

That flexibility is one of the reasons structured cabling is so useful.

But There Is an Important Distance Limit

Standard copper Ethernet over twisted-pair cabling has practical distance limitations.

A commonly used maximum channel length for Ethernet over balanced copper cabling is approximately 100 meters, or about 328 feet, including the overall channel.

For longer building-to-building connections, fiber can become particularly attractive.

Fiber also has another useful characteristic for connections between separate buildings:

It does not create an electrical copper connection between the buildings.

That can be valuable when considering differences in electrical potential and electrical disturbances between structures.

Physical network design and electrical design can intersect.

What About the Wi-Fi Access Point?

Now imagine an access point connected to a managed switch.

The access point provides three Wi-Fi networks:

Private Wi-Fi

Guest Wi-Fi

IoT Wi-Fi

The access point can associate each wireless network with a different VLAN.

Its Ethernet connection to the switch may therefore carry traffic for multiple VLANs.

That connection can function much like a trunk.

The Wi-Fi Name Can Lead to a VLAN

A device joins:

Private Wi-Fi

The access point associates that traffic with VLAN 10.

Another device joins:

Guest Wi-Fi

The access point associates that traffic with VLAN 30.

Both devices use the same physical access point.

But logically, they live on different networks.

This is an excellent example of physical infrastructure supporting multiple security zones.

Where Does DHCP Fit?

Each VLAN usually needs appropriate IP configuration.

Our trusted device needs an address from:

192.168.10.0/24

The camera needs an address from:

192.168.20.0/24

The guest needs an address from:

192.168.30.0/24

DHCP can provide those addresses.

The network infrastructure ensures that a device's DHCP request reaches the DHCP service appropriate for its network design.

So VLAN membership can influence which IP configuration a device receives.

Each Network Gets Its Own Gateway

Our router/firewall might have logical interfaces such as:

VLAN 10: 192.168.10.1

VLAN 20: 192.168.20.1

VLAN 30: 192.168.30.1

Each address serves as the gateway for devices on that subnet.

The router is therefore standing at the doorway of each network.

That makes it an ideal place to enforce communication policy.

The Router Can See the Boundaries

This is the key architectural idea.

If traffic needs to move from one subnet to another, it crosses a routing boundary.

That gives us an opportunity to inspect and control it.

Instead of allowing every device to communicate freely at the local switching layer, we deliberately create boundaries where security policy can be applied.

Good network architecture creates useful control points.

What Is a Native VLAN?

You may encounter the term native VLAN when configuring 802.1Q trunks.

On some configurations, one VLAN on a trunk may be associated with untagged traffic.

The exact behavior depends on the equipment and configuration.

The important lesson for now is not to memorize a particular vendor's settings.

It is to recognize that a trunk can contain both tagged traffic and, depending on configuration, potentially untagged traffic associated with a designated VLAN.

This is an area where configuration mistakes can matter.

VLAN Configuration Must Match

Suppose one end of a connection believes traffic belongs to VLAN 20 while the other end expects something different.

Problems follow.

Devices may become unreachable.

Traffic may appear in the wrong place.

Or the intended security separation may not work as expected.

This is why VLAN configuration should be deliberate and documented.

Do Not Allow Every VLAN Everywhere

A trunk does not necessarily need to carry every VLAN in the organization.

If a remote switch only needs VLANs 10 and 20, there may be no reason to carry unrelated VLANs to that location.

This is another application of least privilege.

Carry what is needed.

Allow what is needed.

Do not automatically enable everything everywhere.

VLANs Are Useful, but They Are Not Magic

It is important not to turn VLANs into a security buzzword.

A poorly configured segmented network can still be insecure.

A VLAN does not replace:

• Strong passwords
• Secure authentication
• Firmware updates
• Firewall rules
• Device hardening
• Monitoring
• Backups
• Physical security

VLANs give us useful logical boundaries.

We still have to secure what happens on both sides of those boundaries.

Let's Follow the Whole Journey

Our trusted laptop wants to view a camera.

Here is the complete simplified journey:

1. Laptop sends ordinary Ethernet traffic.

2. Traffic enters a switch access port assigned to VLAN 10.

3. The switch associates the traffic with VLAN 10.

4. Traffic crosses a trunk carrying VLAN information.

5. Router/firewall receives the VLAN 10 traffic.

6. Router sees that the destination is on the VLAN 20 subnet.

7. Firewall checks whether VLAN 10 is permitted to initiate the requested communication toward VLAN 20.

8. If allowed, the router routes the traffic into VLAN 20.

9. Traffic crosses the trunk associated with VLAN 20.

10. Switch forwards the traffic to the camera's VLAN 20 access port.

11. Camera receives ordinary Ethernet traffic.

12. Camera replies.

13. Stateful firewall recognizes the response.

14. Response is routed back into VLAN 10.

15. Laptop receives the response.

All of that can happen extremely quickly.

And the Cat 6 Cable Just Carries the Bits

This may be the most interesting part.

The cable does not know:

This is a camera.

This is a laptop.

This is trusted traffic.

This is guest traffic.

This packet is going to the Internet.

The cable simply provides the physical medium.

The intelligence comes from the devices and configuration at the ends.

Switches.

Routers.

Firewalls.

Access points.

Servers.

And the policies created by the network administrator.

The Physical Layer and the Logical Layer

This gives us a useful way to think about networking.

Physical layer:

Cables, fiber, connectors, switch ports, radio signals.

Logical architecture:

VLANs, IP addresses, subnets, routing, firewall rules, access policies.

You can have excellent physical infrastructure and poor logical design.

Or excellent logical plans running over inadequate physical infrastructure.

A good network needs both.

Now You Can Follow the Packet

This is an important milestone.

When you look at a managed switch, a router, or a firewall configuration, the terminology should begin to tell a story.

Access port — where an endpoint enters a particular VLAN.

VLAN — a logical Layer 2 network.

802.1Q — a common method for carrying VLAN information in Ethernet frames.

Trunk — a link that can carry multiple VLANs.

Subnet — the IP network associated with a group of addresses.

Gateway — the router used to reach other networks.

Inter-VLAN routing — routing traffic between VLANs.

Firewall rule — the policy determining whether that communication should be allowed.

These are no longer isolated networking terms.

They describe the journey.

And Security Lives Along the Journey

We can now ask much better questions.

Which VLAN is this device on?

Which subnet does it use?

Where is its gateway?

Which VLANs travel across this trunk?

Can this device initiate connections to another network?

Which firewall rule permits that?

Does it actually need that access?

What happens if this device becomes compromised?

Can it move anywhere else?

Those are the questions of someone beginning to understand network security.

Once you can follow the packet, you can begin to understand where to protect it.