Switch with VLAN: How to map between VLANs networks

Question

Assume the following network layout

                                        +--------+
----------------------------------------| Switch |-----------------
|               ------------------------+--------+---             |
|               |             ----------|           |             |
|               |             |                     |             |
PC A            PC B          PC C                  Other PC X    Other PC Y
192.168.1.50    192.168.1.51  192.168.1.52          any           any
Network 1       Network 1     Network 1             Network 2     Network 3

The IP Addresses of PC A, B, C are static, fixed and cannot be changed. The IP Addresses of Other PC X, Y are configurable and can be DHCP or static, and can be any IP Address.

All three networks should be isolated, except that Network 2 and Network 3 should be able to access certain services on PC A.

I thought about a switch with VLANs, to isolate the three networks. Now my question is, how can I configure that for Network 2 and Network 3 a given IP will be "mapped" to 192.168.1.50?

For example, let's say Network 2 has some PCs in the IP Range 10.50.1.1 to 10.50.1.30, and want to define that 10.50.1.25 will be the IP that will be mapped to 192.168.1.50 in order to access the service of PC A within Network 2. I have a Netgear GS105E, so I can configure the VLANs, but I see no possibility to realize this mapping.

My next guess would be to assign the port of the switch where 192.168.1.50 is attached to, to all three VLANs, so in general 192.168.1.50 would be able to receive packets from Network 2 and Network 3, and PC A itself would do the "mapping". But I have no clue, so I am asking what is the standard way of doing this, because I think this is a standard use case for a switch with VLANs.

Answer 1

When you create a VLAN, you split your switch into separate logical devices, each serving its dedicated network segment. They behave exactly like separate, unconnected physical devices; no traffic can be forwarded from one VLAN to another - that's the entire purpose of VLANs. Each network segment must be its own separate subnet, i.e. devices connected to that segment must have IP addresses on the same address range. Traffic between the VLANs must be routed.

                                     +--------------+
                                     |   ROUTER     |
                                     +--------------+
                                            |
                                            |
                                        +--------+
----------------------------------------| Switch |--------------------
|               ------------------------+--------+---                |
|               |             ----------|           |                |
|               |             |                     |                |
PC A            PC B          PC C                  Other PC X       Other PC Y
192.168.1.50    192.168.1.51  192.168.1.52          10.50.1.30       any           
Network 1       Network 1     Network 1             Network 2        Network 3
                    

The switch port connecting to the router must be a member in all VLANs (trunk port) so that it can carry traffic from all VLANs to the router. The router port has to have IP interfaces in all ranges, for example 192.168.1.1/24, 10.50.1.1 and "any". That IP would be the PC default gateway for the subnet (192.168.1.1 for 192.168.1.0/24, 10.50.1.1 for 10.50.1.0/24...).

If PC X wants to reach 192.168.1.50, it will send the traffic to its default gateway, the router, which will forward the traffic to 192.168.1.50 in Net 1; and so on.

Now there's a problem with your current hardware. You have a simple 5-port switch and all ports are in use. So you have to either sacrifice one of the ports to use for router connection, or replace the switch.

With a network this simple an alternative approach is to do away with the router altogether and forward the traffic between VLANs directly on the switch itself. That requires a L3-capable routing switch. None of the devices in Netlink's Gigabit Ethernet Plus -line has L3 capability.

Answer 2

All three networks should be isolated, except that Network 2 and Network 3 should be able to access certain services on PC A.

That mandates routing between those networks - PC A needs to use a (default) gateway between Network 1 and the others, as do the hosts in Network 2/3.

how can I configure that for Network 2 and Network 3 a given IP will be "mapped" to 192.168.1.50?

There's nothing to "map". Simply set up a router/gateway in between and make sure all hosts know how to use that gateway, ie. have set a route for the remote network (or a default route to all remote networks or a separate for each network).

Connecting a router to all VLANs is likely done most easily by trunking your VLANs over a single physical link between switch and router: you configure all required VLANs as tagged on the respective port on each side. On the router, set up a subinterface with the desired VLAN ID for each network.

Translating between multiple address ranges is called network address translation (usually a router's job). It's a kludge to cope with private addressing introduced to save public address space. You don't use that inside your own network. (You could but you'd regret it sooner or later.)

When high performance is required between the VLANs, you might consider replacing the switch with a layer-3 switch. That's essentially a switch capable of routing between VLANs (in contrast to a separately connected router). It has the advantage of fully routing in hardware (at "wire speed"), containing everything in a single box, and saving some latencies due to saving layer-2 hops.