VLANs and Network Segmentation

A large, flat network is a gift to attackers: once they are on it, they can see and reach almost everything. Segmentation is the practice of cutting a network into smaller zones with controlled doors between them. This lesson shows how switches do that with VLANs, why companies use them, and how the same idea will shape the structure of your own lab.

In the previous lesson you saw that ARP attacks and broadcasts only affect the machines in the same segment. The smaller the segment, the smaller the damage. That is the core argument for what follows.

Broadcast domains: who hears whom

A broadcast domain is the set of devices that receive each other's broadcasts, such as ARP requests or DHCP discoveries. On a basic switched network, all ports of the switch belong to one broadcast domain. If you plug in a hundred machines, they all hear each other's broadcasts, and they can all reach each other directly without a firewall in between.

This causes two problems. The first is performance: more machines means more broadcast noise. The second, more important for us, is security: reception staff, servers, printers, visitors' phones and connected cameras all share the same room.

What a VLAN is

A VLAN (Virtual Local Area Network) splits one physical switch into several logical switches. Each VLAN is a separate broadcast domain, identified by a number (the VLAN ID, from 1 to 4094). You assign ports to VLANs: ports 1 to 8 in VLAN 10, ports 9 to 16 in VLAN 20, and so on. Machines in VLAN 10 cannot reach machines in VLAN 20 at the link layer, as if they were on different physical switches, even though the equipment is shared.

Typical examples of a company's VLANs:

• VLAN 10: employees' workstations
• VLAN 20: servers
• VLAN 30: guests (Wi-Fi for visitors)
• VLAN 40: printers and connected objects
• VLAN 99: network management

Each VLAN normally gets its own IP subnet, for example 10.10.10.0/24 for VLAN 10 and 10.10.20.0/24 for VLAN 20. This is where the CIDR notation from lesson 1 becomes practical: segmentation is mostly a question of designing subnets sensibly.

Access ports and trunk ports

Switches use two kinds of ports:

• Access port: connects an end device, such as a PC or a printer. It belongs to exactly one VLAN, and the device does not even know about VLANs.
• Trunk port: connects switches to each other, or a switch to a router, and carries several VLANs at the same time. Frames on a trunk carry a small tag identifying their VLAN, according to the IEEE 802.1Q standard.

The tag is just a few extra bytes inserted in the Ethernet header, including the 12-bit VLAN ID. When the frame leaves a trunk towards an access port, the switch removes the tag. If you capture on a trunk with Wireshark, you will see the 802.1Q layer between Ethernet and IP.

Talking between VLANs: inter-VLAN routing

Machines in different VLANs are on different subnets, so by the logic of lesson 4 they need a router to communicate. This is the great benefit for security: the router or firewall placed between the VLANs can apply rules. For instance:

• Employees may reach servers on specific ports only (say, the web application on 443).
• Guests may reach the Internet but nothing internal.
• Connected objects cannot start connections towards employees.
• Only the management VLAN can reach the administration interfaces of the equipment.

The connection to a router can be a trunk, sometimes called "router on a stick": one physical link that carries all VLANs, with a virtual interface for each. Many modern switches can also perform the routing themselves, which is known as a layer 3 switch.

VLANs improve security, but they are not magic

A VLAN is an organisational and traffic-control tool, not an impenetrable wall. A few points that every defender should know:

• Misconfiguration is the main risk. A trunk port left open towards an end device, a default VLAN used for everything, or unused ports left active can undermine the design. Disable unused ports and move them to a dedicated, isolated VLAN.
• VLAN hopping is a family of techniques that exploit poorly configured switch ports (for example automatic trunk negotiation, or mismanaged native VLANs) to reach other VLANs. The defence is configuration hygiene: turn off automatic trunking on access ports and do not use the native VLAN for user traffic.
• The firewall rules between VLANs matter. If the router allows everything between VLANs, you have the broadcast benefits but none of the security benefits.
• VLANs do not replace encryption or authentication. They reduce exposure; they do not protect data in transit across a compromised segment.

Segmentation is also a major resilience measure. When ransomware, which you met in the first course, spreads inside a company, it travels from machine to machine through open network paths. A segmented network limits those paths, and that is why audits and regulations often ask for it.

Beyond VLANs: other forms of segmentation

VLANs are one tool among several:

• Physical separation: a completely separate network, as used for highly sensitive industrial systems.
• Firewalls and DMZs, as in lesson 4 of chapter 1.
• Microsegmentation: rules applied per workload in virtualised and cloud environments.
• Zero trust approaches: do not trust a device just because of the segment where it is located, authenticate and authorise every access.

For your own lab, the lesson is practical. You will create isolated virtual networks, and in an advanced version of the lab you will simulate a small company network: one segment for a "workstation", another for a "server", and a controlled path between them.

Your turn: design a segmented network on paper

Take a small company with 20 employees, a public website hosted on its premises, a file server with confidential documents, a guest Wi-Fi and three network printers. Design at least four VLANs, give each a name, a VLAN ID, and a subnet in the private range 10.20.0.0/16. Then write the rules that the router or firewall between the VLANs should apply, in the form "who may reach what, on which port".

See a solution

One possible answer: VLAN 10 "Employees" 10.20.10.0/24; VLAN 20 "Internal servers" 10.20.20.0/24 (file server); VLAN 30 "DMZ" 10.20.30.0/24 (public website); VLAN 40 "Guests" 10.20.40.0/24; VLAN 50 "Printers" 10.20.50.0/24. Reasonable rules: employees may reach the file server on its file-sharing port and printers on their printing port; the Internet may reach the DMZ on 80 and 443 only; the DMZ may not start connections to the employees or the internal servers; guests may only go out to the Internet, with no access to any internal VLAN; printers may not start connections to anything; everything not explicitly allowed is denied. Your numbers can differ: what matters is that every flow is deliberate (default deny) and that the public-facing machine is isolated from the confidential data.