VLAN vs subnet: what is the difference?
A VLAN and a subnet solve related problems at different layers. A VLAN separates traffic at layer 2 (switching); a subnet separates addresses at layer 3 (routing). They are usually mapped one-to-one, but they are not the same thing.
Last reviewed:
Looking for the complete table instead? Every prefix from /0 to /32, with mask, wildcard and host count, is on the CIDR reference.
The core difference
A VLAN (Virtual LAN) is a way to make one physical switch behave like several separate switches. Ports in different VLANs cannot see each other's broadcast traffic, even on the same hardware. It is a layer-2 concept: it works with MAC addresses and frames.
A subnet is a layer-3 concept: it is a range of IP addresses with a shared prefix. Hosts in different subnets need a router to communicate. Where a VLAN separates broadcast domains, a subnet separates address space.
VLAN and subnet side by side
The two are easiest to keep apart by asking what each one would look like if it broke. Cut the VLAN and two machines on the same switch stop hearing each other's broadcasts. Cut the subnet and two machines still hear each other but no longer believe they are on the same network, so they send everything to the gateway.
| Property | VLAN | Subnet |
|---|---|---|
| Layer | Layer 2, data link | Layer 3, network |
| What it separates | Broadcast domains, in frames | Address space, in packets |
| Addressed by | MAC address | IP address and prefix |
| Configured on | Switch ports and trunks | Router or host interfaces, and DHCP |
| Defined by | IEEE 802.1Q, a 12-bit tag in the frame | A prefix length applied to an address |
| Range | VLAN IDs 1 to 4094 | Any prefix from /0 to /32 |
| Crossing it needs | A trunk, or a router between VLANs | A router, always |
| Failure mode | Traffic leaks between segments, or a port is stranded | Hosts cannot reach each other, or the gateway is wrong |
The 12-bit VLAN tag is why the ceiling is 4094 rather than 4096: IDs 0 and 4095 are reserved.
A worked example: router on a stick
The classic setup that shows both at once. One switch, one router, one physical cable between them, and two segments that must not see each other's traffic: staff on VLAN 10 and guest Wi-Fi on VLAN 20.
The switch tags frames from the staff ports with VLAN 10 and frames from the guest ports with VLAN 20, then sends both down the same trunk to the router. The router has one physical interface split into two subinterfaces, each holding the gateway address for one subnet. A packet from staff to guest leaves the switch tagged 10, arrives at the router, is routed to the other subinterface, and comes back tagged 20. It has crossed both the VLAN boundary and the subnet boundary, in one hop, on one cable.
The point is that neither mechanism could do the job alone. Without the VLANs the two groups would share a broadcast domain. Without the separate subnets the router would have nothing to route between, because every host would think its neighbour was local.
| VLAN | Subnet | Gateway | Usable hosts | Purpose |
|---|---|---|---|---|
| 10 | 192.0.2.0/24 | 192.0.2.1 | 254 | Staff devices |
| 20 | 198.51.100.0/25 | 198.51.100.1 | 126 | Guest Wi-Fi |
Both ranges are documentation space under RFC 5737, so this configuration can be copied into a lab without colliding with anything real.
The router side, in the Cisco IOS syntax most people meet this in:
interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ip address 192.0.2.1 255.255.255.0 ! interface GigabitEthernet0/0.20 encapsulation dot1Q 20 ip address 198.51.100.1 255.255.255.128
Why they usually go together
In most designs, each VLAN maps to exactly one subnet. VLAN 10 might be 192.0.2.0/24, VLAN 20 might be 198.51.100.0/24. This pairing is clean: the VLAN keeps the traffic separate at layer 2, and the subnet gives that segment its own address range at layer 3, with a router interface as the gateway between them.
Keeping the mapping one-to-one makes the network easier to reason about. When you see VLAN 20, you know it is 198.51.100.0/24, and vice versa.
When they do not line up
You can run multiple subnets on one VLAN (secondary addressing) or, less commonly, stretch a subnet across VLANs with bridging. Both are edge cases that add complexity and are usually avoided. The takeaway: a VLAN is about isolating traffic, a subnet is about organising addresses, and good designs keep them aligned.
Frequently asked questions
Is a VLAN the same as a subnet?
No. A VLAN is a layer-2 broadcast domain; a subnet is a layer-3 address range. They are usually paired one-to-one, but they operate at different layers.
Can one VLAN have two subnets?
Yes, using secondary addressing, but it is uncommon and adds complexity. Most designs keep a single subnet per VLAN.
Do different subnets need different VLANs?
Not strictly, but pairing each subnet with its own VLAN is the standard, clean approach. It keeps broadcast domains and address ranges aligned.
Sources
Everything technical on this page is checkable against the documents below. Where a document and common practice disagree, the guide says so rather than picking one quietly.
- IEEE 802.1Q: the VLAN tagging standard
- RFC 4632: Classless Inter-domain Routing (CIDR)
- RFC 5517: Cisco Systems' Private VLANs, for the cases where the one-to-one mapping breaks
Spotted something wrong? Tell us and it gets corrected. How the data is maintained is described on the about page.