I was reading a VLAN setup walkthrough, and the author had an interesting idea for setting up VLANs without a router (which you don't normally see). At first glance, this doesn't seem like it actually works how the author expected it to, but, I've been wrong before.
- In the switch, he set up three VLANs (2, 3, and 4).
- Then he assigned one group of ports to VLANs 2 and 3, with a (untagged) PVID of 3.
- The second group of ports was assigned to VLANs 2 and 4, with an (untagged) PVID of 4.
- The port out to the router was then assigned to all three VLANs (2, 3, and 4), with an (untagged) PVID of 2.
This setup supposedly separated the network traffic from VLAN 3 and VLAN 4. It does prevent pings or direct network traffic from one router to another. The problem that I see, however, is that all packets coming from the router will be sent out to both groups of devices (VLANs 3 and 4). This seems to, at least partially, defeat the security, since any packets from the router will go out to all the devices.
Is the author's solution valid, security-wise, or is it, in fact, routing reply packets from the WAN into both VLANs?