You can segregate a physical network/broadcast domain into multiple subnets/broadcast domains using VLAN-enabled switches (not hubs).
Virtual LAN is a layer 2 technology that is supported by IEEE 802.1Q. It adds a tag into the ethernet frame that defines the VLAN ID of the packet. You will need some kind of a layer 3 switch/router for the VLANs to communicate with each other.
A common network design for VLANs is called router-on-a-stick.
The router interface which the switch is connected to via trunking can be divided into many sub-interfaces, with each sub-interface serving as the default gateway of a VLAN. The router then treats each sub-interface as an individual interface for routing and access-control purposes.
For example, if you have VLANs 2, 3 and 4, the router interface can be configured to have interfaces