0

Assume the following network layout

                                        +--------+
----------------------------------------| Switch |-----------------
|               ------------------------+--------+---             |
|               |             ----------|           |             |
|               |             |                     |             |
PC A            PC B          PC C                  Other PC X    Other PC Y
192.168.1.50    192.168.1.51  192.168.1.52          any           any
Network 1       Network 1     Network 1             Network 2     Network 3

The IP Addresses of PC A, B, C are static, fixed and cannot be changed. The IP Addresses of Other PC X, Y are configurable and can be DHCP or static, and can be any IP Address.

All three networks should be isolated, except that Network 2 and Network 3 should be able to access certain services on PC A.

I thought about a switch with VLANs, to isolate the three networks. Now my question is, how can I configure that for Network 2 and Network 3 a given IP will be "mapped" to 192.168.1.50?

For example, let's say Network 2 has some PCs in the IP Range 10.50.1.1 to 10.50.1.30, and want to define that 10.50.1.25 will be the IP that will be mapped to 192.168.1.50 in order to access the service of PC A within Network 2. I have a Netgear GS105E, so I can configure the VLANs, but I see no possibility to realize this mapping.

My next guess would be to assign the port of the switch where 192.168.1.50 is attached to, to all three VLANs, so in general 192.168.1.50 would be able to receive packets from Network 2 and Network 3, and PC A itself would do the "mapping". But I have no clue, so I am asking what is the standard way of doing this, because I think this is a standard use case for a switch with VLANs.

New contributor
sctty is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
2

When you create a VLAN, you split your switch into separate logical devices, each serving its dedicated network segment. They behave exactly like separate, unconnected physical devices; no traffic can be forwarded from one VLAN to another - that's the entire purpose of VLANs. Each network segment must be its own separate subnet, i.e. devices connected to that segment must have IP addresses on the same address range. Traffic between the VLANs must be routed.

                                     +--------------+
                                     |   ROUTER     |
                                     +--------------+
                                            |
                                            |
                                        +--------+
----------------------------------------| Switch |--------------------
|               ------------------------+--------+---                |
|               |             ----------|           |                |
|               |             |                     |                |
PC A            PC B          PC C                  Other PC X       Other PC Y
192.168.1.50    192.168.1.51  192.168.1.52          10.50.1.30       any           
Network 1       Network 1     Network 1             Network 2        Network 3
                    

The switch port connecting to the router must be a member in all VLANs (trunk port) so that it can carry traffic from all VLANs to the router. The router port has to have IP interfaces in all ranges, for example 192.168.1.1/24, 10.50.1.1 and "any". That IP would be the PC default gateway for the subnet (192.168.1.1 for 192.168.1.0/24, 10.50.1.1 for 10.50.1.0/24...).

If PC X wants to reach 192.168.1.50, it will send the traffic to its default gateway, the router, which will forward the traffic to 192.168.1.50 in Net 1; and so on.

Now there's a problem with your current hardware. You have a simple 5-port switch and all ports are in use. So you have to either sacrifice one of the ports to use for router connection, or replace the switch.

With a network this simple an alternative approach is to do away with the router altogether and forward the traffic between VLANs directly on the switch itself. That requires a L3-capable routing switch. None of the devices in Netlink's Gigabit Ethernet Plus -line has L3 capability.

