0

I would like to separate several hosts from the local network and put them behind a firewall. I would like to use VLANs to "physically" separate them instead of using just different subnets. My idea is to use a switch that supports VLANs, and build up the network like this:

enter image description here

P1 and P2, P3 and P4 are four different hosts that belong to two separate, "physical" networks (VLAN 1 and 2). They should be protected by firewall/gateway on P5.

P5 should act as firewall/gateway that controls the data between the separated hosts and the existing network. It only has one NIC that needs to connect to the existing network (no VLAN) and the two VLANs.

P6 is the uplink to the existing network.

My questions now are:

  1. Can this idea work as expected (given a correct configuration) - i.e., that the host on P5 can have multiple IPs/be part of multiple networks with just a single NIC, that it acts as gateway/firewall between the separated hosts and the existing network, and if there are no pitfalls/flaws that I didn't consider which might allow data flow between networks bypassing the firewall?
  2. I guess the switch needs to be able to support tagged VLAN (instead of just port-based VLAN) because of P5?
Improve this question
2
  • Note that P6 requires an associated VLAN as well (untagged on P6, tagged on P5).
    – Zac67 ♦
    Dec 3, 2021 at 12:07
  • Unfortunately, host/server configurations are off-topic here, and produvt or resource recommendations are also off-topic. A host need not be in multiple VLAN because we have routers that can route traffic between VLANS.
    – Ron Maupin ♦
    Dec 3, 2021 at 13:19

1 Answer 1

Reset to default
1

Can this idea work as expected ?

Yes, but only if your firewall supports 802.1q vlan tagging.

Yes your switch also must support vlan tagging.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.