I have the following setup:

Internet -> Modem/Router ( -> Switch (TL-SG105E) -> WiFi Router -> Any other network device

Note: Switch spans to a passive IDS

My WiFi Router does not support a guest network but I have a bunch of old WiFi routers that I figured I can use it to place all IoT devices on a different network.

The switch supports VLAN 802.1Q I am just not sure if with my current setup I can setup two VLANs that both share a common port (the edge router's port), e.g.,: VLAN 1 - 1,2,3,5 VLAN 2 - 1,4

This way ARP requests and effectively MAC packets from port 4 (the IoT VLAN) will never see the other ports except for the edge router.

Is this possible? If not, what else do I need to make this work?


802.1Q VLANs can use tagging when sharing a port (VLAN trunk). One of the VLANs can remain untagged (sometimes called the native VLAN), all others need to be tagged.

E.g. if you configure switch port 1 as VLAN 1 untagged and port 2 as VLAN 2 untagged, you can trunk both VLANs to a router using a single port, with both VLANs tagged or one of them untagged and the other tagged. The router needs to support 802.1Q and requires appropriate configuration to match the switch's trunk setup.

If the router doesn't support 802.1Q VLANs you could use a dedicated router on a second port. Without trunking you're using port-based VLANs with each VLAN representing a separate, logical switch.

Of course, 802.1Q VLANs can also be used between switches. You could configure a guest VLAN port on your living room switch, trunk your normal VLAN and the guest VLAN to a basement switch, and then fan out the VLANs to two routers.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.