1

After much wrangling with money, desk space and other such considerations I'm trying to create a Jekyll-&-Hyde computer (and as a result learn some basic networking principles.)

This would be both for a personal use and for working from home for a small business. They have no IT dept, I'm the closest thing to it. I want as clean of a break between these two functions as I can achieve, so my plan was to dual-boot the workstation off separate drives into different operating systems. In personal mode the machine would join VLAN-20, in company mode the machine would join VLAN-60. I thought I could achieve this behaviour either using a spoof mac address under one of the boots or by installing a pci-e card to provide one or more additional network interfaces in the machine. In that second scenario I'm struggling to understand the security implications of the cabling.

  • Can I run one cable from a single port of a smart switch to the workstation, swap over the network port on the workstation I plug into between the different boots, and set the port switch to handle both VLAN-20 & 60 traffic? (No? "Access ports.. should be members of a single VLAN" Yes? "port with multiple tags..router needs to know how to remove the tags..generally done by having a separate IP address per VLAN")
  • In company mode, the workstation would be on VLAN-60 but the switch would still send packets marked as '20' to it even though the workstation itself has been assigned an ip on VLAN-60?
  • Is the only safe approach two ports on workstation -> two cables (or one cable moved between ports at both ends) -> two ports on managed switch?

I already have a Truenas machine on the network that is presenting a similar dilemma (misunderstanding on my part of how L2/L3 security works). That machine has two network ports, but currently I'm only using one. While researching I saw that it might be prudent to connect the second interface and route access to the administrative console over it.

  • If doing this so some machines can get access to the NAS, but not it's console, does this mean I would need each port out of the Truenas box to go on a different VLAN, or is it sufficient to have them go into a dumb switch and handle access restrictions just via ip addresses?

In trying to answer my own question I've done my homework, but I fear he who knows a little thinks he knows a lot, and I will setup my network believing I'm safe while being very wrong.

My current assertions / understandings: If I have a router/firewall (pfsense box) with 2 LAN/VLAN one containing one machine, the other containing two.

VLAN 20
    -> Machine A
    -> Machine B
VLAN 60
    -> Machine C
  1. A can talk to B without necessarily going through the router (an unmanaged switch that connects them can handle the message passing?). (They are in the same subnet? "One VLAN = one subnet") So a rule blocking the ip of A from the ip of B does not prevent (any/all/some?) traffic between them?
  2. C cannot talk to anything outside of VLAN-60 without the router.. 'routing' the traffic, ("inter-LAN communications need a L3 device with routing function.") so we can setup rules about what C can and can't do in VLAN-20.
  3. Permitting C access to a specific machine in VLAN-20 does not open access to all of VLAN-20 (Because the destination ip in the destination VLAN can be part of the rule?). We could say: C may talk to B only and that would not expose A to an attack from C unless B maliciously forwards it on C's behalf.

How far away from knowing what I'm doing am I??

I originally asked this question on networkengineering.stackexchange where it was closed as off-topic but the following posts were recommended when posting my question. After reading them I am still stuck but I have edited my question with quotes to reflect the information I did glean from them.

4
  • With rare exceptions, multiple interfaces are always on different subnet/vlans
    – Ron Trunk
    Jun 13, 2022 at 19:10
  • I see, and therefore in the example where say a NAS box has two interfaces, putting them both on the same VLAN would be unusual precisely because using one for data traffic and one for console access provides no real security if they don't also connect to different vlans?
    – John S.
    Jun 13, 2022 at 19:17
  • No, it's a problem because the NAS won't know which interface to use. In nearly all cases, it's an invalid configuration and the NAS won't let you do it.
    – Ron Trunk
    Jun 13, 2022 at 19:38
  • AHHH (penny-drop) I understand. From first look I thought Truenas was allowing you to specify services by interface, but I see now it's by subnet. I even found a reference from iXsystems themselves for anyone reading this who wants to follow up: truenas.com/community/resources/…
    – John S.
    Jun 13, 2022 at 19:43

1 Answer 1

1

Can I run one cable from a single port of a smart switch to the workstation, swap over the network port on the workstation I plug into between the different boots, and set the port switch to handle both VLAN-20 & 60 traffic?

