2

I am a lil confused:

Let's say I got one switch with two VLANs (X, Y) and one trunk port (for X, Y). The trunk port is connected to a router with subinterfaces.

VLAN X has IP address range 192.168.X.0/24

VLAN Y has IP address range 192.168.Y.0/24

The router got the first IP address in both networks. That means it knows a route to X and Y.

If I now send a packet from X to Y, the router will receive it and forward it. (?)

The reason to use a router is becaue of NAT to the internet.

Nearly everything is connected to the internet. That means I always need to filter traffic on the router that connects the switches. (?)

Is there any setup connected to the internet, which doesn't need to be filtered by ACL or VRT? Is it possible to use NAT without routig internally? Did I miss something?

1
  • What is VRT in this context ?
    – hertitu
    Sep 16 '16 at 8:19
5

That's a lot of questions so let's try to take them one by one.

If I now send a packet from X to Y, the router will receive it and forward it. (?)

Yes, that is what a router does, it forwards packets from one layer-2 (L2) network to another.

The reason to use a router is becaue of NAT to the internet.

No. The primary reason to use a router is to forward packets. Additionally it can, but certainly doesn't always, perform additional operations on the packets such as address or port translation (NAT/PAT) or encryption (VPN).

You could just as well have public ip addresses on your vlan X so in that case, no NAT is required for it to connect to the Internet.

Or, as @RonTrunk mentions, if you do use private IP addresses then the NAT can also be done elsewhere, e.g. on a firewall between the router and the Internet.

Nearly everything is connected to the internet. That means I always need to filter traffic on the router that connects the switches. (?)

It depends how secure you want to be (and how paranoid you are, or to look at it from another angle, how severe the impact would be of a security breach), and how well your hosts are secured.

Is there any setup connected to the internet, which doesn't need to be filtered by ACL or VRT?

Sure, most home routers will typically do NAT but have no explicit ACLs.

Is it possible to use NAT without routig internally? Did I miss something?

Assuming that you mean that vlan X and Y both need access to the Internet (with NAT) but X is not allowed to communicate with Y (and vice versa) then you cannot "disable" the routing between X and Y so the simplest solution would be to use an ACL to filter that traffic.

2
  • I know that the primary reason of routers is routing (forwarding) IP packets. What I mean is that there must be NAT in order to connect local IPs to the internet. Because nearly everything is connected to internet, there must be NAT (and therefore a router) and therefore there should always be ACLs for inter-VLAN communication. Right?
    – nodna
    Sep 16 '16 at 11:09
  • 2
    You only need NAT to route traffic over the public Internet if you are using private IP address space. NAT can also be performed on other devices, such as a firewall -- t doesn't have to be the router. I'm working in a place that uses public IP addresses internally, so we don't use NAT. The only reason to use ACLs between VLANs is if you want to restrict inter-VLAN traffic.
    – Ron Trunk
    Sep 16 '16 at 11:28
0

NAT is required for a privately addressed endpoint to communicate with an Internet connected endpoint. Firewalls are typically deployed at Internet connection points to limit the scope of incoming traffic. A router, sometimes called a layer 3 gateway, enables endpoints on different subnetworks to talk to one another. Typically, a single subnet exists per VLAN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.