Evaluating VLAN Segmentation Strategies for a Mixed IoT and Business Network

A compromised device should not automatically give an attacker access to an entire office network. Yet when workstations, printers, security cameras, and guest phones share the same unrestricted network, that is exactly the kind of exposure an organization creates. Network segmentation reduces this risk by separating devices into controlled zones and limiting the connections permitted between them.

In this post

1. The security problem with flat networks
2. How VLANs separate network traffic
3. How to choose segmentation boundaries
4. A practical example: isolating printers
5. Why VLANs need firewall rules
6. What segmentation cannot prevent
7. A small-business segmentation plan
8. Implementation and testing checklist
9. Frequently asked questions

1. The Security Problem with Flat Networks

A flat network places devices in the same network segment without meaningful internal restrictions on communication. This arrangement is convenient: devices can discover printers, access shared folders, and communicate with other systems without an administrator having to design many separate access rules.

The weakness appears when a device is compromised. Malware running on an employee's computer may scan for vulnerable services, search for shared folders, or attempt to connect to administrative interfaces. If those destinations are reachable, the attacker has more opportunities to move beyond the original device.

Not every flat network permits every possible connection; host firewalls and application permissions can still restrict access. Nevertheless, a network with broad connectivity gives a compromised device more potential paths to explore than a properly segmented environment.

The device initially compromised does not have to contain valuable information. A printer with outdated firmware, a camera with weak credentials, or an unmanaged workstation may provide a useful starting point if it can communicate with sensitive systems.

The purpose of segmentation is containment. It does not guarantee that devices cannot be compromised. It reduces the number of systems a compromised device can reach and makes those permitted connections easier to control and monitor.

2. How VLANs Separate Network Traffic

A virtual local area network, or VLAN, divides a physical switching infrastructure into separate logical Layer 2 networks. Devices connected to the same physical switch can belong to different VLANs, so they do not automatically share the same broadcast domain.

On Ethernet links carrying multiple VLANs, switches commonly use the IEEE 802.1Q standard to identify the VLAN associated with a frame. An access port usually assigns a connected endpoint to a configured VLAN, while a trunk port carries traffic for multiple VLANs between compatible network devices.

Consider an office with three VLANs:

• VLAN 10 — Business: employee laptops and desktop computers.
• VLAN 20 — IoT: printers, cameras, and other connected equipment.
• VLAN 30 — Guest: visitors' phones and personal laptops.

Although these devices may use the same physical switch, each VLAN maintains its own Layer 2 broadcast domain. A device in VLAN 30 cannot simply send an ordinary Ethernet frame directly to a device in VLAN 10 as if both were on the same local network.

Communication between different IP subnets normally requires a Layer 3 device, such as a router or firewall. That device becomes a control point where administrators can permit, restrict, and log traffic between the segments.

VLANs and firewall rules solve different problems

• VLANs separate Layer 2 broadcast domains.
• Routing provides a path for communication between IP networks.
• Firewall rules determine which routed connections are allowed or denied.
• Endpoint firewalls can further restrict connections to individual computers and servers.

A VLAN by itself is not a complete security policy. If a router allows unrestricted communication between every VLAN, devices may still reach one another through that router. The separation becomes a meaningful security control when the network's routing and filtering rules enforce the intended boundaries.

3. How to Choose Segmentation Boundaries

Creating a VLAN for every device category may look organized, but device labels alone do not determine the correct security boundary. A better design starts with two questions: what does each group of devices need to communicate with, and what could happen if one of those devices were compromised?

A workstation used for financial administration may need stricter access rules than a general-purpose employee laptop. A camera may need to contact a recording server but have no reason to initiate connections to employee computers. A guest phone usually needs internet access rather than access to internal business resources.

The following layout is a useful starting point for many small organizations. It should be adapted to actual business requirements rather than copied without review.

Network segment	Typical devices	Suggested access policy
Business	Employee computers and approved work devices	Allow required business applications and internet access; restrict unnecessary access to IoT and management systems.
IoT and equipment	Printers, cameras, smart devices	Permit only required services, such as approved print servers, monitoring systems, or update services.
Guest	Visitor devices and personal phones	Provide internet access while blocking access to internal networks and other guests where supported.
Management	Switches, routers, access points, administrative interfaces	Restrict access to designated administrator devices and approved management services.
Servers	File servers, application servers, databases	Allow connections from approved clients and services rather than every device on the business network.

Small networks do not always need five separate VLANs. A business with a handful of devices may begin with business, guest, and IoT segments, then introduce dedicated server and management networks when the equipment and operational needs justify them.

