Do VLANs always end up in a router and need to be blocked?

Question

I am a lil confused:

Let's say I got one switch with two VLANs (X, Y) and one trunk port (for X, Y). The trunk port is connected to a router with subinterfaces.

VLAN X has IP address range 192.168.X.0/24

VLAN Y has IP address range 192.168.Y.0/24

The router got the first IP address in both networks. That means it knows a route to X and Y.

If I now send a packet from X to Y, the router will receive it and forward it. (?)

The reason to use a router is becaue of NAT to the internet.

Nearly everything is connected to the internet. That means I always need to filter traffic on the router that connects the switches. (?)

Is there any setup connected to the internet, which doesn't need to be filtered by ACL or VRT? Is it possible to use NAT without routig internally? Did I miss something?

Answer 1

That's a lot of questions so let's try to take them one by one.

If I now send a packet from X to Y, the router will receive it and forward it. (?)

Yes, that is what a router does, it forwards packets from one layer-2 (L2) network to another.

The reason to use a router is becaue of NAT to the internet.

No. The primary reason to use a router is to forward packets. Additionally it can, but certainly doesn't always, perform additional operations on the packets such as address or port translation (NAT/PAT) or encryption (VPN).

You could just as well have public ip addresses on your vlan X so in that case, no NAT is required for it to connect to the Internet.

Or, as @RonTrunk mentions, if you do use private IP addresses then the NAT can also be done elsewhere, e.g. on a firewall between the router and the Internet.

Nearly everything is connected to the internet. That means I always need to filter traffic on the router that connects the switches. (?)

It depends how secure you want to be (and how paranoid you are, or to look at it from another angle, how severe the impact would be of a security breach), and how well your hosts are secured.

Is there any setup connected to the internet, which doesn't need to be filtered by ACL or VRT?

Sure, most home routers will typically do NAT but have no explicit ACLs.

Is it possible to use NAT without routig internally? Did I miss something?

Assuming that you mean that vlan X and Y both need access to the Internet (with NAT) but X is not allowed to communicate with Y (and vice versa) then you cannot "disable" the routing between X and Y so the simplest solution would be to use an ACL to filter that traffic.

Answer 2

NAT is required for a privately addressed endpoint to communicate with an Internet connected endpoint. Firewalls are typically deployed at Internet connection points to limit the scope of incoming traffic. A router, sometimes called a layer 3 gateway, enables endpoints on different subnetworks to talk to one another. Typically, a single subnet exists per VLAN.