VLANs for Small Business: How to Segment Your Network Without Making It Complicated

A VLAN, or virtual local area network, splits one physical network into separate logical networks, so devices in one group cannot talk directly to devices in another. Most small businesses need four to six: staff computers, phones, guests, cameras and smart devices, payment terminals if they take cards, and a management network for the equipment itself. Traffic between them passes through the firewall, where you decide what is allowed. Done this way, a compromised camera or a guest's infected laptop stays in its own corner instead of reaching the accounting PC.

Most small offices start with a flat network: one router, one Wi-Fi password, everything able to see everything. It works, right up until a guest's laptop spreads malware, a cheap camera turns out to have a known vulnerability, or the phones crackle every time someone backs up to the cloud. Segmentation fixes all three, and with managed switches and access points it costs very little in extra hardware.

How VLANs work, in plain terms

Each VLAN has a number, from 1 to 4094. A managed switch keeps traffic on one VLAN separate from every other, even though it all travels through the same box and often the same cables. The standard that makes this work is IEEE 802.1Q, which adds a small tag to each frame naming the VLAN it belongs to.

Access ports and trunk ports

• An access port belongs to one VLAN. Plug a computer into it and the computer is on that VLAN without knowing anything about tags. Most desk and camera ports are access ports.
• A trunk port carries several VLANs at once, with tags. The links between switches, from a switch to the firewall, and from a switch to each Wi-Fi access point are usually trunks.
• Voice VLANs are a special case. Many desk phones have a computer port on the back, so one cable serves both. The switch port carries the phone's traffic tagged on the voice VLAN and the computer's untagged on the data VLAN. Phones often learn which VLAN to use automatically from the switch.

Wi-Fi networks map to VLANs

Each Wi-Fi network name (SSID) is tied to a VLAN. The staff SSID drops devices on the staff VLAN, the guest SSID on the guest VLAN. That way the same access point serves both while keeping them apart. Our guide to guest Wi-Fi security covers the guest side in detail.

The firewall is where the rules live

A VLAN on its own only separates traffic. Devices on different VLANs can talk only if something routes between them, usually the firewall, and the firewall's rules decide which conversations are allowed. Segmentation is only as good as those rules: a firewall that routes between every VLAN with an allow-everything rule has given you separate networks in name only. See our small business firewall guide for choosing and setting up the firewall itself.

A sample VLAN plan

Illustration only: the VLAN numbers and address ranges are examples. Any consistent scheme works.

Matching the VLAN number to the third part of the address, as above, makes it easy to tell at a glance which segment a device is on. Each VLAN gets its own address range and its own DHCP scope, usually served by the firewall.

What each segment is for

Staff

Company laptops and desktops. In a larger office you might split this again, for example putting finance or HR on their own VLAN so a problem on a general staff machine does not reach payroll data.

Voice

Desk phones on their own VLAN are easier to prioritize with quality of service, easier to troubleshoot, and protected from whatever else is happening on the staff network. If your calls break up, our guide to VoIP call quality troubleshooting shows how to find the cause.

Guests

Internet only, no route to anything internal, client isolation turned on, and a bandwidth limit so one streaming guest does not slow the business.

Cameras and smart devices

Cameras, smart TVs, thermostats, door controllers and similar devices are often the least patched things on the network. Give them their own VLAN, let them reach only what they need, and do not let them start conversations with staff machines.

Payment terminals

If you take cards, keeping terminals on their own segment narrows the part of your network that card security rules apply to. We cover this in PCI DSS network requirements.

Management

The admin pages of your switches, access points, firewall and UPS should not be reachable from the guest network or from every staff laptop. Put them on a management VLAN that only IT can reach.

Things that break, and how to handle them

• Printing and screen casting. Many printers and casting devices are found through discovery protocols that do not cross VLANs. Either put shared printers where the staff VLAN can reach them and allow just the printing ports, or use the firewall's or access point's discovery relay feature if it has one.
• The phone system. If phones need to reach an on-site server or a paging device, allow exactly that traffic and nothing else.
• Camera viewing. Staff who view cameras need a rule from the staff VLAN to the recorder, not to every camera.
• Remote access. VPN users should land on a segment with the access they need, not on the management network.

Write each exception down when you make it. A year later, a short list of allowed connections is what lets someone else understand the network.

Common mistakes

• Leaving everything on VLAN 1. VLAN 1 is the default on most switches. Use other numbers for your real segments so a new device plugged into an unconfigured port does not land on the staff network.
• Allow-all rules between VLANs. The most common way segmentation fails in practice.
• Unused ports left live. Disable them, or put them on an empty VLAN, so a cable plugged into a spare jack in the lobby reaches nothing.
• Unmanaged switches in the middle. A cheap desktop switch under a desk can strip or mishandle tags and blur the segments. Our guide to managed vs unmanaged switches explains where each belongs.
• No diagram. If nobody can say which ports are on which VLAN, nobody can fix it at 8am on a Monday.

What segmentation does and does not protect against

Segmentation limits how far a problem can spread inside your building. It does not stop a phishing email, patch a vulnerable device or back up your files. It is one layer among several; our guide to ransomware and your network covers how it fits alongside backups, patching and access controls.

A worked example

Hypothetical: the practice and its devices are invented to show the method.

A dental practice with 14 staff runs everything on one flat network: front desk computers, the imaging workstation, eight desk phones, six cameras, a smart TV in the waiting room, two card terminals and a guest Wi-Fi network that is really the staff network with a different password.

The new design uses six VLANs on the practice's existing managed switch and access points, plus a firewall that can route between them:

• Staff and imaging computers on the staff VLAN, with the imaging workstation allowed to reach the image storage and nothing on the guest or camera side.
• Desk phones on the voice VLAN, plugged in with the front desk computers behind them on one cable each.
• Waiting room guests and the smart TV on the guest VLAN, internet only.
• Cameras on their own VLAN, reaching only the recorder, with one rule letting the office manager's PC view it.
• Card terminals on their own VLAN, reaching only the payment processor.
• Switch, access point and firewall admin pages on the management VLAN.

The work is mostly configuration: an afternoon of changes after hours, then a morning of testing printing, phones, imaging and card payments before patients arrive. Health data rules do not prescribe this exact layout, but separating the systems that hold patient information from guests and smart devices is the kind of safeguard those rules expect a practice to think about. This is general information, not legal advice.

Questions to ask your provider or IT partner

• Do our switches and access points support VLANs, and can the firewall route and filter between them?
• Which segments do you recommend for our business, and why?
• What traffic will be allowed between each pair of segments?
• How will printing, casting and camera viewing work after the change?
• Will we get a diagram showing each port, SSID and VLAN?
• Who keeps the rules up to date when we add devices?

Getting it designed

Our managed network service designs segmented networks for staff, guests, payment terminals and cameras from the start, with managed switches, Wi-Fi and monitoring, and we price the internet circuit underneath across several Tier 1 carriers with no markup, because the carrier pays us. The consultation is free with no obligation, you usually hear back the same day, and Phil Morales stays your one point of contact. Tell us what is on your network, call 478-758-8091 or text (347) 870-0965.