You can think of VLANs as segmenting a switch into multiple networks. Each port could belong to a different VLAN. Contrary to what some believe, VLANs should not be a security mechanism. The bridge table can be flooded and switch can start to act like a hub, breaking the VLAN broadcast segmentation.

A router is required if an ARP request goes unanswered. That means the host is not on your local network.  So in order to connect multiple VLANs:

  1. You can connect a port from each VLAN to a router and set up the routes.
  2. You can use virtual interfaces in each VLAN. Layer 3 switches.
  3. With 802.1q you can tag frames with VLAN identifiers.  This enables you to connect multiple switches to the same VLAN.
    1. Tag Protocol Identifier (TPID)
    2. Tag Control Information (TCI)
    3. Truck ports