Why a Router Is Needed for Inter‑VLAN Communication (Layer 3 vs Layer 2)
Understanding why switches alone cannot route between VLANs
When building a network, VLANs are a powerful tool. They segment a physical switch into multiple logical networks, improving security and reducing broadcast traffic. But there is a catch: devices in different VLANs cannot communicate with each other using only a Layer 2 switch. This is where a router becomes essential.
The Limitation of Layer 2 Switches
A standard Layer 2 switch forwards frames based on MAC addresses. It does not understand IP addresses or routing. Each VLAN is its own broadcast domain. Frames from VLAN 10 will never cross into VLAN 20 unless a router intervenes.
In other words, a switch keeps VLANs isolated by design. That is great for security, but it also means that a PC in VLAN 10 cannot ping a PC in VLAN 20 without help.
The Router’s Role: Layer 3 Routing
A router operates at Layer 3 (the network layer). It makes forwarding decisions based on IP addresses, not MAC addresses. When a device sends a packet to an IP address in a different VLAN, the router:
- Receives the packet on one interface (or subinterface)
- Looks up the destination network in its routing table
- Forwards the packet out the correct interface toward the destination VLAN
This process is called inter‑VLAN routing.
Router‑on‑a‑Stick: One Interface, Many VLANs
In many small to medium networks, you do not need a separate physical router port for every VLAN. Instead, you can use router‑on‑a‑stick. A single router interface is divided into logical subinterfaces, each tagged with a different VLAN ID (802.1Q encapsulation).
Get Brian Joshua Elimu’s stories in your inbox
Join Medium for free to get updates from this writer.
Each subinterface acts as the default gateway for its VLAN. The switch connects via a trunk port carrying all VLANs. The router then routes between the subinterfaces.
This is exactly what we configured in our networking lab. The router’s physical port connected to the switch as a trunk, and subinterfaces were created for each VLAN (e.g., VLAN 10, VLAN 20). Each subinterface had its own IP address — the default gateway for that VLAN.
Layer 2 vs Layer 3: A Simple Comparison
Without a router, VLANs would be completely isolated islands. With a router, they become connected networks that can communicate securely and efficiently.
Practical Takeaway
If you are designing a network with VLANs, remember: the switch segments, the router connects. Whether you use a dedicated router interface per VLAN or a router‑on‑a‑stick, inter‑VLAN communication requires Layer 3 routing.
Next time you ping across VLANs, thank the router.
