VLANs: How to Protect Your Wifi and LAN

Dave explains VLANS and how they can be used to enhance the performance and security of even a simple home WiFi setup.

[@What_s_Neu]

The different colors in a pipe is the best analogy I've heard for vlans!

[@DavesGarage]

Thanks! I was hoping that would resonate with some folks!

[@eric38243]

I agree, the pipe analogy and the visuals in this video are probably the best explanation of the vlan concept I've ever seen in the past 15 years of my career.

[@thiago713]

Same! I totally agree! Once Dave said that, it all started to make sense!!!

[@Deliquescentinsight]

@@DavesGarage Yes, I am revising some of the basics, that really helped me

[@anthonyholleran2721]

@@DavesGarage This analogy resonated with me, wonderfully!

[@nickvoncloft4566]

I'm studying for my CCNA 200-301 I understood every word you said!!!!!

[@jerbear7952]

Then your studying is working. Heck yeah :)

[@FarmerRiddick]

Dave, I do appreciate how you just 'lay it out there' so simply for all of us! Things don't seem so intimidating the in style in which you teach. From a user +, Thank You!

[@killbot6]

DAVE, I have been in IT for a while and have done a lot of networking, but your Pipe description is the best metaphor I've heard for this thus far. Thank you!

[@bobbyLovesTech]

Dave, please don't ever stop making videos. Love the content and love learning about networking

[@CarmineIannace]

Excellent, straightforward introduction to VLANs. You knocked it out of the park!

[@iamvinku]

This is a fantastic explanation of VLANs for networking newbies like me. Thank you Dave for making this video and including an example of configuring VLANs in Unifi hardware.

[@e.lan.s]

Unifi is awesome! ❤

[@randyl5205]

It can be difficult to find a person with deep background in these more esoteric topics, really appreciate the clarity of the presentation.

[@zaandam0172]

Goes for anything...

[@reecedeyoung6595]

Thank you for explaining it completely!! There are many quick/easy vlan videos that miss important details, like the difference between port based and ethernet frame tagging vlan implementation. This was confusing me, and your video cleared it up.

[@scoty_does]

I've worked on data center network and systems deployments for years and i find this video compelling!

[@mowtown75]

Dave, you are easy to listen to, you make sense and cut out the guff. I have not touched networks in years (used to for my job) and this saved me the "dont use it you lose it recovery time" and I learnt stuff. Thanks Tibby

[@MrUglyDave]

One of the best explanations of VLANs I have come across. Your analogy with the different coloured sub-pipes works great :)

[@mrandyburns]

Love it Dave! So simple and yet still informative. In fact it prompted me to update my UniFi settings at home as your simple quick demo highlighted a couple of errors I had I my rules. Thank you from the top of Scotland!

[@414s4]

I’d tell you a joke about udp, but I’m afraid you may not get it.

[@ChatGTA345]

Just tell it to me QUIC, problem solved 😂

[@TylerTMG]

idk what usp is but I get the joke

[@TeaBagginsMcGee]

i bet if you told a tcp joke he would get it!

[@TylerTMG]

id tell you a joke about my brain. but i forgot where it is

[@rexsceleratorum1632]

@@TeaBagginsMcGee Indeed. This needs to be acknowledged.

[@johnp312]

Great explanation! That pipe-in-a pipe concept gave me the needed understanding of what VLANs are.

[@michaelrafferty660]

Another good video. I like how you don't mess around and waste my time. Thank you!

[@otherganymede3681]

the most straight to the point vlan video i've ever watched, thank you

[@rainmant5724]

OUTSTANDING!! So many people I work with don't understand them, and confuse Vlan's with a ip segment!! Your water example is great, and I plan to share your video with others. Thank you very much!

[@gonootropics2.065]

Most VLANs are used in tandem with their own IP range. You generally don't have 2 VLANs on the same subnet for example.

[@ChitChat]

You can have multiple IPs for one VLAN, but only one VLAN per IP range. In practice 99% of the time it's a 1:1 mapping.

[@thegingaman]

Great insights on VLANs, Dave! But let's not forget about VLAN hopping - a sneaky technique that can breach VLAN segregation. It's a real eye-opener for network security, showing that even VLANs aren't impervious to attacks. Always a good reminder to double-check our configurations and stay vigilant!

[@robsyoutube]

This stopped being an issue in the early 2000s with cisco and its clearly indicated to never use vlan1 in all of ciscos documentation to avoid this when mixing vendors with poor implementations.

[@perwestermark8920]

VLAN hopping really isn't a fun subject. Switches needs to be fast. Which means they can't be too smart at the same time.

[@robsyoutube]

It literally knows where in the CAM table each device is, What interface and vlan. The only place you're getting on another vlan in a proper deployment is a trunk port. Now on small home networking gear this is probably an issue but the last generation from cisco on the catalyst line and nexus line where it was an issue was in the early 2000s. @@perwestermark8920 Its been standard practice in both cisco's hardening guide, and the NSA security guidelines to never use vlan1. And never leave trunkport status to auto negotiation. edit: A quick google shows this is exactly the same as it was when the advisory went out initially for the 1900 series, 2900 series and 3500 series catalyst switches when this was discovered in the early 2000s. Don't use VLAN1/ the untagged vlan. I don't think there is a single person in the industry that does this because its been common knowledge how incredibly stupid the concept of using vlan1 mixed in is since at least 2001.

[@DrakiniteOfficial]

The moment he said it was done in software, my very first thought was "How easily can this be exploited or hacked?" - I definitely wouldn't trust something like this with my life, but still I'm sure it'll stop the vast majority of spyware.

[@pheonixmmkc]

Good ol double tagged vlans

[@dpyles9396]

Hey Dave! This is great info and is VERY WELL presented. I always enjoy and look forward to you videos.

[@DavesGarage]

I appreciate that!

[@gadfly5741]

Great video! Small nitpick at 6:30. In Ethernet frames, destination MAC address comes before source MAC address (opposite the ordering of addresses and ports in IP and TCP/UDP headers).

[@Studio23Media]

I would really love more of these computer basics educational videos from you!

[@siliconsoundz]

Another great video that explains what can be a complex subject in an easy to digest fashion. Cheers!

[@jholloway77]

I use a VLAN to block my mother in law from going on Facebook. Makes conversations with her less crazy

[@stewartdahamman]

Dave - please do more of these type of videos as this was really useful

[@frfrankie23]

LMAO. I did not expect the subtle humor with the VLAN names. You were so serious up until that point. Super informative video, thank you for this!

[@stevenPounder-p4b]

Thank you for this video. Yesterday was the first day my home network consisted more than the ISP modem/router combo and a small unmanaged switch. I spent most of the day shooting myself in the foot through unknown trouble guessing and hopes.

[@the4peters]

The quality and color of your videos is outstanding. I was recently given an older 24-port dell managed switch and I plan to experiment with VLANs. Thanks for the info! subbed.

[@bdeva029]

This video was awesome, please make more videos like this with the detailed break down of the topic. I'm going to share this video with friends.

[@dustinscott2765]

Dave, I love how you broke this down and simplify VLANs!! As a Lead Infrastructure Engineer I have to explain how VLANs work, I will definitely be using your analogy of the pipes inside a larger pipe. Thanks for sharing and keep the content coming! Great work.

[@anthonyholleran2721]

I subscribed to your channel Dave! Great explanations and even with my A.D.H.D., I get you, my neuro-divergent brother. The world needs more minds like ours, indeed! Great videos, keep 'em coming.

[@alexevansuk]

You just saved me thousands of hours explaining the cost and benefits of configured router, switching and wireless access. Thanks Dave.

[@hquest]

Just be mindful there are two different elements in play: wired VLANs and wireless SSIDs. While you can create an extremely long list of VLANs (around 4000), including one VLAN for each and every device (literally, if used for micro-segmentation, for instance), you have a limit of wireless SSIDs you can run on your equipment before you start to lose performance. A somewhat "secure" home wireless setup would be built with independent "private", a "guest" and "IoT" SSIDs. Each SSID would run on top of (or be "tagged" to) one wired VLAN, as you detailed on your video. Good stuff, Dave - now get the video listed so others can watch it too without having a link to it 👍

[@BGraves]

Each ssid will broadcast beacons, reducing overall performance.

[@bjoern.gumboldt]

The UniFi Network Application supports WiFi Private Pre-Shared Keys (PPSK), so you can use multiple VLANs with only one SSID. You can still keep a second SSID for the "guest network" just for aesthetics; but there's no need for separate IoT, camera, etc. SSIDs when using PPSK, which the equipment Dave's shown does support. Thusly, no impact on performance due to too many SSIDs as you've correctly pointed out.

[@FluffyPuppyKasey]

This is exactly what I do. I run a private SSID for my roommates and I, a guest SSID for well, guests, and an IoT SSID for IoT things like cameras and doorbells, plus another one for devices I don't trust (for example, a Windows XP machine I'm forced to connect to the internet). I only have four VLANs though, but I'm thinking about separating everything into it's own network that all have internet access. I just don't know how to do that

[@hquest]

@@bjoern.gumboldt It all depends on the product and skill level. The average user will be running whatever garbage gear their ISP provides them, or whatever gear they can buy for cheap that is friendly enough for them to configure. For more advanced solutions, yes, the UniFi network and the PPSK are great. At home, I do have my own NAC server, which authenticates the client and instructs the network to enforce policies, including VLANs, ACLs and URL redirections, so I too only run one SSID for maybe 6 different use cases, all fully isolated from each other. However, this has a cost and such complexity that is unrealistic to average users.

[@ailivac]

Unless you use EAP ("enterprise") security, then you can configure different devices to authenticate to the same SSID separate accounts that map to different VLANs with most APs. But that's assuming the devices actually support EAP, which in practice absolutely none of them do. And even when they do they tend to be full of bugs, like Android's compatibility problems with default Let's encrypt certs (and crap documentation with even more crap error messages). So it will work with your laptops and phones, which you likely don't have any reason to isolate anyway, but all the stuff with sketchy firmware will need an extra dedicated SSID.

[@gotbordercollies]

You should teach computer concepts, you have an amazing talent for explaining complex things!

[@triforcelink]

That’s exactly what he is and has been doing lol

[@gotbordercollies]

@@triforcelink very true - I stand corrected

[@greg778123]

I surprised you haven’t hit a million subscribers yet You videos are awesome

[@nickclarkuk]

Thank you , I was looking for info about VLANS a few months ago . This is much clearer than anything I previously found .

[@BrianG61UK]

This mainly discusses network segmentation and isolation. I prefer to think of VLANs as a separate topic since you can do the former without the latter, especially in simple cases. I see VLANs as just a way that one cable can carry multiple isolated networks between VLAN aware equipment. A VLAN aware switch can be divided into several isolated switches, and its ports can be configured to be part of any one (or more) of the isolated switches, a single cable can carry groups of isolated networks between routers, switches and Wi-Fi access points. It's also worth noting that ordinary untagged traffic is just as isolated from the VLANs as they are from each other.

[@allenbythesea]

I've got a udm pro se and all ubiquiti hardware as well. Great video to explain how this all works. I sent the link to several friends who should understand this as well.

[@qubes8728]

This channel is VG. That is “Virtual Gold” and it’s worth more than its weight🙏🏼

[@BankingBrad]

Wonderful breakdown and very digestible while not being too simple to become useless

[@dontmakemelaugh8502]

Thank You Dave for that whole detailed presentation!

[@kevinoneill2170]

Thank you, Dave. Always enjoy learning from you.

[@BillWilder]

Kudos Dave for the concept of coloured pipes within pipes - a very nice way to visualize virtual LANS.

[@Intrepid344]

Great video, Dave! I found it very helpful to me as an aspiring network administrator. Cheers!!

[@pdelfante]

Great video for newbies. Well explained

[@emorysmith197]

This is good stuff! For people who are trying to learn networking, this is a really good explanation of generally the how and why. Great review for those of us who need to implement the stuff we learned.

[@Cire3PC]

Never heard it explained so well. Nice video

[@BaZzZaa]

Hi Dave, network engineer here. Good job on the video, a few errors but we’re cool! 😂 I see your world and ours converging fairly rapidly. Looking at what you’re able to achieve with a GUI on home equipment is astonishing to me if not a little but scary! I work at an airport where our server team and my network team work closely together. Technology moves in waves in big business but I’m seeing the capability advance far quicker now. There already is a blurred line between server and network teams that’s going to be interesting to live through over the next few years. I appreciate you bringing networking to your channel. It’s an important collaboration that many must take for granted. In the corporate world having experts in both fields is a blessing. Writing code for operating systems is well out of my reach of understanding. However I always like to see the other side. Mainly to know I’m completely incapable of understanding a single like of code. Have a good Christmas mate.

[@TequilaDave]

Speaking as a server engineer and working for the Ambulance Service we work very closely with the network engineers. It really helps if each know at least a bit of the other, basic things like the OSI 7 Layer Model should be known by both. It is much easier to try and explain what you think a networking issue is if you can troubleshoot and give your diagnosis to the network team. I still love those topology diagrams comparing network to servers engineers involving "magical pixie dust" 😂

[@bivensrk]

What did he get wrong?

[@alb12345672]

@@TequilaDave I work in the power industry and substations have huge networks that carry TCP packets about how the power is flowing. The info is coded into a TCP packet. Everything you can imagine from voltages, control signals, etc. Look up IEC 61850 if interested. Vlans are extremely important.

[@hquest]

@BaZzZaa Another fellow network person here. I would not call Dave's videos "errors", but semantics that could be better clarified - one such as I did on another comment in his video about VLANs and SSIDs. The Ubiquity is not exactly "home gear". I would call it SoHo to Small Business friendly. Not exactly datacenter/carrier grade, that's for sure. But they have some brilliant products for dirty cheap, if compared with crappy ISP provided gear or the options we would be recommended at regular brick and mortar stores. About GUI changes, well, that has been more and more common lately. Not sure which gear you use, but many if not all of them do offer strong configuration capabilities via a GUI - be it in form of a native app or web app - to the point you will use CLI for initial configuration and perhaps some very obscure troubleshooting only. Keep in mind the world is progressing towards the cloud, and even while on-premises will still reign for a long while, programmability has been the key for almost a decade now. There will be fewer folks needed with CLI skills and much more with web and API skills - meaning those that understand code. Keep that in the back of your mind, but don't bury it too much so you won't get phased out ;) Merry Christmas!

[@chefdeit]

@@hquest >"The Ubiquity is not exactly "home gear". I would call it SoHo to Small Business friendly. Not exactly datacenter/carrier grade, that's for sure. But they have some brilliant products for dirty cheap" I definitely agree. TP-Link Omada SDN is even cheaper than Ubiquiti, with a modicum more privacy. The difference vs mid to low tier enterprise grade gear is beyond performance. While the performance gap may actually be shrinking, the gap that's widening is support and especially how well the various features are tested by these vendors before they're rolled out.

[@UmVtCg]

7:10 As you explained, vlans operate on the data link layer which is layer 2 of the OSI model. Therefore the vlan segmentation is configured on a switch. And technically not on a router. However, you are correct as most home routers are a firewall, switch, router and modem all packed into one device.

[@jdmayfield88]

Actually, a switch, at it's most basic, doesnt do any of this. This is still taken care of by routing. I.E. Smart switches, are basically still routers. "Dumb" switches cannot do any of this, they are basically glorified hubs that also still route IP traffick to specific network segments, without any other rules. The realm between "router", and "switch", nowadays has been greatly blurred.

[@hotzemusic]

@@jdmayfield88 I believe the point OP is trying to make with this comment, is that Switching and Routing are clearly defined and very different things, which is important to understand when wrapping your head around how VLANS work. And Even though dave is managing his network from the Unifi controller, which lets him configure VLANs and routing policies in one place, the VLANs are actually configured in the switches domain at L2, and the subnets, interfaces, and routes are the router's domain at L3. The two layers don't really care about or even know what the other is doing even if they are brought together and manageable through a slick SDN controller interface like this.

[@TheBitWhisperer]

The IEEE 802.1 term for a device operating at layer two is “bridge”. I think switch is an implementation specific term and really only came to be used when we starred building custom silicon for networking. The original layer 2 bridges were PCs with multiple network cards. So were a lot of the early routers, which were often called gateways. Switch became used to distinguish repeaters (hubs) from devices that inspected the packets at near line rate rather than blindly repeating at the bit level.

[@hotzemusic]

@@TheBitWhisperer 100% correct. But I was trying to not get *too* into the weeds. FWIW, My intent wasn't to be pedantic or anything lol The subject is pretty esoteric, so I just wanted to close the loop a little bit for anyone watching and reading the comments who might be trying to wrap their heads around high level VLAN concepts. That's all :)

[@paaao]

​@TheBitWhisperer The term bridge however is commonly confused with a hub. Hubs being those old crap switches that broadcast packets across all their ports as opposed to L2 switches that tie each port to the MAC address plugged into it, and only routing packets destined to that MAC, to that port so devices plugged into other ports cannot sniff the traffic.

[@waterandafter]

I love how you explain things. Too many computer channels expect their viewers to have a computer science degree.

[@Qsie]

VLANs are a big deal in enterprise environments. Even in a home LAN, the concept is very useful!

[@AM-dc7pv]

I see from the VLAN name that I've found the right place with like-minded people...carry on, sir.

[@channelzero2252]

Hey, Dave, I think videos like this may be one of your callings. You should do more. The digital world would be a better place for it! And easier to understand.

[@garymcc3748]

Very good information - was dabbling with VLANs recently. Love the channel

[@techn1kal1ty]

As a networking degree holder myself, I appreciate the inclusion of the OSI model.

[@Alchemetica]

Most interesting, I think for the first time I understand the basic use of VLANs, I will need to watch again and take notes. I think when I watch your videos I almost always learn something or gain more understanding about computing. Thank you.

[@marksterling8286]

Great video, I run 8 vlans with the by default untagged vlan is the guest network and carries the other vlans as tagged. The only exception is for cctv where those ports are untagged in the cctv network, but don’t carry the other tagged networks.

[@deandrewilliams9087]

The "NotPorn" VLAN was hilarious 😂😂

[@AM-pl2pt]

Thank you Dave!! I truly needed to watch this video. Your explanation is very helpful.

[@danman32]

When it comes to broadcast and physical bandwidth utilization, consider those colored pipes as able to expand their diameter. VLANs only get limited on access ports on a switch that supports vlan segmentation. Trunks in Cisco terminology or ports with VLAN tagging as other brands designate it will still pass all VLANs through, and can be probed. Thus a single VLAN can saturate ALL ports that allow that VLAN through, thus possibly choking bandwidth on ports and cables for VLANs that share the same physical structure. If you are using 'dumb' switches, that is switches that don't support VLANs, they will pass all VLANs through it to all other ports on that switch. You'll need a switch that supports VLANs though to strip off that tagging, otherwise the end device might not accept the traffic, since it may consider the frame corrupt when it sees the VLAN tag still in the frame. A better way to look at VLANs are marked cars on a highway. You can still see all the cars and they take up space on the highway, but perhaps cars tagged with blue license plates are only allowed in and out of some exits, while cars tagged with red license plates can only go on others. Then there's the interchange exits where cars with any color license plate can get through. If red cars attended a convention that suddenly let out, those red cars could flood the highway and prohibit them blue cars from getting through.

[@BrianG61UK]

It's safer to consider what will happen to tagged packets in a non VLAN aware switches as undefined, because apparently some switches just drop tagged packets.

[@thiago713]

That was exactly what I needed!!! Thank you so much Dave!!! You da man!!! 👍

[@tylaminovel9343]

Super straightforward and helpful, awesome video man

[@cyclemoto8744]

Great presentation Dave. Cheers from OZ

[@AutumnGarnet]

This definitely reminds me that I need to set up a more complex router than the one provided by the ISP. I needed that reminder.

