How to achieve Private VLAN (PVLAN) isolation without PVLAN support on switches

Question

I'm looking for some wired client isolation on our public IPv4 VLAN. Since we have a /23 block, isolation is a kind of feature that's really useful.

But we don't have switches capable of PVLAN. To circumvent the issue and avoid wasting public IPv4 addresses with /30 links, I've come across a solution looking through the web that involves setting up a port on a given switch to be the "uplink port" with some untagged VLANs, and just a single VLAN on the access ports.

For example:

Port 24: VLAN 100,101,102,103,104 => Untagged
Port 01: VLAN 101                 => Untagged
Port 02: VLAN 102                 => Untagged
Port 03: VLAN 103                 => Untagged
Port 04: VLAN 104                 => Untagged

Finally the question: will this really work as expected? If yes how can I cascade switches using this approach?

Answer 1

The short answer is no - PVLAN functionality is there for a reason - it changes the way the default flooding and learning mechanisms work to ensure that hosts in a VLAN don't see each other, while being able to see their gateway devices and other "public" resources.

Having said that, you could re-create something functionally equivalent using a lot of ACLs either on the switch (at either L2 or L3 depending on hardware capabilities), or on the hosts themselves (L3) to restrict traffic flow between all public hosts.

Depending on your requirements/ruleset, this could either be really simple (bar traffic to any other hosts on the same subnet except the gateway), or very tedious (some inter-host traffic allowed, but different for each host).

If you go down this path, look into some automation tooling (Ansible etc.) to make this easier.