Technical guide

VLAN vs Subnet: How VLANs, Subnets, and Trunks Actually Work Together

By Subnetica · Published August 24, 2026 · Updated August 24, 2026

A VLAN is a Layer 2 segmentation decision. A subnet is a Layer 3 addressing and routing decision. They are commonly designed together—VLAN 10 with 192.168.10.0/24, for example—but they are not two names for the same thing.

The two boundaries

A VLAN creates a separate Ethernet broadcast domain. Switches learn source MAC addresses and forward frames within that VLAN; a broadcast in VLAN 10 does not normally enter VLAN 20. A subnet defines which IP destinations a host considers on-link and which destinations it sends to a router. One is primarily Layer 2; the other is Layer 3.

One VLAN commonly maps to one IP subnet because that makes broadcast and routing boundaries line up cleanly. It is a design convention, not a law of physics. A subnet can be extended across Layer 2, and a VLAN can carry multiple subnets, but those designs need deliberate handling.

Access ports and trunks

An access port normally connects an endpoint to one VLAN. The endpoint sends ordinary Ethernet frames; the switch associates them with the configured access VLAN. A trunk carries multiple VLANs between network devices. With 802.1Q, the sending switch inserts a VLAN tag for frames crossing the trunk, and the receiving switch uses it to preserve VLAN identity.

“Native VLAN” usually describes the VLAN whose frames are sent or accepted untagged on a trunk. Exact terms and allowed-VLAN behavior vary by vendor. A native VLAN mismatch can cause warnings, leakage, or confusing partial connectivity, so compare both ends.

# Cisco-style
show vlan brief
show interfaces switchport
show interfaces trunk
show mac address-table

# Linux bridge VLAN-aware inspection
bridge vlan show
bridge link
ip -d link show

Trace traffic through the design

Two hosts in the same VLAN

Host A at 192.168.10.10/24 decides that 192.168.10.20 is on-link. It ARPs for the destination MAC and the switch forwards within VLAN 10. No router is needed.

Two hosts in different VLANs

Host A decides that 192.168.20.20 is outside its local /24. It ARPs for 192.168.10.1 and sends a frame to the gateway. The router removes that Layer 2 header, looks up the destination, and emits a new frame into VLAN 20.

A frame crosses a trunk

If the frame is in VLAN 10, the first switch tags it for the trunk. The next switch checks whether VLAN 10 is allowed, learns the source MAC in VLAN 10, and forwards it. The tag is removed when the frame exits to an untagged access endpoint.

Router-on-a-stick and SVIs

In router-on-a-stick, one router interface has subinterfaces such as G0/0.10 and G0/0.20. The switch port facing it is a trunk, and each subinterface supplies a gateway. An L3 switch instead commonly uses SVIs such as interface vlan 10 as gateways. In both designs, inter-VLAN routing must exist and the host gateway must be in the correct subnet.

When the design almost works

• Wrong access VLAN: the host is in a different broadcast domain than its address plan says.
• VLAN missing from a trunk: same-VLAN hosts work on one switch but fail across switches.
• Native VLAN mismatch: untagged traffic is classified differently at each end.
• Wrong subnet or gateway: the host sends traffic locally when it should route, or routes to an unreachable gateway.
• Inter-VLAN routing missing: both VLANs look healthy at Layer 2, but traffic stops at the gateway.

Compare a working and failing host with their actual IP/prefix, gateway, VLAN membership, MAC table entry, and trunk allowance. The subnetting mistakes guide covers why endpoints can disagree about what is local; the route-selection guide explains what happens after a packet reaches Layer 3.

Practice the boundary

Start with Subnetica’s Switching and VLANs topic, then use the Subnetting and Routing topics to connect the layers. You can also practice with the published VLAN basics lab and inter-VLAN routing lab.