4. A Practical Example: Isolating Printers

Printers illustrate why segmentation should follow communication requirements instead of convenience alone. Employees need to submit print jobs, but the printer usually does not need unrestricted access to employee laptops, file shares, or administrative interfaces.

Suppose an office places its printer in an IoT VLAN and its workstations in a business VLAN. The administrator can allow printing through an approved print server or permit the specific workstation-to-printer connections required by the printer's supported protocols.

For example, a network might allow an approved print server to contact a printer using the configured printing service. Other connections from the printer network to employee devices can remain blocked unless a documented requirement exists.

The exact rules depend on how printing is deployed. Internet Printing Protocol (IPP), raw printing, Line Printer Daemon (LPD), discovery protocols, and vendor-specific management features can use different ports and connection patterns. An administrator should confirm the services in use before writing firewall rules.

Do not assume that all printing is one-way. Discovery, status reporting, scan-to-folder features, and printer management may require additional communication. Permit only the flows the organization actually uses, and avoid broad rules that allow the entire printer VLAN to communicate freely with the business network.

This approach reduces the opportunities available to an attacker who compromises a printer. It does not make the printer invulnerable, but it can prevent that device from becoming an unrestricted route to more sensitive systems.

5. Why VLANs Need Firewall Rules

Once devices are separated into VLANs, the next step is deciding what traffic may cross between them. Without an intentional inter-VLAN policy, the network may either block legitimate business functions or permit more communication than necessary.

A useful starting policy is to deny inter-VLAN traffic by default and create explicit exceptions for required services. This is sometimes called a default-deny approach. It is not the same as blocking all network traffic: the goal is to permit documented business needs while refusing unnecessary connections.

Example policy decisions

• Guest devices may access the internet but not internal servers or network management interfaces.
• Business devices may reach approved internal applications and printing services.
• IoT devices may contact designated controllers or update services, but should not freely initiate connections to employee computers.
• Management interfaces may accept administrative connections only from approved administrator devices or a dedicated management workstation.
• Servers may accept application traffic from authorized clients rather than from every subnet.

Firewall rules should account for connection direction and state. Many firewalls automatically permit return traffic for an established connection, so a rule allowing an authorized workstation to initiate a connection to a printer may not require a separate broad rule allowing the printer to initiate arbitrary connections back to workstations.

Where feasible, keep management access separate from normal user traffic and use multifactor authentication for administrative services that support it. Strong network boundaries can be undermined if management credentials are weak or administrative interfaces are exposed to untrusted devices.

6. What Network Segmentation Cannot Prevent

Segmentation is powerful because it limits reachability, but it does not eliminate every route an attacker might use. Its effectiveness depends on the design, configuration, and security of the equipment enforcing the boundaries.

Attacks within the same segment

Devices in the same VLAN can generally communicate at Layer 2 when other controls do not prevent it. A compromised workstation may still attack another vulnerable workstation in that segment. Host firewalls, client isolation, endpoint security, and smaller or more granular segments can reduce this exposure.

Overly permissive routing rules

If a firewall permits unrestricted traffic between VLANs, segmentation may offer little protection against attacks that travel through those permitted paths. Rules must reflect actual access requirements and be reviewed when applications or network architecture change.

Misconfigured switch infrastructure

Incorrect access-port assignments, unintended trunking, exposed management interfaces, or other switch configuration errors can weaken VLAN isolation. VLAN hopping techniques have also been documented against certain vulnerable or incorrectly configured environments. Administrators should follow the switch vendor's security guidance and avoid treating VLAN boundaries as an automatic guarantee.

Compromised trusted services

A server or management system that is allowed to communicate with many segments can become a valuable target. If that system is compromised, an attacker may abuse the legitimate access it already has. Restricting service accounts, monitoring administrative activity, and protecting central infrastructure remain important.

Weak endpoint security

Network boundaries do not replace patching, secure authentication, endpoint detection, backups, or application security. Segmentation reduces the paths available to an attacker; it does not prevent every initial compromise or every attack against an allowed service.

7. A Small-Business Segmentation Plan

A practical deployment should improve security without unnecessarily interrupting daily operations. For many small businesses, a staged approach is easier to manage than attempting to redesign the entire network in one change.

