I am struggling to find out how can I make a VLAN (let's name it A) see another VLAN (let this one be B) and I want the B VLAN not to be able to see A VLAN.
I mention because I want this configuration for Windows server.
I am struggling to find out how can I make a VLAN (let's name it A) see another VLAN (let this one be B) and I want the B VLAN not to be able to see A VLAN.
I mention because I want this configuration for Windows server.
VLANs work the same way as two ordinary separate networks: they do not "see" each other by default, and can only communicate through a router (which has both VLANs configured, probably as "tagged" interfaces). So if you want to prevent certain types of communication, you would do that in the router's firewall rules.
And, generally, you do need a switch that supports VLAN configuration. (Windows itself can do that only when it's acting as a switch for Hyper-V VMs, too.) It's probably not a good idea to configure VLANs directly on the end hosts – if there's nothing to enforce them, then it's not very secure.
(Besides, not counting the Hyper-V "virtual switch" mode, Windows itself doesn't actually have native VLAN configuration. Some drivers provide it; some drivers don't; some drivers accept all packets ignoring any VLAN tag... Linux and BSDs are more flexible in this regard.)
For example (not sure if this is actually good, but it technically works):
Switch:
Router (Linux example):
192.168.10.1/24
192.168.20.1/24
192.168.10.0/24
, but only expected replies from everything else. (On Linux that'd be iptables with the "FORWARD" chain and "-m state".)Server:
192.168.10.3/24
Desktop PC:
192.168.20.7/24