Router LAN Ports – Purpose of Multiple LAN Ports on Routers

Wikipedia is your friend:

LAN: A local area network (LAN) is a computer network that user interconnects computers in a limited area such as a home, school, computer laboratory, or office building using network media.

In simple words, what unifies devices on one LAN: they are situated in the same area. Most commonly, one LAN is behind one router (not talking about backup routers and redundancy routers).

WAN: A wide area network (WAN) is a network that covers a broad area (i.e., any telecommunications network that links across metropolitan, regional, or national boundaries) using private or public network transports.

Again, in simple words: a WAN connection is connecting LAN's over a bigger area.

Example: LAN + internet/network + LAN = WAN (when talking about bigger area's)

There's really no reason not to put multiple subnets on the same VLAN, but there's also probably no reason to do it.

Pro:

• Allows the subnets to talk directly without a router or firewall
• Save's VLANs

Con:

• Allows the subnets to talk directly without a router or firewall
• It's messy from a documentation and troubleshooting perspective
• More broadcast traffic

We generally don't do it because of the messiness and lack of security. One VLAN = one subnet is easier to document and easier to troubleshoot and there's usually not a good reason to complicate things.

The only reason I can think of to do it is company mergers or network upgrades and for both of those I'd prefer it to be temporary.

Edit to clarify, for the hosts on different subnets but the same VLAN to talk directly you'd need to either make them their own default gateway or add a route to the "other" subnet that connects it to the interface.

In the gateway case if the host IP was 10.1.1.2 then the gateway would also be 10.1.1.2. This will cause the host to ARP for everything on or off it's subnet. This would allow it to talk to the second subnet on that VLAN but the only way it'll be able to talk to anything else is if there's a router/firewall running proxy arp that can help it out.

In the route out the interface case you'd add something like "route add -net 192.56.76.0 netmask 255.255.255.0 eth0" to the device and then 10.1.1.2 will ARP directly on eth0 when it wants to reach 192.56.76.*.