2 Server, 2 NAS, Computers in the Office area, Computers and Streaming-Clients in the Private-Area, Guest-Network.
I want to Access:
from the Office-Computers to both Servers, NAS and internet
from the Private-Computers to one of the NAS and internet, some also on one of the Servers
from the Servers to the internet
from the Guest-Network only to the Internet.
I want to seperate the Computers with VLANS, but i dont know how to start on the hEX-Side. the guest-network ís simple. the Problem is on the Office and private-side. When i connect a private port on the Switch to the vlan where the Servers located i need a matching ip-address for the Network. how can i do that? can i configure 2 seperate VLANS on the hEX on the same ip-subnet? or is there a better way i dont see?
Let me take a stab at this. Separating everything with VLANs will work for what you want to do. I make NO claim that this is the only or best way to do this, but would work. The first step is to define how many separate VLANs you need. I’ll start with that. I used example VLAN numbers and IP ranges (assuming all /24 networks for the example). Obviously if you need a number larger than 252 devices, you can assign a larger network space. Adjust as required.
VLAN 101 (192.168.101.x) = Office PCs (access to VLANs 104, - 107, & Internet)
VLAN 102 (192.168.102.x) = Private group 1 (access to VLANs 106 & internet)
VLAN 103 (192.168.103.x) = Private group 2 (access to VLANs 104, 106, & internet)
VLAN 104 (192.168.104.x) = Server 1 (access to internet)
VLAN 105 (192.168.105.x) = Server 2 (access to internet)
VLAN 106 (192.168.106.x) = NAS 1
VLAN 107 (192.168.107.x) = NAS 2
VLAN 108 (192.168.108.x) = Guest (access to intenet)
By default devices on any VLAN can talk to any other VLAN, so start putting in filter rules that allow the ones you want, and then block everything else. The way I did this, each VLAN has a separate IP address range. I don’t believe you can have multiple interfaces on the same IP subnet, but that’s not needed in my example. Assuming that your AllNet switch can handle VLANs (I’m not familiar with it), you could run a single physical interface from the hEX to the switch with all 8 VLANs, and have the switch physically separate them. All 8 VLANs can be assigned to the same physical interface. For that matter, you could even add another VLAN for your internet connection and run everything on one interface between the router and switch, but there is no advantage to doing so unless you need the physical port space. More likely I would split it up somewhat. IPs get assigned in the hEX to the VLAN, not the physical interface. If you need DHCP servers on some, you would set up a separate pool and server for the VLANs that need it (at most I would assume the office VLAN, both private VLANs and the guest VLAN). Maybe not all of those. You could also partially break this up with IP ranges within VLANs. For example, you could combine private group 1 & 2, but IPs below some number can access server 1 and those above that address can’t. Just a matter of setting up the filter rules.
Does that get you started?
If I have the concept and you cant figure it out, I can be more specific, but I did not want to put a lot of effort into the wrong concept.
thanks for your Reply! First i have tried to make a visual concept. I think it is much to complex, but it is not so easy to find the right Balance at the beginning.
I think it make sense to use more than one port on the hEX for the different VLANs for load-balancing.
The Allnet-Switch can handle VLAN.
For the WLAN i have multiple LinkSys WRT54GL running DD-WRT, so there is also VLAN-Support. They can also create multiple WLANs.
My internet-Router, a fritzbox7490 has a built-in guest Network which has also a optional splash-page. the fritzbox has no vlan, but the guest-netzwork is on a extra port, so it is safe to use. i think it make sense to use it, maybe direct to the allnet on a additional port.
if i understand right each Group becomes there own vlan, Special Computers like the Servers get their own vlan too. i define for each vlan a new address-range.
Can you give me a example how a filter rule Looks like?
