How to Configure VLANs on a Switch and Router Step by Step

The short version

A VLAN splits one physical network into separate logical networks. Staff, guests, phones and cameras share the same switches but cannot see each other unless the router allows it. The setup always follows the same order:

1. Plan VLANs and subnets.
2. Configure switch ports: access for end devices, trunk for links between network devices.
3. Create VLAN interfaces on the router and route between them.
4. Add firewall rules between segments.
5. Set up DHCP for each VLAN.
6. Map Wi-Fi SSIDs to VLANs.
7. Test isolation.

Step 1. Plan

Write the plan down before touching any device. An example for a small office:

Avoid using VLAN 1 for user traffic. Matching the VLAN ID to the third octet makes troubleshooting easier.

Step 2. Access and trunk ports

• Access port — belongs to one VLAN, frames are untagged. Used for PCs, printers, cameras.
• Trunk port — carries several VLANs with 802.1Q tags. Used for links to the router, other switches and access points.
• Native VLAN — the untagged VLAN on a trunk. It must match on both ends.

On a Cisco-style CLI:

vlan 20
 name STAFF
interface GigabitEthernet0/5
 switchport mode access
 switchport access vlan 20
interface GigabitEthernet0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,50

Some models require switchport trunk encapsulation dot1q before trunk mode. On web-managed switches the same idea appears as a table: for each port mark a VLAN as tagged, untagged or not a member, and set the PVID (the VLAN for untagged incoming frames) on access ports.

Step 3. Inter-VLAN routing

The router (or a Layer 3 switch) gets an interface with a gateway address in every VLAN. Example for MikroTik RouterOS:

/interface vlan
add interface=ether2 name=vlan20 vlan-id=20
add interface=ether2 name=vlan40 vlan-id=40
/ip address
add address=192.168.20.1/24 interface=vlan20
add address=192.168.40.1/24 interface=vlan40

If the port is part of a bridge, create VLAN interfaces on the bridge and configure bridge VLAN filtering instead.

Step 4. Firewall rules between segments

Once the router has interfaces in all VLANs, it routes between them freely. Segmentation only works after you add rules. Logic: allow established connections, allow specific flows, block the rest.

/ip firewall filter
add chain=forward connection-state=established,related action=accept
add chain=forward connection-state=invalid action=drop
add chain=forward in-interface=vlan20 dst-address=192.168.50.10 action=accept comment="staff to NVR"
add chain=forward in-interface=vlan40 out-interface-list=WAN action=accept comment="guests to internet"
add chain=forward in-interface=vlan40 action=drop

Typical policy:

• Staff — internet, printers, file server, video recorder.
• Guests — internet only.
• Cameras — only the video recorder, no internet.
• Management — reachable only from an admin subnet.

Also protect the router itself in the input chain: guests need DHCP and DNS from it, not its admin panel.

Step 5. DHCP per VLAN

Each VLAN gets its own pool with its own gateway and DNS:

/ip pool add name=pool20 ranges=192.168.20.100-192.168.20.250
/ip dhcp-server add name=dhcp20 interface=vlan20 address-pool=pool20
/ip dhcp-server network add address=192.168.20.0/24 gateway=192.168.20.1 dns-server=192.168.20.1

If DHCP runs on a separate server, configure a DHCP relay (on Cisco, ip helper-address) on each VLAN interface.

Step 6. SSID-to-VLAN mapping

Connect access points to trunk ports. In the controller, assign each SSID a VLAN ID: staff SSID to VLAN 20, guest SSID to VLAN 40 with client isolation enabled. Keep the access points themselves in the management VLAN.

Step 7. Test isolation

• Connect to each VLAN and check that you get an address from the right subnet.
• Ping the gateway: it should answer.
• From the guest VLAN, try to reach a staff PC, the NAS and the router admin page: all should fail.
• Check allowed flows: printing from staff VLAN, recording from cameras.
• Scan other subnets from the guest VLAN with a network scanner and confirm nothing answers.

Remember that discovery protocols such as mDNS do not cross VLANs: printers may need to be added by IP address.

Common mistakes

• Locking yourself out: configure the management VLAN first and keep console access.
• Forgetting to allow a VLAN on the trunk to an access point.
• Native VLAN mismatch between two ends of a trunk.
• Routing between VLANs with no firewall rules.