[@wtmayhew]

Out of the box, a lot of consumer grade equipment is configured to prevent the end-user from shooting her/himself in the foot, and that is usually a configuration which leans toward too permissive - so things work without needing to bring in a Cisco CCNP technician. It is fairly easy to get in over your head quickly. 802.1Q VLANs are a good thing and as Dave correctly stated help isolate traffic, but don’t necessarily equate to security measures. The security as Dave also said is in the inter-VLAN routing and that can be tricky and/or take some time to get right. In fact you can take a college level class which is entirely on the subject of LAN routing (and another class on enterprise routing). Something to keep in mind as administrator is to limit what protocols both layer 2 (at the data frame level) and layer 3 (at the IP addressing level) allowed at a given port. For example, ports which are connected to end user devices should not be allowed to accept in 802.1D spanning tree frames which could alter the network topology, or 802.1Q tagged frames which could allow users to spoof what VLAN they are on. There are exceptions. VOIP phones have a 3-port switch inside which directs VOIP to the phone electronics and regular traffic to a PC port, while the network port carries both VLANs to the switch. Another example is a VMware or HyperV server which may be running a virtual switch and virtual router within the server software, and sending multiple VLANs into the network. Spanning tree can be tricky. At its basic, spanning tree lets you plug multiple switches together any way you like and your network will magically work. Spanning tree does so by shutting down any port which receives back a spanning tree frame sent out from the same device on another port. This automatically prevents loops from forming in your network. You can even intentionally put redundant links between devices and one link will be kept shut off unless the other link fails. (We’ll save trunking with multiple operational parallel links for some other time). When one link fails, the other link will start up after a few seconds.. The trick comes in when you have multiple switching devices, usually arranged as a hub with spokes and maybe an outer wheel connecting the spokes for backup. You need to be sure the hub of your network stays the hub and not one of your spoke devices, usually weaker, becomes the network nexus. Even worse, a rouge user or infected PC might send out 802.1D frames to become the hub in order to intercept all traffic. A good quality switch will allow programming some sort of spanning tree security configuration. Network convergence can be controlled by assigning what you want to be the hub nexus device a low 802.1D ID number. Lower numbers have higher priority for controlling topology. The default for devices to use their physical MAC addresses as their 802.1D ID, thus whatever device has the numerically lowest MAC address becomes the network nexus. Once you have your topology locked down, then you can think about routing. That’s another course to take.

[@jefffuhr2393]

@wtmayhew Thank you (seriously) for the reality check on my level of [mis]understanding! Very interesting topics!

[@wtmayhew]

@@jefffuhr2393 Thanks for the supportive reply. I did my best to be accurate.

[@qwertykeyboard5901]

JUST USE "THEIR", ITS BETTER THEN "HIM/HERSELF".

[@arfazero1]

CCNP you mean call a cisco tech for $5000 a year card

[@malborboss]

Exactly ​@@qwertykeyboard5901

[@timothyburke7226]

Physical switch port isolation is still needed to seperate different segments of the network.

[@garysutcliffe9770]

Cheers, hadn't really though about VLANs for home networks, only corporate, but your right given the amount of IOT devices even on security alone it would be worth it.

[@smoetje]

Clear and comprehensive. Thank you!

[@joeydebra763]

The most technical explanation of VLAN's is the segmentation of broadcast domains. Each MAC address table entry also has a VLAN property constraining local and broadcast traffic within itself. By using segmentation you force traffic to a router, switched virtual interface or firewall where you can define policy for traffic between VLAN's. However this is important: a broadcast storm on 1 VLAN WILL bring your entire local network down even if that traffic belongs to another VLAN on the same switched network. Only traffic living on another physical interface on an upstream router or firewall will not be affected since the broadcasts only are on 1 physical interface. The reason why switch CPU's spike in a broadcast storm is because they have to continually rewrite the mac table because source MAC addresses keep jumping between ports. And writing to the CAM memory has to be done by the CPU.

