VLAN vs subnet: what's the difference?
Two terms that get mixed up constantly. Here is what each one actually controls, and why you usually need both.
A VLAN and a subnet often get treated as the same thing, because they usually appear together. They are not the same thing. One is about wiring. The other is about addresses.
What a VLAN actually separates
A network switch is the box with lots of cable ports that your devices plug into. Normally, everything plugged into one switch can talk to everything else plugged into it.
A VLAN changes that. It lets one physical switch behave like several separate switches, even though the cables and hardware are shared. A camera plugged into port 3 and a laptop plugged into port 4 can be placed on different VLANs, and then neither device can see the other, even though both cables run into the exact same box.
VLANs are a wiring-level idea. They decide which group a device's traffic belongs to before that traffic goes anywhere near an address.
What a subnet actually separates
A subnet is a block of IP addresses that belong together, the way houses on the same street share a postcode. A typical home network might use 192.168.1.1 through 192.168.1.254 as one subnet.
Devices in the same subnet can normally reach each other directly, address to address, with no extra hop. Devices in different subnets need a router in between to pass traffic across, even if they are plugged into the exact same cable.
A subnet is an addressing-level idea. It has nothing to do with cables or switches by itself. Two devices in different subnets can sit in the same room, on the same switch, and still not be able to reach each other without a router deciding to let them.
Why the two get confused
In almost every real network, a VLAN and a subnet are set up as a pair. Each VLAN gets its own subnet. Guest Wi-Fi might be VLAN 20 with the subnet 192.168.20.0. Security cameras might be VLAN 30 with the subnet 192.168.30.0.
Because they always travel together in practice, people start using the words interchangeably. But you can have one without the other, and knowing the difference helps when something does not work the way you expect.
- Same VLAN, different subnet: devices are on the same wiring group but cannot talk directly, because their addresses are not compatible.
- Different VLAN, same subnet: this is rarely useful and usually a configuration mistake, since the VLAN separation is defeated by addresses that overlap.
- Same VLAN and same subnet: the normal, working setup for one group of devices.
How they work together in practice
Think of it this way. The VLAN decides which lane a device drives in. The subnet is the street address printed on the device. You generally want both to line up: a device in the guest lane should have a guest address, so the two systems reinforce each other instead of fighting.
This pairing is exactly how DHCP, the service that hands out addresses automatically, is normally configured. Each VLAN gets its own DHCP range, so any device plugged into the guest VLAN is automatically handed a guest-subnet address, with no one having to set it by hand.
Two mistakes that cause real problems
Most VLAN and subnet problems trace back to one of two mistakes, and both are easy to avoid once you know to look for them.
The first is reusing the same subnet on two different VLANs. It looks harmless on paper, but devices on both VLANs end up thinking they share a street, and traffic gets confused about where to go. Each VLAN needs its own, separate address range.
The second is forgetting that separate VLANs need a router to talk to each other at all, even when that is exactly what you want. A guest network and a staff network on separate VLANs will not reach each other by default, which is usually correct. But if you do want one narrow exception, like a printer that both groups should reach, a firewall rule has to allow that one path deliberately. It will not happen on its own.
Setting both up together
Firecradle creates a VLAN and its matching subnet as one step, not two separate ones. You name the group, guest Wi-Fi, cameras, staff laptops, and Firecradle handles the VLAN tag and the address range together, including firewall rules that keep the groups apart by default.