Install Quick Surf Network
Tap the Share icon
then Add to Home Screen to use QSN like an app.
Tagged, untagged, trunk, access — four words that stop most people reading. They describe something simple: how one cable can carry several separate networks without letting them mix. Here's the whole idea, without the jargon.
In short: an access port is where the network ends and a device begins — a laptop, a printer, a camera, a games console. It belongs to exactly one VLAN, and it hands over plain, unlabelled traffic, so the device never needs to know VLANs exist. A trunk port is where the network keeps going — switch to switch, switch to router, switch to an access point broadcasting several WiFi networks. It carries many VLANs at once, so every frame needs a label saying which one it belongs to. That label is the tag. Tagged means labelled; untagged means plain.
The reason any of this exists is that running separate cables for every separate network would be absurd. If you wanted the office PCs, the phones, the CCTV and the guest WiFi kept apart, the old way was four physical networks — four sets of cables, four switches, four times the cost. VLANs let one physical network behave as many logical ones, and the tag is what keeps them from being confused with each other.
Everything else in this guide is detail on those two sentences: what the tag actually looks like, where it gets added and removed, what you gain by splitting a network up, and why this matters just as much in a three-bedroom villa as in a corporate headquarters.
Forget the acronym. A VLAN is a lane marking painted onto a road you already own.
On a normal home or small-office network, everything is on one flat network: your laptop, the smart TV, the doorbell camera, the guest who came for dinner, the cheap smart plug you bought online. They can all see each other. Most of the time that is harmless, and it is why flat networks are the default — they need no thought at all.
The problem is what happens when one of those things is untrustworthy. The weakest device on a flat network sets the security level of everything on it. A budget IP camera running firmware that was last updated three years ago sits on the same network as the laptop with your bank details. A guest's phone, carrying whatever it picked up elsewhere, joins the same network as your NAS. Nothing has to be dramatic for this to matter: it is simply an unnecessary risk that costs nothing to remove.
A VLAN removes it by painting lanes. The cables don't change. The switch doesn't change. What changes is that the switch now refuses to carry traffic from the camera lane into the laptop lane. Devices in different VLANs cannot talk to each other at all unless a router or firewall is explicitly told to allow it — and that "explicitly told" is the entire point. Access becomes something you grant deliberately, rather than something that exists by accident.
The second benefit is quieter but just as real: broadcast noise. Devices constantly shout to the whole network looking for each other — printers announcing themselves, TVs hunting for casting targets, apps scanning for smart devices. On a flat network with a hundred devices, every one of those shouts reaches every device. Split into lanes, each shout only reaches its own lane. On a busy network you feel this as a general improvement in responsiveness that is hard to attribute to anything specific.
This is the mechanism the whole subject rests on, and it is genuinely small.
An ordinary Ethernet frame has no idea which VLAN it belongs to. It has a destination, a source, a type, the data itself and a checksum. That's it. To make VLANs work, the standard called IEEE 802.1Q inserts a small label into the frame — four bytes, sitting just after the sender's address.
Those four bytes carry a fixed marker value of 0x8100 that says "a tag follows", three bits of priority (which is how voice traffic gets to jump the queue ahead of a file download), one bit marking the frame as droppable if things get congested, and — the part that matters most — twelve bits holding the VLAN ID. Twelve bits gives 4,096 possible values, of which 0 and 4095 are reserved, leaving 1 to 4094 usable. That is the number that decides which lane the frame is in.
Adding four bytes grows the maximum frame from 1518 to 1522 bytes. Worth knowing, because very old equipment occasionally objects to the larger frame and drops it silently — one of those faults that looks mysterious until you know to look for it.
The clearest way to understand access and trunk is to watch a single frame make the trip.
A PC on VLAN 20 sends completely ordinary traffic. It has no VLAN settings and needs none. The switch port it is plugged into is an access port assigned to VLAN 20, so the switch stamps a tag saying "20" onto every frame as it comes in. That frame then crosses the trunk to the next switch, sharing the cable with tagged traffic from VLANs 10 and 30, each one labelled and therefore unmixable. At the far end, the receiving switch reads the tag, sends the frame out of a port belonging to VLAN 20, and strips the label off on the way out. The receiving PC gets plain, ordinary traffic — exactly as if the two machines were plugged into the same small switch.
This is why a "VLAN-capable" printer or camera is almost never necessary. The intelligence lives in the switch, not the device. The only equipment that genuinely needs to understand tags is equipment sitting on a trunk: another switch, a router or firewall, and access points broadcasting several WiFi networks at once — a staff SSID on VLAN 20, a guest SSID on VLAN 30, all down one cable.
Every port on a managed switch is one or the other. Getting it wrong is the single most common cause of "it works over here but not over there".
| Dimension | Access Port | Trunk Port |
|---|---|---|
| Carries | Exactly one VLAN | Many VLANs at once |
| Tagging | None — traffic leaves plain and untagged | An 802.1Q tag on every frame |
| Plugs into | Laptop, PC, printer, IP phone, camera, TV, console | Another switch, a router or firewall, or an access point serving several SSIDs |
| Does the device need configuring? | No — it sees an ordinary network | Yes — both ends must agree on the VLAN list |
| How many on a typical switch | Most ports | Usually just the uplinks — often one or two |
| Symptom when set wrong | Trunk where access belongs: usually nothing works at all | Access where trunk belongs: one VLAN works, the rest silently vanish |
| Typical wording in the interface | "Access", "Untagged", "PVID" | "Trunk", "Tagged", "Allowed VLANs" |
| Think of it as | A letterbox on one door — everything inside belongs to that flat | The delivery van for the whole building — every parcel needs a label |
Vendors use different words for the same thing. Ubiquiti UniFi and TP-Link Omada tend to say "native VLAN" and "tagged networks" rather than access and trunk; MikroTik and Cisco use tagged/untagged and access/trunk directly. The concept underneath is identical.
Splitting the network is not busywork. Each lane buys you something specific.
The same four lanes serve a villa, a café, a clinic and a gaming setup. Only the labels change.
If your network is a router, two laptops and a phone, VLANs are overhead with no payoff — and we will tell you that rather than sell you a managed switch. The threshold is not size, it's mixture. The moment you have devices you don't fully trust sitting alongside devices that matter — a dozen smart-home gadgets, cameras, a guest network people actually use, a NAS with everything on it, a payment terminal — segmentation starts earning its keep.
What it costs is a managed switch and an access point that supports multiple SSIDs, which for most homes and small offices is the equipment you would sensibly buy anyway. What it does not require is a rewire: VLANs run over the cabling you already have. If the cabling itself is the problem, that's a different question — our wired vs wireless guide covers it.
Every one of these produces a fault that looks like something else entirely.
The questions people ask once they realise this is simpler than it sounded.
We design the segmentation around how you actually use the place — then configure the switches, access points and firewall rules so it holds. Whether that's four lanes in a villa or thirty across a building, the principle is the same.