Network segmentation, VLAN and ACL/firewall rules

• Network segmentation = the overall concept of dividing a network into separate sections to improve security and control.
• VLAN (Virtual LAN) = one technology used to create those separate sections logically on the same physical network.
• ACLs/firewall rules = can control what traffic is allowed between those segments.

Example

Imagine a company has:

• VLAN 10 → Employees
• VLAN 20 → Servers
• VLAN 30 → Guest Wi-Fi
• VLAN 40 → Security cameras

These VLANs segment the network. You can then use routing/firewall rules or ACLs to decide, for example, that Guest Wi-Fi can access the internet but cannot access the server VLAN.

So a good way to remember it is:

VLANs can provide network segmentation, but network segmentation isn’t limited to VLANs.

We can also segment networks using physical networks, subnets, firewalls, ACLs, VRFs, and other technologies.

• Physical segmentation: Separate switches, routers, cabling, etc. for different networks. There’s a physical barrier between them.
• VLAN segmentation: The same physical infrastructure can carry multiple logically separated networks.
• Hybrid: Use VLANs for normal segmentation and firewalls/ACLs to strictly control traffic between them.

Why physical segmentation can be attractive

If you have a highly sensitive network, putting it on completely separate physical infrastructure can reduce the ways an attacker can move between networks. For example:

Internet
   |
Firewall
   |
   +---- Corporate network
   |
   +---- Separate physical network
          |
          +---- Critical systems

However, physical networks are more expensive and harder to manage.

We need additional switches, cables, network interfaces, potentially routers/firewalls, and so on.

VLANs are often preferred when we need to segment many networks because you can achieve substantial isolation without maintaining completely separate hardware.

So:

Physical segmentation can provide stronger isolation, especially for highly sensitive systems, while VLANs provide a more flexible and cost-effective way to segment networks.