This might work if your switch supports "MAC-based VLANs" (which is an uncommon feature, though it does exist).

However, standard 802.1Q VLANs are distinguished not by MAC addresses, but by an explicit "VLAN ID" tag following each packet's Ethernet header. (Hence the terms 'tagged' and 'untagged'.) Configuring multiple such VLANs on the same port will only work if the workstation itself implements 802.1Q VLAN tagging, to let the switch know which VLAN it's supposed to belong to.

Linux and FreeBSD allow creating VLAN-tagged interfaces on top of a physical Ethernet interface – you're already using this feature in your pfSense router. Windows supports this using a Hyper-V vSwitch in "external" mode (only one VLAN at a time), or using custom features found in some enterprise-grade NIC drivers (e.g. certain Intel NICs).

So if you have two Windows installations, enable Hyper-V on both of them and configure a vSwitch that attaches to the physical Ethernet interface using whichever VLAN ID you prefer. (Make sure to set up a vSwitch on both installations, whether they use VLAN tagging or not – due to the design of NDIS6 in Windows, weird things happen when the OS receives tagged packets, whereas a Hyper-V vSwitch will filter them out like it should.)

If you have Linux installations, create a virtual VLAN interface (through NetworkManager or networkd or whichever tool your distribution uses), but also make sure to disable all IP configuration on the original physical interface.


Some switches may allow you to configure more than one "untagged" VLAN on the same port, but this only works in one direction – the host would be able to receive packets from both VLANs, but only send to one of them, whichever is set as the switch port's PVID/"native vlan" at the moment. For the host to specify which VLAN it wants to talk on, well, it has to use tagging – that's literally what it's for.

6
  • I thought the pfsense router would attach the tag and the standard behaviour of the managed switch was to (after using it to decide which ports to send a packet on) strip it. I took this from the opening of this video by Lawrence Systems in which he points to a wiki page regarding IEEE 802.1Q and "VLAN-awareness". youtube.com/watch?v=WMyz7SVlrgc . In short, switch is VLAN aware, pc is not. Are you confirming but pointing out in the case of multiple VLAN's on a port, that requires the step after the port to be VLAN aware also? (achieved as per your directions)
    – John S.
    Jun 13, 2022 at 19:28
  • You already have an exception to that behavior: the switch doesn't strip tags when sending packets to the pfSense port. Being "VLAN-aware" is symmetric, because VLANs are an emulation of physically separate Ethernet LANs (not of overlapping "security groups") – so with two VLANs, pfSense attaches tags to indicate which "virtual Ethernet interface" it's sending the packets to, but also receives packets with tags still attached so that it could know which virtual Ethernet interface each packet is supposed to arrive from. (i.e. it's also "the step after the port", not just "the step before".) Jun 13, 2022 at 20:15
  • So yes, your workstation would need to do the exact same thing – as long as its switch port is assigned to two VLANs (i.e. it's a "trunk" port or "tagged VLAN" port), it will be receiving packets with tags still attached and it must attach the correct tag to every packet it sends, i.e. it needs to be "VLAN-aware" in both directions. Jun 13, 2022 at 20:17
  • Extremely clear, thank you. I have gone ahead and ordered equipment to allow two ports on the switch (each serving a single VLAN) to be wired up to separate ports on the workstation, each of which will be enabled exclusively within each of the operating systems.
    – John S.
    Jun 13, 2022 at 21:13
  • 1
    Definitely looking at the HyperV solution. Hardware is a stop gap, with those components ultimately destined for other uses. For anyone following this post with similar aims, this looks like a good link for implementing @user1686 suggestions: woshub.com/configure-multiple-vlan-on-windows and the D-Link DGE-530T looks to be a cheap card with VLAN Windows support.
    – John S.
    Jun 14, 2022 at 22:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .