Guide · VLANs in plain English
VLANs without the jargon: access ports, trunk ports, tagged vs untagged.
One switch, everything plugged into it, everything able to see everything else, that's how most small offices start, and it's fine until it isn't. VLANs are how you split that one switch into separate networks without buying separate switches.
Last reviewed: 21 July 2026
What a VLAN actually is
VLAN stands for Virtual LAN. A plain switch drops every device that plugs into it onto the same network, the guest on the WiFi, the office PCs, the VoIP phones, the security cameras, all in one pool, all able to talk to each other. Convenient, and completely insecure.
A VLAN lets you carve that one physical switch into several logical networks that behave as if they were separate switches that can't see each other. Same box, same cables, but guest WiFi lives in one VLAN, the office in another, the phones in a third, the cameras in a fourth, and by default, traffic in one can't reach another. You get the separation without buying four switches.
Picture an office building with one front door but locked internal floors. Everyone comes through the same entrance; not everyone can get to every floor.
Why you'd bother separating things
The point is containment and control:
- Guest WiFi should never touch the office. A visitor's laptop, or the malware on it, has no business seeing your file server or the accounts PC. Guests go in their own VLAN with internet only, nothing internal.
- Cameras and other set-and-forget gear are soft targets. Cheap IP cameras and IoT devices rarely get security updates. In their own VLAN, a compromised one can't be used as a doorway into the rest of the network.
- VoIP phones behave better on their own. Voice traffic is fussy about delay. A dedicated VLAN lets you prioritise it so a big download doesn't make calls choppy.
- Less noise, easier troubleshooting. Smaller broadcast domains mean less chatter, and problems that stay contained instead of taking down everything.
Done well, this kind of segmentation is the backbone of a tidy business network and Wi-Fi and a practical piece of everyday cyber security.
Access ports vs trunk ports, the bit people trip on
Once you've got VLANs, every switch port is doing one of two jobs.
Access port, carries ONE VLAN, untagged. This is the port a normal device plugs into: a PC, a printer, a camera, a phone. The device has no idea VLANs exist, it just sends plain Ethernet frames. The switch quietly drops that device into whichever single VLAN the port is assigned to. Plug a camera into a port set to the 'cameras' VLAN and it's on the camera network; the camera never knows or cares. Because the traffic carries no VLAN label, it's called untagged.
One access port = one VLAN = one dumb-and-happy device.
Trunk port, carries MANY VLANs, tagged. A trunk is the link between switches, or between a switch and a router, or a switch and a smart access point serving several WiFi networks. It has to carry several VLANs down one cable, so each frame gets a small label, a tag, saying which VLAN it belongs to. The switch at the other end reads the tag and keeps each VLAN's traffic separate. That tagging standard is 802.1Q, if you ever see the term.
One trunk port = many VLANs = every frame tagged so nothing gets mixed up.
Tagged vs untagged, one line each
- Untagged (access): 'This whole port is VLAN 20. Devices here don't know about VLANs.' For end devices.
- Tagged (trunk): 'This port carries VLANs 10, 20, 30, 40, each labelled.' For links between switches, access points and routers.
Getting these backwards is the classic mistake. Plug a PC into a trunk port and it won't work properly; connect two switches with an access port and only one VLAN crosses. End devices get access ports; the links between your network gear get trunks.
A simple office example
Say a small office wants four networks on one managed switch and one access point:
| VLAN | Purpose | Port type |
|---|---|---|
| 10 | Office PCs / server | Access ports at each desk |
| 20 | VoIP phones | Access ports (or phone with PC daisy-chained) |
| 30 | Guest WiFi | Delivered by the access point |
| 40 | Cameras | Access ports in the ceiling / comms room |
The desks, phones and cameras all sit on access ports, each locked to its one VLAN. The cable to the access point (which broadcasts both office and guest WiFi) and the cable up to the router are trunks, carrying all the tagged VLANs. The router then decides what's allowed to talk to what, typically guest and cameras get internet only, office gets everything, and nothing reaches the cameras from outside.
One requirement: you need a managed (or 'smart') switch for any of this. An unmanaged switch can't do VLANs.
The short version: A VLAN splits one physical switch into separate logical networks that can't see each other, so guest WiFi, phones, cameras and the office each stay in their own lane. An access port carries one VLAN untagged for a single device that knows nothing about VLANs; a trunk port carries several tagged VLANs between switches, access points and routers. End devices get access ports, the links between gear get trunks, and mixing those up is why it won't work.
This is a plain-English overview. The exact VLAN and port setup depends on your hardware, so check your switch's documentation or ask your IT support before changing anything.