9
  • Thank you, that makes perfectly sense, when I understand your idea correctly, an idea to save the additional hardware: could it be possible that PC A (Linux with one NIC) acts also as the router, or even routing functionality is not necessary because PC A adds, additionally to its fixed not changeable IP, two another IPs, each for network 2 and 3? So essentially PC A is connected to your mentioned trunk port and having also an IP for network 2 and 3, would that already be enough? I would give up the isolation of network 1 (at least for PC A) but could use the given layout.
    – sctty
    Sep 13 at 12:55
  • If the need is only to allow access to PC A from all networks, yes, it can be configured to partake in multiple subnets, and you don't need to configure routing. The switch port connecting to PC A must still be configured as a trunk port. You can configure the necessary subinterfaces on the NIC and give them IPs in appropriate VLANs - I believe all NICs nowadays support dot1q configuration. For how to you need to check your distro documentation. You're not giving up the Net 1 isolation either, if you don't configure routing the other networks won't have access there. Sep 13 at 13:09
  • I think this is actually off topic in this community. Superuser or Unix&Linux would be better places to ask if you need help configuring this. Sep 13 at 13:15
  • Yes, now I have an idea how it could work and how to investigate further, we do not need to detail the "PC A multiple IPs" scenario here. One question to your layout with the router: Can this scenario be implemented without touching hosts from network 2 and 3? So instead of defining a gateway in network 2 hosts, they for example connect to 10.50.1.25, which will be handled by the new router without any further configuration in network 2, and the router translate it to 192.168.1.50, network 2 thus never knows about network 1?
    – sctty
    Sep 13 at 13:35
  • That's basically what NAT is... but why? If PC A already has an interface in 10.50.1.0/24-net, any device in that network can access the services you want to provide. The user can only learn of the other networks if they can see the IP configuration of the PC. There's no need to touch the other networks at all, there only has to be an endpoint that will respond when packets are sent to a given IP address. Whether the next device NATs the traffic or responds directly makes no diff on that side. Sep 13 at 14:10
0

All three networks should be isolated, except that Network 2 and Network 3 should be able to access certain services on PC A.

That mandates routing between those networks - PC A needs to use a (default) gateway between Network 1 and the others, as do the hosts in Network 2/3.

how can I configure that for Network 2 and Network 3 a given IP will be "mapped" to 192.168.1.50?

There's nothing to "map". Simply set up a router/gateway in between and make sure all hosts know how to use that gateway, ie. have set a route for the remote network (or a default route to all remote networks or a separate for each network).

Connecting a router to all VLANs is likely done most easily by trunking your VLANs over a single physical link between switch and router: you configure all required VLANs as tagged on the respective port on each side. On the router, set up a subinterface with the desired VLAN ID for each network.

Translating between multiple address ranges is called network address translation (usually a router's job). It's a kludge to cope with private addressing introduced to save public address space. You don't use that inside your own network. (You could but you'd regret it sooner or later.)

When high performance is required between the VLANs, you might consider replacing the switch with a layer-3 switch. That's essentially a switch capable of routing between VLANs (in contrast to a separately connected router). It has the advantage of fully routing in hardware (at "wire speed"), containing everything in a single box, and saving some latencies due to saving layer-2 hops.

5
  • Ah thanks @Zac67 :-) I'd add that NAT is also a job for a router. An example where it's used is any ISP router. The router will NAT the traffic from every device connected to the router so that the outside world will see all the traffic originating from one single IP address; even if your network contained multiple devices. As Zac67 says, it's not used when routing traffic internally. Sep 13 at 10:35
  • @Peregrino69 True, but NAT should be avoided here, so don't give them any ideas... ;-)
    – Zac67
    Sep 13 at 10:36
  • you are absolutely right :-D Sep 13 at 10:37
  • Thank you, unfortunately I do not have any access whatsoever in network 2 or 3, so I can not add a default gateway/route for hosts in network 2 or 3 when I understand you correctly. By buying a VLAN switch I thought your mentioned Layer-3 functionality would be automatically available, since I see no use case for mixing VLANs without options to "wire them". I was too naive I guess.
    – sctty
    Sep 13 at 13:01
  • @sctty You don't need a default route for the N2/3 hosts, but they do need a route - that's the only way the hosts can use a gateway. No, a VLAN-capable (managed) switch isn't necessarily capable of layer-3 switching/routing. You can use it in combination with either a layer-3 switch higher in hierarchy or with a separate router.
    – Zac67
    Sep 13 at 14:02

Your Answer

sctty is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.