2

Suppose one wishes to provide guests with access to the Internet (and only the Internet) over one's network. For obvious reasons, switch ports will be assigned to a private VLAN created specifically for that purpose.

It strikes me that one can either place the hosts in a shared subnet (isolating between them at L2 only); or else place each of them in their own subnet (thereby also isolating at L3)—this latter case effectively creates point-to-point links between each guest host and the gateway, which seems more rational to me because it more accurately reflects the logical design.

However such point-to-point links would traditionally require a subnet with at least a /30 prefix (in order to address both the guest and the gateway as well as provide network and broadcast addresses for the subnet itself); applying RFC 3021, one could use /31 prefixes—but this would still require a virtual interface on the router for each guest and consume 2 addresses per guest host: not a particularly efficient use of resources.

So it has struck me that one solution could be to use PPPoE between the guest host and the router…

  1. Is this sensible? Have I overlooked any pitfalls, or more appropriate solutions?

  2. Can DHCP configure a client expecting IPoE to use IPoPPPoE instead, or must the guest host OS be prepared for PPPoE? If the latter, do popular workstation OSes (Windows/Linux/OSX) attempt PPPoE Discovery if DHCP fails?

  3. If the router is also performing IP-masquerading (i.e. many-to-one NAT) it strikes me that every PPPoE host could in fact be assigned the router's egress address: the NAT need merely map upstream ports to PPP interfaces (rather than IP addresses); this would provide the "advantage" that the hosts would then be configured with their actually visible external address. Seems pretty ridiculous to me, but is it nevertheless possible?

Improve this question
  • 1
    To clarify, you do realize that there is a difference between using VLANs and using private VLANs, correct? Private VLANs are used for exactly the kind of client isolation you mention. To me it sounds like you are over complicating the issue and potentially asking an XY question. – YLearn♦ Dec 13 '14 at 2:29
  • @YLearn: You're right—a private VLAN does indeed isolate each individual guest from eachother, but L2 (inc link-local L3) broadcasts from promiscuous ports (such as the gateway) will nevertheless go to all such hosts... perhaps I am overcomplicating the question, but it seems to me that in fact it's the other way around: private VLANs are actually an overcomplicated solution! – eggyal Dec 13 '14 at 2:37
  • 2
    Which broadcasts from the gateway would you be concerned about? ARP requests? No harm there, guests won't see the reply. IPv6 router advertisements or neighbor discovery (technically multicast)? Again no harm. Seems to me the correct solution is that your gateway should be configured such that it won't be broadcasting out anything you wouldn't want the guests to see. Somehow can't see how a single subnet with guests isolated from each other and no need for client configuration is more complicated than PPPoE with individual /30 networks. – YLearn♦ Dec 13 '14 at 3:01
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin♦ Aug 10 '17 at 23:04
2

Separate private VLAN that has it's own L3 addressing scheme is the option that would make the most sense. Or you can get fancy and use vrf's. Simple is better, do not make things complicated when you do not have to because it makes troubleshooting a nightmare.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.