VLAN Basics for a Small Office (802.1Q Guide)
Virtual Local Area Networks (VLANs) allow a single physical router, managed switch, and ceiling access point to host multiple completely isolated networks without running separate cabling. By inserting a 4-byte IEEE 802.1Q header into Ethernet frames, your infrastructure cleanly separates corporate workstations, VoIP phones, IoT cameras, and guest WiFi.
- Access Ports (Untagged + PVID) connect to single-VLAN end devices like PCs, printers, and NVR cameras.
- Trunk Ports (Tagged 802.1Q) carry multiple VLANs simultaneously over a single uplink cable between routers, switches, and multi-SSID access points.
- Every VLAN requires its own Layer 3 subnet, gateway interface (SVI/sub-interface), and DHCP pool on your VLAN-aware router.
- Use stateful Established/Related firewall rules so Staff (VLAN 10) can print to IoT (VLAN 20) while IoT cannot initiate connections back.
How IEEE 802.1Q Frame Tagging Works at Layer 2
On an unmanaged switch, every port belongs to one giant broadcast domain—meaning an ARP broadcast or ransomware SMB scan from a guest laptop reaches every single port on the switch. A Managed Switch solves this using the IEEE 802.1Q standard, which inserts a 32-bit (4-byte) tag into the Layer 2 Ethernet frame header right after the Source MAC address. Twelve bits of that tag form the VLAN ID (VID), supporting VLAN numbers from 1 to 4094.
Frames tagged with VID 10 and frames tagged with VID 20 can travel down the exact same physical Cat6 cable between two switches without ever mixing at Layer 2. Only a Layer 3 router (sometimes called a "Router-on-a-Stick") or a Layer 3 switch can route packets between VLAN 10 and VLAN 20, giving your firewall complete inspection control over inter-department traffic.
Access Ports (Untagged/PVID) vs. Trunk Ports (Tagged) Explained
The #1 stumbling block when configuring managed switches (from Cisco, Netgear, TP-Link Omada, MikroTik, or Ubiquiti) is mixing up Untagged, Tagged, and PVID (Port VLAN ID) settings. Every switch port plays one of two roles:
- Access Port (End Devices): Connects to a VLAN-unaware endpoint like a desktop PC, printer, or security camera. The port is set to Untagged for a single VLAN (e.g., VLAN 20) with its PVID set to 20. When the camera sends an ordinary untagged frame into the port, the switch stamps it internally with
VID 20; when exiting the port to the camera, the switch strips the tag off. - Trunk Port (Switch Uplinks & APs): Connects your router to your switch, switch to switch, or switch to a multi-SSID WiFi access point. The port carries one Native/Untagged VLAN (usually Management VLAN 1) plus multiple Tagged VLANs (
10T, 20T, 30T) so the AP can map each WiFi SSID to its respective VLAN tag.
Configuring Router Sub-Interfaces & Per-VLAN DHCP Servers
Creating VLAN IDs on a managed switch only isolates Layer 2 traffic; for devices on VLAN 10, 20, and 30 to reach the internet, your router must also be VLAN-aware. Consumer routers do not understand 802.1Q tags on their LAN ports and will simply drop tagged frames. Using a business router (such as UniFi, pfSense/OPNsense, MikroTik, or Omada ER605), configure a virtual sub-interface for each VLAN on the trunk port feeding your switch:
- VLAN 10 Interface (
eth1.10): Gateway IP10.10.10.1/24, DHCP Server.100–.249, DNS10.10.10.1. - VLAN 20 Interface (
eth1.20): Gateway IP10.10.20.1/24, DHCP Server.100–.249, DNS1.1.1.1. - VLAN 30 Interface (
eth1.30): Gateway IP10.10.30.1/24, DHCP Server.100–.249, DNS1.1.1.3(malware/family filtered).
Enable an mDNS reflector service on the router only across specific trusted VLANs if staff laptops need to discover AirPrint printers across subnet boundaries.
Writing One-Way Stateful Inter-VLAN Firewall Rules
Most routers automatically route between all local sub-interfaces the moment you create them—meaning VLAN 20 (IoT/Printers) can still reach VLAN 10 (Staff) until you add explicit firewall rules! However, if you place a blanket block between VLAN 10 and VLAN 20, employee laptops on VLAN 10 won't be able to print to the office multifunction printer on VLAN 20.
