0

So I try to explain the dilemma.

I have 2 groups of clients and one server. I want these groups to only communicate with the server. This means that each device in these groups should see the server, but not the devices in the other group.

Is it even possible?

I tried to solve this problem by assigning different masks like this:

  Server:         192.168.1.1 / 255.255.255.0
  GroupA:  192.168.1.10 - 120 / 255.255.255.128
  GroupB: 192.168.1.130 - 250 / 255.255.255.128

I thought if I do it like this these groups can't see each other but they can see the server. It turns out that due to the different mask they can't see the server either. Or am I missing something?

It would be much better if the devices in the same group couldn't see each other too, but I guess that's not possible, right?

2 Answers 2

3

You’re trying to solve this problem at the wrong layer.

If you want to filter nodes in a single subnet from talking to each other, but allow common access to servers, look at something like Private VLANs - most decent switch vendors support this.

1
  • Another possibility is to use Access Control Lists to limit what devices can reach. This also requires a commercial-grade router.
    – Ron Trunk
    Aug 7 at 12:07
0

I have 2 groups of clients and one server. I want these groups to only communicate with the server. This means that each device in these groups should see the server, but not the devices in the other group.

There are multiple ways to achieve that.

  1. use a managed switch and configure its private VLAN or port isolation so that the client ports can only communicate with the server port
  2. use a managed switch and configure an ACL on the client ports so that the client IP addresses can only communicate with the server IP address
  3. separate your clients and the server into three VLANs and allow only client-server communication on the L3 switch/router/firewall between the VLANs
  4. add a second NIC into your server and use two separate switches

I tried to solve this problem by assigning different masks like this

The problem with that is that your server is only part of the one subnet and not of the other. You'd need to add a second IP address to your server for the second subnet.

However, there's no real security as communication is only separated as long as each client keep to its IP address. No one's stopping a client to add an IP address from the other subnet. You need to have some separation on the network level.

It would be much better if the devices in the same group couldn't see each other too, but I guess that's not possible, right?

That's quite possible with options 1 and 2 above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.