Jack Wallen/ZDNET
Follow ZDNET: Add us as a preferred source on Google.
ZDNET key takeaways
- Virtual LANs enable you to isolate devices on your network.
- This step is crucial because some devices are less secure.
- Not all ISPs allow for the creation of VLANs.
Picture this scenario: You have one local area network (LAN) at home. On that network, you have your desktops, laptops, tablets, phones, and IoT devices, such as thermostats, smart TVs, speakers, and more.
Your IoT devices can see other devices and vice versa. Even though the IoT devices have considerably less security than your desktops and laptops, they are allowed to connect to the same network.
Also: The best VPN routers: Expert tested and reviewed
Then, one fateful day, an IoT device is hacked. Malware is injected into the device, which then spreads to your desktops and laptops. Next thing you know, a hacker has your bank account information and is stealing your money.
All of this happened because an insecure thermostat had access to your desktop PC.
But what if you could avoid that scenario? You can, thanks to VLANs.
What is a VLAN?
VLAN stands for virtual local area network. Without getting too deep into the muck and mire of network terminology, a virtual LAN is like a secondary network within your LAN that’s isolated from the rest of your network. Your primary LAN might have an address scheme like 192.168.1.x, and your VLAN might have an address scheme like 192.168.2.x.
The significant thing about this setup is that, because of the address scheme, the VLAN cannot directly access the LAN. That separation is important because it isolates the devices.
Let’s use our example above and name our networks LAN1 and LAN2 (LAN1 being the primary LAN and LAN2 being the VLAN).
Also: What is MoCA 2.5? How this low-cost networking can replace Wi-Fi and fix dead zones
On LAN1, you connect your desktops, laptops, tablets, and phones. On LAN2, you connect all of your IoT devices. If an IoT device is hacked, since it’s isolated on LAN2, the only devices it can access are those on the same LAN, which means your desktops, laptops, tablets, and phones are safe (more on this separation later).
You could take this approach one step further and create two VLANs — one for phones and tablets and one for IoT devices, so your network structure would be:
- LAN: Desktops and laptops (you could also add printers to this setup)
- VLAN1: Phones and tablets
- VLAN2: IoT devices
You could even configure the LAN to access everything on its network, as well as everything on VLAN1 and VLAN2, but VLAN1 and VLAN2 cannot access devices on the LAN. If you have the right networking hardware, you could even set up VLAN2 so that no devices can communicate with one another and have access only to the outside world (or the wide area network, WAN). This step could be important because it would prevent one IoT device from causing problems with another.
Another option would be to create a third VLAN for your children’s devices. You could also create VLAN3, which includes added parental controls that would limit the websites your children can reach, but wouldn’t affect devices on the primary LAN.
Also: Slow home internet? Here are 3 things I always check first to regain fast Wi-Fi speeds
In fact, you could take this approach even further by creating a fourth VLAN for guests and a fifth for working from home (that network might be routed through a VPN).
As you can see, the number of VLANs you create increases the complexity. The important thing is knowing the devices on your network and how to isolate them.
How to create VLANs
This is where things get quite complicated, as every networking router/modem/switch is different. How you create a VLAN depends on your specific hardware.
Also: Sick of online ads and trackers? How I block them across my entire home network
For instance, my network provider (Spectrum) doesn’t allow VLANs to be created via its hardware. In fact, most ISPs don’t support VLANs on their own hardware.
That leaves me with two options:
- Deploy a Linux distribution, such as OPNsense or IPFire, that can act as a router.
- Purchase a third-party router.
Since the first option can get a bit complicated for most people, I recommend purchasing a third-party router. Here are a few models that support VLANs:
If you don’t purchase one of the above routers, make sure the router you do choose supports VLANs. Using a third-party router lets you set up several VLANs, but you’ll want to read the router’s documentation to learn how, since each router’s setup will differ.
If you’re lucky and your ISP’s router/modem supports VLANs (again, most don’t), chances are they’ll be pre-configured in the router/modem’s web UI as guest networks, mobile devices, streaming devices, etc.
A bonus reason to go with a third-party router (especially a wireless one) is that you can buy one with a larger range than you already have.
Naming your VLANs
Although I mentioned creating VLAN1, VLAN2, VLAN3, etc., you could instead create VLANs with a naming scheme, such as IoT, Mobile, Kids, and Guests — but I recommend against it. The problem with that naming convention is it makes everything a bit too obvious. If a bad actor happens to be wardriving around your neighborhood and spots a wireless VLAN named IoT (if it’s visible to the WAN), they could connect with an insecure device and (if they have the skills) do bad things. Because of that risk, I recommend using VLAN names that obfuscate their purposes.
Are VLANs foolproof?
No. As I’ve said many times, if a device is connected to a network, it’s vulnerable. Still, setting up VLANs is more secure than slapping everything on a single network.
However, there’s a thing called VLAN hopping, which allows a hacker to exploit misconfigured switch ports or VLAN-tagging mechanisms to hop from a VLAN to a primary LAN (or from VLAN to VLAN). By taking that approach, attackers could gain unauthorized access to any device on your network.
Also: The best secure browsers for privacy: Expert tested
Therefore, it’s important to ensure your VLANs are configured correctly (according to the hardware in use), that your router firmware is up to date, and that the devices on every network have both updated operating systems and software.
Although VLANs aren’t a perfect solution to security challenges, they’re a great way to isolate hardware to prevent less secure devices, such as IoT tools, from accessing machines that contain sensitive information.
