I'm an experienced computer professional but strictly amateur in networking.

At home, I have a broadband router from which I get a DHCP route to the internet via an ethernet cable.

I want to segregate my LAN network into 2 so there's a home and guest LAN. My router already provides this but guest LAN is wifi only, I want ethernet as as well as wifi for guests.

I plan on buying an Ubiquiti EdgeRouter Lite mostly to provide the VLAN capability. I will have:-

  • eth0 as WAN
  • eth1 as home LAN, unmanaged switch TP-LINK SG108 (jumbo frame compatible) connected to eth1, wireless ap, raspberry pi, printer etc
  • eth2 as guest LAN, wireless ap plugged directly into eth2

I want all DHCP to come from the edge router.

My questions are:-

  • I have an unmanaged switch which I intend to plug into eth1 to give me more ports to work with and will add a wifi AP amongst other things. Will this unmanaged switch break the VLAN function? Will my home LAN still be protected from the guest LAN or does the switch strip the VLAN information? Does the switch matter if all devices connected to the switch will be in the same home LAN?
  • I have a Raspberry Pi which I will configure to be a VPN server. Can I port forward the EdgeRouter Lite to forward to the VPN server and have the VPN users appear on the VLAN as if they'd plugged themselves into the ethernet port? I assume this is bread and butter for the EdgeRouter Lite?
  • Is it hard to get this working on the EdgeRouter Lite for a non-network professional?

Any help appreciated!


What an unmanaged switch that doesn't understand VLAN tags will do with frames which have VLAN tags (a trunk link) is really undefined. Some switches will drop the frames as garbled, some switches will pass them on as they are, and some switches will strip the VLAN tags.

A switch receiving untagged frames from two different VLANs on the same or differnet ports will think they all belong to the same LAN, and the frames can't be separated into VLANs after that. This doesn't mean that hosts with addresses in one network will have direct access to hosts in a different network.

Hosts trying to send packets to a differnet network will send the frames to their configured gateways. A host will mask both its address and the destination address to determine if the destination address is on the same network. If the destination address is on the same network, it encapsulates the packets in frames for the destination host, otherwise it encapsulates the packets in frames for its configured gateway, and the gateway is responsible for sending the packets to the other network.


You can use the unmanaged switch with an interface for one untagged (native) VLAN (access port). If you want more ports for a different VLAN, then you need another unmanaged switch to connect to the port for the other network to receive an untagged (native) VLAN. The term VLAN doesn't really make sense in this scenario since that is a term for switches to separate broadcast domains on a switch, and unmanaged switches don't do that.

  • It would be faulty if it were to drop the packets. They're still valid Ethernet packets. – Daniel B Nov 11 '16 at 16:06
  • The ethernet standard (IEEE 802.3) doesn't have VLAN tags, and many manufacturers follow that standard. There is a differnet standard (IEEE 802.1) from a different IEEE committee that added VLAN tags. It is a standard that applies to the IEEE LANs, but it is not required. For instance Wi-Fi (IEEE 802.11) doesn't use VLANs the way ethernet may because it has a different solution with SSIDs. Adding VLAN tags to Wi-Fi frames will cause the frames to be dropped. – Ron Maupin Nov 11 '16 at 16:12
  • That is not a good comparison. The VLAN tag is in the payload. It does not change anything the switch has to consider. One could also introduce a similar VLAN tag in 802.11. The 802.1q standard of course applies only to 802.3 Ethernet. The only situation where it is valid for a switch to drop the packet is a full-length tagged packet, because it will have four additional bytes. – Daniel B Nov 11 '16 at 16:29
  • The VLAN tag is inserted in the frame, not the payload. It adds four octets to the frame, and that throws the FCS four bytes later than it should be, so the last four bytes of the payload could be interpreted as the FCS. The 802.1Q standard applies to all IEEE LANs. There are instructions for how to add a VLAN tag to the different frame types. – Ron Maupin Nov 11 '16 at 16:31
  • But it isn’t. The EtherType changes. The tag itself is inside the payload, when you consider the whole thing as an Ethernet frame. – Daniel B Nov 11 '16 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.