The solution is a stateful one-way firewall policy evaluated top-to-bottom on your router's internal forward/LAN-In chain:
- Rule 1 (Allow Return Traffic):
ACCEPTall packets with connection state Established or Related from any VLAN to any VLAN. - Rule 2 (Allow Staff to Printer):
ACCEPTNew connections fromVLAN 10 (Staff)toVLAN 20 (IoT). - Rule 3 (Block IoT & Guest to RFC 1918):
DROPall New connections fromVLAN 20andVLAN 30destined for private RFC 1918 subnets (10.0.0.0/8,172.16.0.0/12,192.168.0.0/16).
Managed Switch Port Tagging Matrix (8-Port Small Office Example)
| Switch Port | Connected Device | Port Mode | Untagged (Native / PVID) & Tagged VLANs |
|---|---|---|---|
| Port 1 (Uplink) | VLAN-Aware Firewall / Router | 802.1Q Trunk | Untagged: VLAN 1 (PVID 1) | Tagged: 10T, 20T, 30T |
| Port 2 (PoE+) | Ceiling Multi-SSID WiFi AP | 802.1Q Trunk | Untagged: VLAN 1 (PVID 1) | Tagged: 10T, 20T, 30T |
| Ports 3–5 | Employee Desktops & NAS | Access Port | Untagged: VLAN 10 (PVID 10) | Tagged: None |
| Port 6 | Office Network Laser Printer | Access Port | Untagged: VLAN 20 (PVID 20) | Tagged: None |
| Port 7 (PoE) | Security NVR & IP Camera | Access Port | Untagged: VLAN 20 (PVID 20) | Tagged: None |
| Port 8 | Lobby Kiosk / Visitor Jack | Access Port | Untagged: VLAN 30 (PVID 30) | Tagged: None |
802.1Q VLAN Implementation & Testing Checklist
- Verify every switch in the wiring path between the router and access points is an 802.1Q-capable managed switch.
- Always update the PVID to match the Untagged VLAN ID whenever configuring an Access Port on Netgear/TP-Link switches.
- Confirm the router-to-switch trunk port carries identical Tagged VLAN IDs (10T, 20T, 30T) on both ends of the cable.
- Test an Access Port on each VLAN to confirm the connected laptop receives an IP from the matching DHCP subnet.
- Place an 'Allow Established/Related' rule above your 'Drop Inter-VLAN' firewall rules for one-way printer/IoT access.
- Disable unused wall switch ports or assign them to a blackhole/Guest VLAN (VLAN 30) with port security enabled.
Frequently Asked Questions
What happens if I plug an unmanaged switch into a Trunk port carrying multiple tagged VLANs?
Never plug an unmanaged switch into a multi-VLAN trunk port. Unmanaged switches vary wildly in how they treat 4-byte 802.1Q tags—some strip the tags, some drop oversized 1522-byte tagged frames, and others broadcast tagged frames to every port without filtering, breaking isolation.
Why does my device get no IP address after I set a switch port to Untagged VLAN 10?
On many web-managed switches (such as Netgear ProSAFE and standalone TP-Link JetStream), setting a port to 'Untagged VLAN 10' only controls outbound frames; you must also go to the PVID Configuration tab and change that port's PVID from 1 to 10 so inbound untagged frames enter VLAN 10.
How do VoIP desk phones share a single wall Ethernet cable with a desktop PC on two different VLANs?
Enterprise VoIP phones contain an internal 2-port mini-switch. You configure the wall switch port with Untagged VLAN 10 (Data PVID 10) for the PC and Tagged VLAN 40 (Voice VLAN via LLDP-MED). The phone tags its own voice packets as VLAN 40 while passing the PC's traffic through untagged on VLAN 10.
Related Wired LAN Setup & Engineering Guides
- Subnet Mask Beginner Guide (CIDR /24, /23 & /16) — Understand IPv4 subnet masks, CIDR notation (/24, /23, /16, /30), binary bitmasking, usable host formulas, and RFC 1918 private IP ranges for home and office.
- MikroTik Basic Setup for Beginners (RouterOS v7) — Configure MikroTik RouterOS v7 routers from scratch using WinBox or WebFig at 192.168.88.1, verify defconf firewall rules, enable FastTrack, and secure admin.
- Guest WiFi Setup Guide for Homes and Offices — Set up a secure Guest WiFi network for homes and small offices: enable AP client isolation, block intranet LAN access, cap bandwidth, and isolate IoT devices.
- Best Ethernet Switch for a Small Office (2026 Picks) — Compare the 5 best Ethernet switches for small offices: Netgear GS308E, TP-Link TL-SG108PE, Ubiquiti UniFi Lite 16 PoE, TRENDnet 2.5G, and Cisco CBS250.