Two VLANs
A VLAN (virtual LAN) splits one switch into separate LANs. The PC's port is in VLAN 10, the printer's in VLAN 20. The switch never passes a frame from one VLAN to the other.
The PC (192.168.10.10) wants to print on 192.168.20.20. The mask 255.255.255.0 gives 192.168.10.0 for the PC and 192.168.20.0 for the printer. Different subnets, so it must go through the gateway, 192.168.10.1.
Router on a stick
The PC sends a normal frame to the gateway's MAC, 00:00:5e:00:53:01. It carries no VLAN tag: the PC does not even know VLANs exist. The switch knows port 1 is VLAN 10.
The router's MAC sits behind port 24, the trunk: one cable carrying both VLANs. So the switch adds a 4-byte 802.1Q tag that says VLAN 10. Nothing else in the frame changes.
The router's one port has two subinterfaces, one per VLAN. Tag 10 lands on port.10 (192.168.10.1). The route to 192.168.20.0/24 leaves by port.20. TTL drops from 64 to 63.
Every packet between the VLANs passes the router, so rules can sit there. This ACL (access control list) permits printing, TCP port 9100, to 192.168.20.20 and denies everything else from VLAN 10. Our packet matches the permit.
The router builds a new frame: from its own MAC 00:00:5e:00:53:01 to the printer's 00:00:5e:00:53:14, tagged VLAN 20. It goes back down the same cable. The IP addresses inside have not changed.
The switch reads tag 20, finds the printer's MAC on port 2 in VLAN 20, removes the tag and sends the frame out. The printer gets a plain frame, just like the PC sent.
The printer keeps the packet: its own MAC, its own IP. Both MAC addresses changed at the router and the tag went from 10 to 20. The IP addresses never changed; only TTL went down, 64 to 63.
Layer 3 switch
A layer 3 switch can route by itself. It gets an SVI (switch virtual interface) per VLAN, 192.168.10.1 and 192.168.20.1, and routes inside its own chips at line rate: no trip up a trunk and back.
The headers, field by field
;; step 1/10 · two-vlans · local ;; at switch + pc + printer switch port mode VLAN 1 access 10 (PC) 2 access 20 (printer) 24 trunk 10, 20 (router) VLAN 10 = subnet 192.168.10.0/24 VLAN 20 = subnet 192.168.20.0/24 a frame is only ever sent out of ports in its own VLAN (IEEE 802.1Q)
The PC already knows the gateway’s MAC and the router already knows the printer’s from earlier ARP exchanges, so ARP is not shown. Both subinterfaces use the router port’s single MAC address, as most routers do. A VLAN ID can be 1 to 4094; 0 and 4095 are reserved (IEEE 802.1Q). A trunk can carry one VLAN untagged, the native VLAN (often VLAN 1). VLANs 10 and 20 are not native here, so their frames are tagged.