[@pitsnipe5559]

Guess I must be getting old as I remember many of those items. As a small boy we lived in an apartment building where my dad was the super. It had a coal fired boiler. I remember the coal truck delivering coal down the cute into the coal bins. We also had an insulated box by the front door for milk delivery. The building had a dumb waiter for sending trash to the basement for loading in barrels for pickup. I attended a vocational high school in the late 1960’s where I trained to be an electrician. One of the things learned was how to install knob and tube wiring. Another thing I remember was when we moved in house there was a mail slot on the front door where the mail man dropped off your mail. So much has changed.

[@bicivelo]

Yet another great video. Thank you!!!!

[@goddan7222]

Thanks for this video vlans always left me head scratching

[@WilcoGroothand]

Learning every day....

[@warperone]

great job, thanks Dave

[@cozymonk]

Here I am splitting my 5Ghz from my 2.4Ghz and running 3 different physical routers. Thanks for this!

[@sealstech8087]

Whats creepier is I just finished a guest AP for a gym and just finished a phone call with my boss about if he wanted to bill for the programming hour(s) to add security to the wifi and rest of the network. Then this gets recommended. Good job algorithm. 🍻

[@jjoker795]

i just love your voice man, you can sell me anything. Thanks for the information much appreciated

[@edwinrosales6322]

Great video, thanks, Dave!

[@sirius4k]

What if I want green and red networks to access a shared resource? For example, I would like my "smart" TV to ideally be in its own network, but it also needs to be able to access the DLNA server (NAS) and I have to be able to access the NAS from green as well.

[@kennethstout9237]

Thanks Dave. Very interesting and informative.

[@aperson1234-t8x]

1:07 thank you Dave for confirming the internet is a series of tubes

[@barrymarcus3425]

Great start from 90,000 ft Dave! Where should I go to learn in detail everything I need to know from theory to nuts and bolts on how to set up my own VLANs?

[@DavesGarage]

Probably a Cisco mgmt course, or the prep for one that deals with VLANs and Subnets. On KZbin, I'd check out Network Chuck and Techno Tim.

[@josesantana6412]

Thank you for sharing your knowledge appreciate it.

[@mobayguy]

Outstanding video - Many thanks

[@Dayison]

Thanks, Dave! Appreciate ya...

[@danman32]

A method that many WiFis use for guest networks when the APs are separate from the router is for the AP to act like a firewall for the guest SSID, treats the wired network as an intermediate network, only allowing the guest traffic on the intermediate network (private network if you will) to access the default gateway on the private network. No VLAN needed in that case. But if your router is providing the WiFi, no need for VLANs since the router will directly firewall the dedicated WiFi networks. Only when you need the dedicated WiFi to traverse the wired infrastructure as well do you need VLAN. It is possible though the router treats the different WiFi networks as VLANs for identification simplicity.

[@johnburgess2084]

Great video Dave. Thanks!

[@nakfan]

Thanks for explaining VLANs... I think though, that I will have to watch it again later due to a mild state of EMISOB (Early Morning Induced Slowness of Brain) 😅 All the best, Per (Denmark)

[@Chris-op7yt]

it's doing my head in. i learnt all my networking in the old school. i have no problem understanding the basic concepts of VLANs but, the rub is in setting it up, and not bricking myself out from devices. knowing what to tag/untag/exclude at each of my devices is giving me a headache. I have a edgerouter, and edgeswitch, and a unifi UAP....and i need to segregate some things on the switch and some on the UAP....without the UAP getting blocked to get to controller on my PC. I watched a few videos and am not much wiser as to how to set it up properly. Any suggestions on reading material, so i can figure out what to T/U/E at each network device?

[@tlwmdbt]

Love your videos. Thanks a lot for all!

[@MichaelRainabbaRichardson]

TP-Link Omada FTW. Their APs can be run without a controller, support multiple SSIDs, and you can assign VLANs to the different SSIDs. When you add something like the ER605 for routing/firewall and the OC200 to manage all of it, you can create a significant number of SSIDs, each having their own VLAN, and an easily configurable router to boot. This man's knowledge no doubt Trump's my own, but I've been playing with networks since the days of 10 megabit token ring and I love how simple the Omada system for this very thing. Keep my kids on one network, my IoT device is on another, and my work separate from all of that.

