Separating with VLANs: one cable, several networks, and where the tag sits

If everything sits on one flat network, every machine can see every machine. The day one of them is compromised, what it sees is that same list. That is the point of separation: to decide in advance how far a bad day can reach.

What a VLAN is

It is a way to carry several networks that know nothing of each other over one physical cable. A small tag is put on each packet, and the switch that recognises the tags carries these networks without mixing them. There is one cable and more than one network.

Where the tag is applied

This is the most confusing part. The tag can be applied in two places: on the virtual machine's network interface, meaning the server tags the packet, or inside the machine, meaning the operating system tags its own. Both work. Never do both at once, because a double tag turns into something unexpected and where it broke stays unclear for days.

As a rule, tagging on the server side is cleaner: the inside of the machine stays plain, and when you move the machine the setting travels with it.

Is the bridge allowed to carry tags

A bridge has to be told separately that it will carry tagged traffic. If it has not been told, the tags are either dropped or ignored, and that happens silently. The same pattern once more: no error message, just no traffic.

Is the port above passing them through

The physical switch port the server is attached to has to be configured to allow the tags that will pass. If the port permits only one network, that one works and the others vanish. Even a flawless server side gives the same result, because that link of the chain is not on your machine.

Separating is not blocking

Two VLANs are separate until there is a router between them, and usually there is. Putting things on separate networks does not by itself mean "they cannot see each other"; if you want them genuinely unable to, you need a rule where the routing happens. When this distinction is skipped, people believe they have separated things when all they have done is number them.

Draw first, then assign numbers

Draw once which machine should never talk to which. VLAN numbers handed out without that drawing become a maze nobody remembers six months later. Separation is not a numbering job, it is a decision job.

What Atlas does

Atlas shows the network layout together with the physical ports, bridges and addresses in one place, so you follow where the tag sits in the chain by looking. The advanced side of network definitions, the zone and virtual network definitions, it shows read only on purpose: a wrong definition there affects not one machine but the whole cluster, so Atlas shows it without editing it. Changes you make to the network configuration are protected by a rollback countdown, so an experiment with a tag does not leave you locked out.