ZDNET60%
How a virtual LAN can better protect your home network - and the best way to get started 54%
By Jack Wallen59%
7/19/2026, 10:00:43 AM
BS Summary: This article contains 36 faulty reasoning types, including Hasty Generalization, Biased Writer Voice, and Attempt to Sell a Product or Service, with Optimism Bias as the most egregious example at 22.1% saturation with 242 hits. Analysis detected 2,480 faulty-reasoning hits from 1,097 analyzed words, generating a BS Score of 53% and a BS Rank of 54% (8,688 of 18,798 articles). This article is worse (more manipulative) than 53.80% of the article peer group.
Picture this scenario: You have one local area network (LAN) at home.
On that network, you have your desktops, laptops, tablets, phones, and IoT devices, such as thermostats, smart TVs, speakers, and more.
Your IoT devices can see other devices and vice versa.
Even though the IoT devices have considerably less security than your desktops and laptops, they are allowed to connect to the same network.
Also: The best VPN routers: Expert tested and reviewed
Then, one fateful day, an IoT device is hacked.
Malware is injected into the device, which then spreads to your desktops and laptops.
Next thing you know, a hacker has your bank account information and is stealing your money.
All of this happened because an insecure thermostat had access to your desktop PC.
But what if you could avoid that scenario?
You can, thanks to VLANs.
What is a VLAN?
VLAN stands for virtual local area network.
Without getting too deep into the muck and mire of network terminology, a virtual LAN is like a secondary network within your LAN that's isolated from the rest of your network.
Your primary LAN might have an address scheme like 192.168.1.x, and your VLAN might have an address scheme like 192.168.2.x.
The significant thing about this setup is that, because of the address scheme, the VLAN cannot directly access the LAN.
That separation is important because it isolates the devices.
Let's use our example above and name our networks LAN1 and LAN2 (LAN1 being the primary LAN and LAN2 being the VLAN).
Also: What is MoCA 2.5?
How this low-cost networking can replace Wi-Fi and fix dead zones
On LAN1, you connect your desktops, laptops, tablets, and phones.
On LAN2, you connect all of your IoT devices.
If an IoT device is hacked, since it's isolated on LAN2, the only devices it can access are those on the same LAN, which means your desktops, laptops, tablets, and phones are safe (more on this separation later).
You could take this approach one step further and create two VLANs -- one for phones and tablets and one for IoT devices, so your network structure would be:
LAN: Desktops and laptops (you could also add printers to this setup)
VLAN1: Phones and tablets
VLAN2: IoT devices
You could even configure the LAN to access everything on its network, as well as everything on VLAN1 and VLAN2, but VLAN1 and VLAN2 cannot access devices on the LAN.
If you have the right networking hardware, you could even set up VLAN2 so that no devices can communicate with one another and have access only to the outside world (or the wide area network, WAN).
This step could be important because it would prevent one IoT device from causing problems with another.
Another option would be to create a third VLAN for your children's devices.
You could also create VLAN3, which includes added parental controls that would limit the websites your children can reach, but wouldn't affect devices on the primary LAN.
Also: Slow home internet?
Here are 3 things I always check first to regain fast Wi-Fi speeds
In fact, you could take this approach even further by creating a fourth VLAN for guests and a fifth for working from home (that network might be routed through a VPN).
As you can see, the number of VLANs you create increases the complexity.
The important thing is knowing the devices on your network and how to isolate them.
How to create VLANs
This is where things get quite complicated, as every networking router/modem/switch is different.
How you create a VLAN depends on your specific hardware.
Also: Sick of online ads and trackers?
How I block them across my entire home network
For instance, my network provider (Spectrum) doesn't allow VLANs to be created via its hardware.
In fact, most ISPs don't support VLANs on their own hardware.
That leaves me with two options:
Deploy a Linux distribution, such as OPNsense or IPFire, that can act as a router.
Purchase a third-party router.
Since the first option can get a bit complicated for most people, I recommend purchasing a third-party router.
Here are a few models that support VLANs:
TP-Link ER605 V2 Gigabit VPN Router
PW-AX1800 WiFi 6 Dual-Band Router with VLAN Support
TP-Link BE6500 Dual-Band WiFi 7 Router (BE400)
NETGEAR Nighthawk WiFi 7 Router (BE9300)
ASUS RT-BE88U WiFi 7 Router
If you don't purchase one of the above routers, make sure the router you do choose supports VLANs.
Using a third-party router lets you set up several VLANs, but you'll want to read the router's documentation to learn how, since each router's setup will differ.
If you're lucky and your ISP's router/modem supports VLANs (again, most don't), chances are they'll be pre-configured in the router/modem's web UI as guest networks, mobile devices, streaming devices, etc.
A bonus reason to go with a third-party router (especially a wireless one) is that you can buy one with a larger range than you already have.
Naming your VLANs
Although I mentioned creating VLAN1, VLAN2, VLAN3, etc., you could instead create VLANs with a naming scheme, such as IoT, Mobile, Kids, and Guests -- but I recommend against it.
The problem with that naming convention is it makes everything a bit too obvious.
If a bad actor happens to be wardriving around your neighborhood and spots a wireless VLAN named IoT (if it's visible to the WAN), they could connect with an insecure device and (if they have the skills) do bad things.
Because of that risk, I recommend using VLAN names that obfuscate their purposes.
Are VLANs foolproof?
No.
As I've said many times, if a device is connected to a network, it's vulnerable.
Still, setting up VLANs is more secure than slapping everything on a single network.
However, there's a thing called VLAN hopping, which allows a hacker to exploit misconfigured switch ports or VLAN-tagging mechanisms to hop from a VLAN to a primary LAN (or from VLAN to VLAN).
By taking that approach, attackers could gain unauthorized access to any device on your network.
Therefore, it's important to ensure your VLANs are configured correctly (according to the hardware in use), that your router firmware is up to date, and that the devices on every network have both updated operating systems and software.
Although VLANs aren't a perfect solution to security challenges, they're a great way to isolate hardware to prevent less secure devices, such as IoT tools, from accessing machines that contain sensitive information.
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.