Most networks start flat. One subnet, one broadcast domain, everything on the same network. It works fine when there are ten devices. It stops working when there are fifty, when some of them are IoT devices with questionable firmware, and when you're trying to figure out why your VoIP calls sound like they're underwater every Tuesday at 2 PM.
This post covers what VLANs are, why flat networks become a problem, what happens when you try to add VLANs after the fact, and how to plan your segmentation before you deploy.
What Is a VLAN and What Does It Actually Do?
A VLAN (Virtual Local Area Network) splits one physical network into multiple isolated logical networks. Devices on VLAN 10 can't talk to devices on VLAN 20 unless you explicitly allow it with a firewall rule. Each VLAN gets its own subnet, its own DHCP scope, and its own traffic policies.
The practical effect: you control what can talk to what. Voice traffic gets prioritized. IoT devices can't reach your file server. A compromised security camera doesn't give an attacker lateral access to your entire network.
VLANs require managed switches (switches that support 802.1Q tagging). Unmanaged switches can't do this. That distinction matters more than most people realize when they're buying hardware.
What Goes Wrong on a Flat Network?
On a flat network, every device shares the same broadcast domain. That creates three problems as the network grows:
No traffic prioritization. Voice and video are latency-sensitive. When a backup job, a large file transfer, and a video call are all competing for bandwidth on the same network, there's no mechanism to say "voice packets go first." QoS policies need network segmentation to work. On a flat network, you can't apply them meaningfully.
No isolation. Every device can see and attempt to reach every other device. That means a smart plug with an unpatched vulnerability is one hop away from your workstation. A guest on your WiFi has the same network access as your servers.
No containment. When a device misbehaves (broadcast storms, DHCP conflicts, rogue devices), it affects everything. On a segmented network, a problem on one VLAN stays on that VLAN. On a flat network, one bad device can degrade performance for every device on the network.
I learned this deploying VoIP systems for businesses. We'd install phones on flat networks with unmanaged switches, and everything would work until a bandwidth-heavy process on someone's workstation tanked call quality across the whole office. We had no way to prioritize, isolate, or even diagnose the problem without segmentation.
Why Is Retrofitting VLANs So Painful?
Because it requires replacing hardware, scheduling downtime, and untangling decisions someone made years ago.
VLANs need managed switches. If your network was built with unmanaged switches, every one of them has to go. That means maintenance windows, downtime, cable tracing, and finding the inline switches someone quietly added under a desk three years ago that you didn't know existed.
At work, we retrofitted dozens of business sites from flat to segmented. Some had four or five unmanaged switches daisy-chained together. Replacing them with properly configured managed switches (trunk ports between switches, access ports assigned to the right VLANs) took hours per site. It also meant reconfiguring every device that needed to move to a new subnet: new IP range, new gateway, new DNS.
The cost of doing this after deployment is always higher than doing it right from the start. The managed switch costs $20 more than the unmanaged one. The retrofit costs hours of labor and a maintenance window your client doesn't want to give you.
How Many VLANs Do I Actually Need?
Start with four or five. You can always add more.
- Management (VLAN 1): Your router, switches, access points. Locked down so only your admin workstation can reach it.
- Trusted (VLAN 10): Personal devices. Laptops, phones, workstations. Full internet access, can reach other VLANs only where explicitly needed.
- IoT (VLAN 20): Smart home devices, cameras, anything with firmware you don't fully trust. Internet access limited to what each device requires. No access to other VLANs.
- Servers/Lab (VLAN 30): Hypervisor hosts, containers, VMs, self-hosted services. Accessible from your trusted VLAN on specific ports only. Isolated from IoT.
- Guest (VLAN 40): Guest WiFi. Internet only. Can't see anything else.
This layout covers most home and small business networks. The key decisions aren't how many VLANs, they're the firewall rules between them: what's allowed to cross VLAN boundaries and what isn't.
What Should I Plan Before I Deploy?
Before you buy hardware or plug in a cable, answer these questions:
- What categories of devices will be on this network? Group them by trust level and traffic needs. Voice, IoT, personal, servers, and guests are the common buckets.
- What needs to talk to what? Your phone needs to reach the internet but not your NAS. Your server needs inbound connections from your workstation but not from your smart thermostat. Map these relationships before you start writing firewall rules.
- Are all your switches managed? If any switch in the path between your router and a device is unmanaged, VLANs break at that point. Every switch needs to support 802.1Q.
- What does your subnet scheme look like? Each VLAN gets its own subnet. Plan them consistently: 10.0.10.0/24 for trusted, 10.0.20.0/24 for IoT, 10.0.30.0/24 for servers. It makes firewall rules and troubleshooting easier.
- What's your WiFi SSID strategy? You can map SSIDs directly to VLANs. One SSID for trusted devices, one for IoT, one for guests. Or use a single SSID with RADIUS-based VLAN assignment if your setup supports it.
Write this down before you deploy. A 30-minute planning session saves hours of retrofitting.
When Does Network Segmentation Become Non-Negotiable?
The moment you're hosting something that matters.
My home network became segmented infrastructure when I started hosting my production website on it, served through Cloudflare Tunnel from a container in my house. At that point, a compromised IoT device on the same network as my web server wasn't a theoretical risk, it was negligent.
For businesses, that line is even clearer. If you're running VoIP, you need voice traffic isolated and prioritized. If you have a guest WiFi, you need it firewalled from internal resources. If you're subject to any compliance requirement, flat networks are a finding waiting to happen.
You don't need VLANs on day one of a five-device home network. But you'll need them sooner than you think. Plan for it now, and deployment is a configuration task. Plan for it later, and it's a project.