I need to set up a solution which is for routing specific TCP/UDP packets between the devices in two separate VLANs through a proxy server. For eg: all my computers are connected to one VLAN(1) and my printers are one another VLAN(2). I can reroute all the packets from VLAN(1) to VLAN(2). My objective is to only reroute packets which generated for printers in VLAN (2) from computers in VLAN (1).

Is there any way in Layer 3 routing for achieving this?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 9:26

To get traffic from one VLAN to another VLAN requires a router to route packets between the VLANs.

Having both VLANs attached to a router will, by default, route traffic between the VLANs. If you want to restrict the traffic in any way, then you use access lists to permit the traffic you want, and block the traffic you do not want.


Your intention seems to be to set up an internal firewall - route packets between VLANs but limit them to the required protocols and blocking/filtering everything else.

This is a job for either a firewall that has sufficient forwarding and processing performance or a layer-3 switch with appropriate ACLs (which I personally prefer for internal traffic).

  • Thanks for the update. Layer 3 switch with ACL will work with static rules, right? but I have dynamic rules here which we have to identify based on request type. I need to route traffic through a proxy and the proxy deciding the rules – LML Sep 13 '18 at 6:30
  • ACLs are essentially stateless, so you'd need to permit both directions explicitly. For instance, use permit udp clientsubnet serversubnet eq 53 and permit udp serversubnet eq 53 clientsubnet for UDP DNS. If you require more granularity you need an appropriate firewall. If you use a HTTP proxy the layer-3 switch (and many firewalls) will only see the request to the proxy. Proxy privileges need to be controlled on the proxy. – Zac67 Sep 13 '18 at 9:32
  • Not quite sure what you mean by "dynamic rules based on request type", but perhaps this question helps a little: networkengineering.stackexchange.com/questions/47985/… – jonathanjo Sep 13 '18 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.