Definition
A VLAN (Virtual Local Area Network) is a logically separate network created on top of shared physical switching hardware. It lets you split one physical switch (or many interconnected switches) into multiple isolated broadcast domains, so devices on different VLANs cannot reach each other at Layer 2 even though they share the same cabling. The standard that makes this possible is IEEE 802.1Q, which inserts a 4-byte tag into the Ethernet frame header identifying which VLAN the frame belongs to.
Tags, access ports, and trunks
The 802.1Q tag carries a VLAN ID (VID) plus priority bits, and it sits in the frame immediately after the source and destination MAC addresses. Switch ports are configured in one of two roles. An access port belongs to a single VLAN and carries untagged frames to an end device. A trunk port carries traffic for many VLANs at once over a single link between switches, using the tag to keep each VLAN's frames distinct. This is how segmentation scales across an entire network without running separate cables per segment.
Why it matters for self-hosting
VLANs are the practical tool for network isolation in a home lab or small rack. You can place miners and IoT gear on one VLAN, trusted workstations on another, and public-facing servers in a perimeter VLAN, each typically mapped to its own subnet. Combined with a firewall controlling traffic between segments, VLANs let a sovereign operator build a clean, defensible network, including a properly isolated DMZ, on modest hardware.
In Simple Terms
A VLAN (Virtual Local Area Network) is a logically separate network created on top of shared physical switching hardware. It lets you split one physical…