I am struggling to find out how can I make a VLAN (let's name it A) see another VLAN (let this one be B) and I want the B VLAN not to be able to see A VLAN.
I mention because I want this configuration for Windows server.
-
The whole point of VLANs is that they can't see each other– BurgiMay 3, 2016 at 21:11
-
This is why I am asking this. Because I need this exception of vlans. I just can't figure out how to apply this from windows server and not from the switch. thank's for your answer!– ViktorMay 3, 2016 at 21:14
-
What do you even mean by "see"? Isn't this just about some trivial firewall rules?– Daniel BMay 3, 2016 at 21:17
-
Sorry for not being able to properly express myself, my bad. By "see" i mean I want the A vlan to see B like computers see each other in a network. I want A to "see" B and be able to access resources from it. I was thinking the firewall might be the answer but I honestly have no clue of how to implement that...– ViktorMay 3, 2016 at 21:29
-
The only option I know of for this type of situation is to do interVLAN routing through sub-interfaces. The sub-interface needs to be made on a layer 3 switch or a router. You would make a sub-interface for VLAN A, that way it can successfully access VLAN B, while restricting VLAN B's access to VLAN A.– DrZooMay 3, 2016 at 21:48
|
Show 1 more comment
1 Answer
VLANs work the same way as two ordinary separate networks: they do not "see" each other by default, and can only communicate through a router (which has both VLANs configured, probably as "tagged" interfaces). So if you want to prevent certain types of communication, you would do that in the router's firewall rules.
And, generally, you do need a switch that supports VLAN configuration. (Windows itself can do that only when it's acting as a switch for Hyper-V VMs, too.) It's probably not a good idea to configure VLANs directly on the end hosts – if there's nothing to enforce them, then it's not very secure.
(Besides, not counting the Hyper-V "virtual switch" mode, Windows itself doesn't actually have native VLAN configuration. Some drivers provide it; some drivers don't; some drivers accept all packets ignoring any VLAN tag... Linux and BSDs are more flexible in this regard.)
For example (not sure if this is actually good, but it technically works):
Switch:
- Port 1 (tagged VLANs 10, 20) → router
- Port 2 (untagged VLAN 10) → server
- Port 3 (untagged VLAN 20) → desktop PC
Router (Linux example):
- Interface "eth0" (untagged) – nothing (maybe management IP? dunno)
- Interface "eth0.10" (VLAN 10) – address
192.168.10.1/24 - Interface "eth0.20" (VLAN 20) – address
192.168.20.1/24 - Firewall configured to allow new connections from
192.168.10.0/24, but only expected replies from everything else. (On Linux that'd be iptables with the "FORWARD" chain and "-m state".)
Server:
- Interface "Ethernet" – address
192.168.10.3/24
- Interface "Ethernet" – address
Desktop PC:
- Interface "Ethernet" – address
192.168.20.7/24
- Interface "Ethernet" – address
answered May 3, 2016 at 21:17
-
Thank you very much for your answer. Indeed, I am aware of the default "feature" of vlans not being able to see each other. I am looking forward to make that exception possible under windows os. I do have vlans created in windows server and I "send" them through a switch. server: vlan A- 192.168.10.1 vlan b: 192.168.50.1 this is what "goes" to switch, and from there, to PCs. Port 1:trunk( i receive vlans). port 2: A vlan leaves port 3: B vlan leaves– ViktorMay 3, 2016 at 21:42
-
This is my actual configurations. Vlans do not ping each other, do not "see" each other. This is the point I got stuck. I can follow the example for Linux (thank you for that) but have no idea of how to implement it...– ViktorMay 3, 2016 at 21:47
-
@Viktor: Can they both ping the router itself? If the router is Linux, did you enable IP forwarding on it? May 3, 2016 at 21:50
-