[@MikeyAntonakakis]

I got an Omada setup running at a new house a couple months ago - loving it! The house was fairly extensively pre-wired with Cat5e, coax, and even some fiber, all run to a common location, at some point drywalled over but I was able to find it and install an in-wall structured media enclosure (house was built in 1999/2000). I had enough physical access to run some more Cat6 without having to tear anything up, and the 3-in-1 ER7217PC is small enough to fit comfortably in the structured media enclosure with my old modem/router combo box running in modem-only mode. I installed 5 EAP655-Wall access points, which each have 3 ethernet ports, and I've been blown away with how quick and easy it was to get everything running, and how much better WiFi fast roaming works compared to my consumer Netgear modem/router combo and WiFi mesh extender (CAX80 and EAX80). Going to get some VLANs set up in the very near future!

[@tamrix]

I’m running my Omanda software controller on a raspberry pi.

[@ChitChat]

I question if homes really need multiple VLANs. If you have IoT, I can see that. For broadcast storms I wouldn't worry about those. They only occur when you have redundant links between switches which causes loops. Spanning-tree protocol is designed to handle that. As well as LACP, and VPC. At an enterprise level though, VLANs are everything.

[@findJLF]

I really like your channel. This episode may have inspired me to finalise some network security !

[@newmonengineering]

Good timing, i am in the middle of planning my vlan setup now. I just setup opensense and my smart switch. Im trying to figure out proper rules and subnets that make sense. Hopefully i can figure it all out.

[@ekowlloyd]

you got a new subscribe sir- I like your delivery style.

[@DavesGarage]

Thanks and welcome!

[@Hansengineering]

Hey! What a great YT recommendation! I am rebuilding my whole network because gear I wanted 8 years ago is just on eBay now! Putting together a whole Ubiquiti system, and i'll need VLANs. I am going to swap over to WPA3, but a few devices still must have WPA2. So i'm (probably) gonna make a separate WPA2 VLAN that just connects to the Internet and not inter-device.

[@cyberwip]

If you look into top-end routers, and route your ISP's modem/router into your own local router, much of this network control is built into the routers.

[@24VBMWPower]

Assigning VLANS to switch ports manually is more a home or small office thing. On larger corporate networks, there might be something like Aruba CPPM, so you can plug any device into any switch port.

[@arturorubio-w1m]

Excellent content

[@pcallycat9043]

One major point that needs to be emphasized... vlan tagging only achieves any level of improved 'security' within the lan. Once you're past the managed switch or router and onto the uplink, the vlan is no longer in effect for most 'normal' users.

[@DavesGarage]

Sure, on the uplink, but let's say an IoT camera goes rogue - unless it can break into my router somehow, how's it going to even touch or see traffic in the other VLANs?

[@pcallycat9043]

@@DavesGarage Oh I agree 100%. I've just went the rounds with a network admin where I work, over the same issue. He was convinced that vlans provided the same protection on both sides of the router (my honest impression is he just didn't understand the lower layers of the network stack), so I thought it worth mentioning that vlan isolation only exists behind the router (exceptions exist of course, depending on higher level transport design).

[@beowulfsleeps892]

@@DavesGarageI think this is quite a complicated subject and there are various interactions, in which I am not expert. I also think there are several ways to tackle this - layer 2 versus layer 3, for example, but I don't know which is the easiest to set up and then manage. My experience is that VLAN tagging for infrastructure rather than end devices. VLAN ids are assigned to frames that are received over a port/interface (removed before transmitting to an end device) and are tagged on trunk links to indicate the VLAN where that trunk is carrying multiple VLANs. This is an administrative separation and relies on trusted infrastructure to respect the tags. So I don't think Wifi would be tag VLANs unless it was a wifi router-to-router trunk link. The separation on Wifi is via SSID isolation. VLANs won't necessarily reduce Wifi load either - the bandwidth is shared on Wifi so it doesn't matter if it's a 'private' broadcast or a 'public' broadcast. VLANs are layer 2, so this problem of separation only is an issue if you are bridging networks (say LAN and Wifi). If you're not then VLAN isn't applicable and you can use layer 3 separation via firewalls and routing.