1. Inventory connected devices. Record workstations, servers, printers, cameras, access points, switches, and other equipment. Identify which devices are business-critical and which are no longer supported.
2. Map communication requirements. Determine which systems need to communicate, what services they use, and which connections are unnecessary.
3. Check hardware capabilities. Confirm that the switches, access points, and router or firewall support VLANs, tagged trunk links, and the inter-VLAN controls the design requires.
4. Separate guest access first. Isolate visitor devices from internal systems and verify that the guest network cannot reach internal management interfaces.
5. Move IoT devices into a restricted segment. Test printing, camera recording, monitoring, and other required services before applying stricter restrictions.
6. Protect network management. Restrict access to router, switch, and access-point administration from ordinary user and guest networks.
7. Add narrower restrictions where justified. Consider separating sensitive servers, financial systems, or administrative workstations if their risk and operational requirements warrant it.
8. Document and review the rules. Record why each exception exists, who approved it, and when it should be reviewed.

Before making changes remotely, ensure there is a safe recovery method. A VLAN or trunk misconfiguration can disconnect administrators from the equipment they are trying to manage. Back up the current configuration and schedule disruptive changes for an appropriate maintenance window.

8. Implementation and Testing Checklist

Before deployment

• Document existing subnets, DHCP scopes, gateways, and critical services.
• Assign a clear purpose to each proposed VLAN and IP subnet.
• Confirm which switch ports should be access ports and which require trunks.
• Plan firewall rules for required cross-segment communication.
• Back up switch, router, firewall, and access-point configurations.

After deployment

• Verify that devices receive addresses from the correct DHCP scope.
• Confirm that permitted applications, printing, and monitoring still work.
• Test that guest devices cannot access internal servers or management interfaces.
• Check that IoT devices cannot initiate unnecessary connections to business systems.
• Review firewall logs for blocked traffic that indicates either an attack or a missed business requirement.
• Keep an updated record of VLAN assignments and approved exceptions.

Testing should be performed using devices and systems you own or are authorized to administer. A successful ping test alone is not enough to establish that segmentation works: ICMP may be blocked while other traffic is allowed, or vice versa. Validate the actual services and network paths the policy is intended to control.

9. Frequently Asked Questions

Does putting devices on different VLANs automatically block all communication?

It separates their Layer 2 broadcast domains, but traffic may still pass through a router or firewall. Inter-VLAN routing and filtering must be configured correctly to enforce the intended restrictions.

Is a VLAN the same as a subnet?

No. A VLAN is a Layer 2 segmentation mechanism, while an IP subnet is a Layer 3 addressing range. Many networks use one IP subnet per VLAN, but the terms describe different things and should not be used interchangeably.

Should printers and cameras be on the same VLAN?

Not necessarily. They may share a restricted equipment segment in a small environment, but separate segments can make sense when their communication requirements or security risks differ. The decision should be based on the access each device needs.

Can a VLAN stop malware from spreading?

It can block some network paths used for lateral movement, particularly when inter-VLAN rules restrict unnecessary connections. It cannot stop malware from affecting other reachable devices in the same segment or abusing services that remain permitted.

Do small businesses need enterprise-grade equipment?

Not always. Some small-business routers, firewalls, and managed switches support VLANs and inter-VLAN policies. Verify the actual features and limitations of the hardware before designing the network around them.

Conclusion

Network segmentation changes the consequences of a compromised device by limiting which other systems it can reach. VLANs create separate Layer 2 networks, while routing and firewall rules determine which connections are allowed between them. Used together, these controls can reduce unnecessary exposure and make lateral movement more difficult.

The most useful design is not necessarily the one with the largest number of VLANs. It is the one that reflects real business requirements, isolates devices that do not need broad access, protects network management, and enforces deliberate rules between security zones.

Start with clear boundaries for guest devices, business systems, and connected equipment. Test the resulting policy, document exceptions, and refine the design as the organization grows. Segmentation works best as part of a broader security program that also includes secure configuration, timely updates, strong authentication, monitoring, and reliable recovery procedures.

Key Takeaways

• Flat networks can give compromised devices unnecessary access to other systems.
• VLANs separate Layer 2 broadcast domains, but do not replace inter-VLAN firewall policies.
• Choose boundaries according to device function, communication needs, and the impact of compromise.
• Printers, cameras, and other IoT devices should receive only the network access they require.
• Guest and management traffic deserve particular attention.
• Segmentation reduces lateral movement but cannot prevent every attack or compensate for weak configuration.
• Inventory, testing, documentation, and regular rule reviews help keep segmentation effective over time.

Further Reading

• NIST SP 800-125B: Secure Virtual Network Configuration for Virtual Machine Protection — guidance on virtual network configuration and protection.
• NIST Cybersecurity Publications — security guidance covering network protection and enterprise risk management.
• Cisco VLAN Configuration Guidance — technical background on VLANs and switching configuration.
• CISA Cybersecurity Resources — practical resources for securing networks and organizational systems.