I'm about to buy a switch which handles VLANs.
Before I buy that switch, I'd like to know : Is it possible to connect two VLAN on a L2 switch ?

I am aware of the topic : Connecting two VLANs together on a single switch but my situation isn't with a L3 switch.
Herer is my plan : VLANs I thought I could connect a cable from VLAN 1 to VLAN 2 to connect them but I found I may need a router to handle the different IP address.
I need to separate one special computer, and control (the most strictly I can) the access to this computer. My boss wants that computer to be on a separate network.

I plan to buy a NETGEAR GS108Ev3 (the model on the image isn't a GS108Ev3)

Is it possible to do so ?

  • 1
    Connecting two VLANs on a layer-2 switch doesn't make much sense. VLANs are to separate the traffic, logically as if they are two separate LANs. If you connect them together, then you have one LAN, instead of two, so what is the point, and why did you create the VLANs in the first place? – Ron Maupin Feb 7 '18 at 15:04

If you are using a separate IP network (ie, with disjoint addresses), then something must have an address, and a connection, on both sides.

  • With a router you can filter on IP addresses and many other things, such as the UDP protocol, source and destination port numbers, packet sizes.
  • A so-called L3 switch is a switch with router functionality: ie, it's a router too
  • With a firewall you can filter on many things including URLs or other higher-level aspects of the interaction
  • With a application layer proxy you can filter on all kinds of permissions, time of day, history of transactions, cookies, sessions, and whatever else might be convenient.
  • With a wire you can do nothing. If you're joining two VLANs with a wire, it's usually a mistake which just complicates your network without providing any benefit.

You say you want to control access "as strictly as you can", but you don't say what kind of service the special computer is intended to perform, so it's hard to guide any further without guessing. If I were to guess, I'd suggest a small router with two ethernet interfaces. Put special computer on its own on one side, other side into your main LAN.

[EDIT] ... it's also possible to do this kind of thing with private VLANs on some ethernet switches, which make some ports of the switch only able to commuinicate with certain other ones. The purpose of these is, for example, to make it that all hotel guests' laptops can communicate with the router and thus the internet, but not directly communicate nor see each others' broadcasts etc. Different switch manufacturers do these in different ways, and they appear to be non-standard. You'll have to check your switch manual to see what it offers in this. I'd advise against them unless you have compelling reasons. From your description of your task, this won't achieve what you want: you can't filter by protocol UDP and port, for example.

  • I need to filter at IP layer (allow only one IP to access the other VLAN) and at Application layer : Only accept UDP on port 4444. I thought I could at least filter the IP, and maybe filter the UDP with a software solution (pfSense or firewall software on a Rpi...) – Maskim Feb 7 '18 at 12:56
  • If it was me I'd use a small router: I often use Cisco 867 for this kind of thing. You can certainly filter by source address and port numbers, and log all the attempts. – jonathanjo Feb 7 '18 at 22:33
  • It occurred to me that you might do this with your existing router which connects your network to the internet. All routers above the most basic will route between the three networks you have: internet, main, special. with very strict rules for access to special. What kind of router do you have? – jonathanjo Feb 8 '18 at 16:10
  • For the moment, I only have a switch. I normally don't have Internet (I can plug my phone...) but I will receive a communication device which will connect the network to Internet. The problem is : the "special' computer is connected to the company's network (cannot boot otherwise), cannot connect to Internet without my company's proxy (blocks the connection due to security rules) but hosts a service that my other PC must contact and the other PC must go on Internet.. I plan on buying LinkSys LRT224 – Maskim Feb 8 '18 at 20:27

If you connect a cable between two ports, each one in a separate VLAN as access port, then you end up with having a single VLAN

This is exactly the same as having two different physical switches and connecting them together with a cable.

If this computer must be on a separate network, then you have to create a third VLAN for this computer, then route - and filter - the traffic to/from this computer on a router.

So you need a router that is VLAN capable and have the security features needed to reach whatever security level you want to achieve.

Most enterprise grade router do have some way to filter the traffic that can come from or reach a specific network (access lists). If this computer really need a high level of security then you may need a firewall that perform packet inspection.

  • The router doesn't need to be VLAN capable unless you want to connect it with a VLAN trunk (instead of each VLAN with a separate port). – Zac67 Feb 7 '18 at 12:13
  • @Zac67 Right, I considered editing this point, but dismissed it since any router that has several L3 physical interfaces will be VLAN aware anyway (by opposition to a router with an embedded switch which cannot be used to do this without VLAN). – JFL Feb 7 '18 at 12:17
  • Thanks for your answers ! For the VLANs to communicate with only a wire, they must have the same IP range, right ? – Maskim Feb 7 '18 at 12:51
  • @Maxime.D Somewhat - VLANs are L2 constructs, so they don't use IP (Ethernet uses MAC). IP in turn uses Ethernet, so when two IP nodes are in the same VLAN/broadcast domain they require a common subnet (or a router). The point of using VLANs is most often to enforce a separation between different subnets. – Zac67 Feb 8 '18 at 12:12

Yes your difinately required a layer3 devices to ensure communication between Vlan 1 & Vlan 2 . General layer2 devices is a transparent devices communication between same Vlan is feasible with layer2 switch . Based on destination mac address frame is destined to destination based on check with mac - address table .

Inter - Vlan routing configuration is mandate on layer3 device to route traffic between different VLans .


What you are asking will not be possible without a layer 3 switch or router. You cannot connect two separate networks with different IP addresses with a layer 2 switch.

Moreover connecting a cable between 2 different VLANs pretty much destroys the purpose of the VLAN in the first place. Why not put it all in the same VLAN then? It also pose a security risk to do so as all traffic from both VLANs will flow freely between them.

  • Thanks, I wanted to forbid every IP except one to access the other VLAN, but it looks like it won't be possible with only a "normal" switch – Maskim Feb 7 '18 at 12:53

Thanks, I wanted to forbid every IP except one to access the other VLAN, but it looks like it won't be possible with only a "normal" switch – Maxime.D yesterday

Like others have said...every day common access layer switches are layer two. VLANs, like in your graphic are layer two...to bridge VLANs a layer 3 device is needed.

Interconnecting a switch is always a bad idea and should never be done, safegurads exist on the switch but interconnecting a swtich can cripple a network.

  • 1
    "to bridge VLANs a layer 3 device is needed" It would be more accurate to say that to route traffic between the VLANs. Bridging is a layer-2 function. Routing happens at layer-3. IP addresses are layer-3 addresses, and to place restriction on them requires a layer-3 device (router). – Ron Maupin Feb 8 '18 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.