A segmented campus network, built as a physical model
This physical model shows how a campus network can be divided into separate zones using VLANs (Virtual Local Area Networks). Each zone gets its own subnet, so different groups of users and services stay isolated from one another while still sharing the same underlying infrastructure.
At a glance:
The core and the edge
Two devices make everything else in the model possible.
Core switch / router
At the centre of the model is the core device — shown as the red cylinder. It connects every zone and routes traffic between them.
Edge / firewall
The foil-wrapped round object represents the network edge — the firewall and gateway to the outside world.
Think of it like a building's front door and hallway 🚪
The edge is the front door — it decides what's allowed in or out. The core is the main hallway inside — once you're past the door, it's what connects every room (VLAN) to every other room.
User zones
Each zone below has two workstations in the model, shown as a PC tower, monitor, and keyboard.
Student VLAN
Subnet 1. Devices used by students, kept on their own subnet so their traffic can't reach staff systems directly.
🖥️🖥️ 2 workstations in the model
Subnet 2
A further user group, isolated on its own subnet and VLAN even though it shares the same physical switch as everyone else.
🖥️🖥️ 2 workstations in the model
Staff VLAN
Subnet 3. Devices used by staff, separated from student traffic so staff systems and files stay protected.
🖥️🖥️ 2 workstations in the model
Subnet 4
A further user group, each with its own subnet and VLAN so a problem in one zone doesn't spread to the others.
🖥️🖥️ 2 workstations in the model
Separating students from staff keeps student traffic away from staff systems and lets each group have its own access rules.
The server VLAN, and the DMZ around it
The server zone, shown on the yellow card, hosts the services the rest of the network depends on.
DNS server
Translates names into IP addresses, so devices can find each other by name instead of a string of numbers.
DHCP server
Hands out IP addresses automatically to devices as they join a VLAN.
Web server
Hosts websites that people — inside or outside the network — can browse to.
Email server
Handles sending and receiving mail for the organisation.
In the model, the black arch over the servers marks the DMZ. Public-facing services such as web and email sit here so outside users can reach them without getting direct access to the internal network — it's a buffer zone between the open internet and everything else.
How it all connects
The same model, laid out as a map. Tap any box to see what it does.
Start anywhere
Tap any device or zone in the diagram above — edge, core, a VLAN, or the servers — to see what it does.
Why bother segmenting the network?
Security
A problem in one VLAN is contained instead of spreading everywhere.
Performance
Broadcast traffic stays within each zone instead of flooding the whole network.
Control
Policies can be set per group, such as who can reach the servers.
Scalability
New zones can be added without redesigning the whole network.
The photos of the physical model don't label the red core device, the foil-wrapped edge object, or exactly which servers sit in the DMZ — and VLANs 20 and 40 have no zone names. This page describes the most likely design based on the model's layout. Adjust any of these details to match the actual plan, and add IP ranges for each subnet if you'd like them shown here too.