VLANs, Switching, and Routing for Yachts

This article applies to yachts using managed switches, VLANs, routed interfaces, firewalls, Wi-Fi SSID mapping, AV/control networks, CCTV, owner office, crew networks, guest networks, or infrastructure management networks.

Applicability depends on switch vendor, firewall design, cabling, support capability, and whether networks touch bridge-adjacent, security, or OT systems.

• VLANs separate broadcast domains, but firewall rules enforce operational boundaries.
• Access ports serve end devices; trunks carry multiple VLANs between infrastructure devices.
• Inter-VLAN routing should be intentional and documented.
• Cisco-style examples are useful, but must be adapted to the actual platform and support model.

A VLAN is a way to divide one physical switching system into separate logical networks. Guest Wi-Fi, crew devices, owner office, AV, CCTV, and management devices may share switch hardware but live in different VLANs.

That helps keep traffic organised. It does not automatically make the yacht secure. If routing allows every VLAN to reach every other VLAN, the separation is mostly cosmetic.

The practical yacht question is: which VLANs exist, what are they for, and what traffic is allowed between them?

An access port usually carries one VLAN to an end device. A guest cabin TV might be on an AV VLAN. A printer might be on an admin VLAN. An access point management port might use one native or management VLAN while mapping SSIDs to other VLANs.

A trunk port carries multiple VLANs, usually between switches, firewalls, routers, or wireless controllers. Trunks need careful control. Allow only the VLANs required. An overly broad trunk can extend risk across the yacht.

Routing moves traffic between networks. On many yachts, inter-VLAN routing should happen at the firewall or a layer-3 core with firewall policy applied. That allows rules such as:

• guest VLAN to internet only,
• crew welfare to internet and selected services,
• owner office to printer and file services,
• AV control to media servers only,
• CCTV to NVR and management station,
• management VLAN to infrastructure devices,
• OT to approved monitoring gateway only.

Do not route OT, bridge-adjacent, or security networks casually for convenience.

These examples are simplified and not a build sheet.

```text vlan 20 name GUEST_WIFI vlan 30 name CREW_ADMIN vlan 40 name AV_CONTROL vlan 90 name NETWORK_MGMT ```

Access port example:

```text interface GigabitEthernet1/0/10 description Guest cabin access point switchport mode access switchport access vlan 20 spanning-tree portfast ```

Trunk example:

```text interface GigabitEthernet1/0/48 description Uplink to firewall switchport mode trunk switchport trunk allowed vlan 20,30,40,90 ```

Management interface example:

```text interface vlan 90 description Switch management ip address 10.90.0.10 255.255.255.0 ```

Before using examples like these, confirm platform syntax, spanning-tree design, native VLAN policy, management access, backups, and rollback.

A guest plugs a laptop into an unlabelled socket in a salon cabinet. The port was left in the management VLAN after commissioning. The laptop can browse switch and access-point interfaces.

The fix is not only changing that port. The yacht needs labelled outlets, default disabled or guest ports, management VLAN restrictions, and a port audit.

• List every VLAN name, ID, subnet, and purpose.
• Map each Wi-Fi SSID to its VLAN.
• Confirm trunk allowed VLANs.
• Check unused ports are disabled or assigned safely.
• Confirm management interfaces are reachable only from admin networks.
• Review firewall rules between VLANs.
• Back up switch and firewall configurations.