separate two interface in same router using VLANs

Techsystem · Sat Sep 10, 2022 2:23 pm

Hello for all ...! so i see a lot of video out there talking a bout VLANs and How to setup VLANs , but all this video talking about VLANs in two or more device, So what if i have only one MT router and
i want to separate eth3 and eth4 forexample using VLANs what i have to do in this case..?
anyone try this ..? or it's a mendatory to have to connected device so we have trunk and access port..? in my single router VLANs scenario i want only access port so no trunk port, also the two access port have to be isolated from each other.

Sob · Sat Sep 10, 2022 4:09 pm

What was wrong with your previous thread about same subject? Question two, what's your understanding of VLANs? Do you perhaps use that term just to refer to some isolated networks and not "real" VLANs? Because so far it doesn't seem that you'd need the latter. Just remove ports from bridge (if you start with default config where they are bridged), configure addresses and possibly routes as needed, use IP firewall to block or allow access between them as needed, and that should be it.

anav · Sat Sep 10, 2022 4:31 pm

A bridge is not required, vlans are not required, its up to you.

If you have single Subnet going to single ports, just assign them individually
Ether1-wan
ether2- subnet1
ether3-subnet2
ether4-subnet3
ether5-subnet4.

When at least two ports will use the same subnet (such as 2,3) then it makes sense to be efficient with rules and the like and a bridge starts to be practical In this case the bridge handles the DHCP address etc for the ports.
Ether1-wan
ether4-subnet3
ether5-subnet4.
add bridge
bridge ports interface=ether2 (subnet1)
bridge ports interface=ether3 (subnet1).

When you have more subnets than ports or if you want to send several subnets over one port, then vlans make sense.

There is no harm in practicing with bridges and vlans even if you only have one subnet, if that is your desire.

ether1=wan
bridge ports interface=ether2 pvid=11 ( where subnet1 is vlan 11)
bridge ports interface=ether3 pvid=11
bridge ports interface=ether4 pvid=11
bridge ports interface=ether5 pvid=11

What I dont tolerate well is mixing apples and oranges and that is using the bridge for some ports with no vlans and then using the bridge with vlans for other ports.
As soon as you start using vlans, dont use the bridge for anything other than bridge (aka no dhcp etc.........)

Techsystem · Sat Sep 10, 2022 5:07 pm

What was wrong with your previous thread about same subject? Question two, what's your understanding of VLANs? Do you perhaps use that term just to refer to some isolated networks and not "real" VLANs? Because so far it doesn't seem that you'd need the latter. Just remove ports from bridge (if you start with default config where they are bridged), configure addresses and possibly routes as needed, use IP firewall to block or allow access between them as needed, and that should be it.

hello Mr Sob ..! thanks again for your answer...! well in a nutshell what i mean is i want to separate my interface on my router using the switch chip that already included on it, so i want to get benefit from it . how can i do that ..?

Techsystem · Sat Sep 10, 2022 5:12 pm

A bridge is not required, vlans are not required, its up to you.

If you have single Subnet going to single ports, just assign them individually
Ether1-wan
ether2- subnet1
ether3-subnet2
ether4-subnet3
ether5-subnet4.

When at least two ports will use the same subnet (such as 2,3) then it makes sense to be efficient with rules and the like and a bridge starts to be practical In this case the bridge handles the DHCP address etc for the ports.
Ether1-wan
ether4-subnet3
ether5-subnet4.
add bridge
bridge ports interface=ether2 (subnet1)
bridge ports interface=ether3 (subnet1).

When you have more subnets than ports or if you want to send several subnets over one port, then vlans make sense.

There is no harm in practicing with bridges and vlans even if you only have one subnet, if that is your desire.

ether1=wan
bridge ports interface=ether2 pvid=11 ( where subnet1 is vlan 11)
bridge ports interface=ether3 pvid=11
bridge ports interface=ether4 pvid=11
bridge ports interface=ether5 pvid=11

What I dont tolerate well is mixing apples and oranges and that is using the bridge for some ports with no vlans and then using the bridge with vlans for other ports.
As soon as you start using vlans, dont use the bridge for anything other than bridge (aka no dhcp etc.........)

Hello again Anav...! so what i want to achieve is to get benefit from a switch chip that my router already have. so i want to separate my interface using this switch chip without using firewall

Sob · Sat Sep 10, 2022 5:25 pm

Advantage of hardware switch is fast processing of traffic between different ports. If you want two independent ports, there's no work for switch there.

Techsystem · Sun Sep 11, 2022 6:12 am

but as you know by default the traffic processing is in CPU not in this chip as far you are not using any bridge, or didn't setup an bridge interface for traffic...!

Buckeye · Sun Sep 11, 2022 10:33 am

what i want to achieve is to get benefit from a switch chip that my router already have. so i want to separate my interface using this switch chip without using firewall

Because you keep repeating the same question, it seems that we are not understanding what your question means.

A quote from George Pólya's book How To Solve It "It is foolish to answer a question that you do not understand. It is sad to work for an end that you do not desire." So be sure to give enough infomation so we understand the problem and your requirements and avoid the xy_problem.

Perhaps if you can give us a concrete example of a problem you are trying to solve, then someone can give an answer to your real question. Are you wanting two access ports in the same broadcast domain from being able to see each other? That isn't what you asked. You asked about different vlans, which are separate broadcast domains. Are you really asking about Port isolation? Like in this video Port Isolation in MikroTik I am not sure the switch in the RB951 supports port isolation or not. The block diagram shows it uses an Atheros9344 SoC.

Techsystem · Sun Sep 11, 2022 7:33 pm

hello Mr Buckeye..! so yes it seems that i couldn't explain what i really want clearly enough... yet in my first comment i try to explain what is the exact behavior that i want to achieve in my 951ui rb, and for the second time and in more simple way that's whatn i want : i want to separate three interface -(three ethernet port)- in my RB951ui from each other using VLANs . so do you have any efficient way to implement that ..?

yes i admit ..Maybe i do that but don't blame me on this, there is alot of content out there that explain a bout VLANs and that make me a kind of confused

i have four ethernet port. eth1 is out interface, eth2 is data interface eth3 is wifi interface and eth4 is pbx interface and i want to separate all eth2 & eth3 &eth4 interface using VLANs. in my current situation now all this interfaces is separated using Firewall so i drop in and out ping and packet from each interface, so that's why i am asking about VLANs to separate those interfaec by VLANs

Sob · Sun Sep 11, 2022 7:50 pm

Do I understand correctly that now you have three independent ports (not bridged), each with own IP subnet? Because if you do, they are already separated as much as they can be and neither VLANs or switch chip can separate them more, because any communication between them uses routing and that's on different level.

Techsystem · Sun Sep 11, 2022 10:50 pm

hi sob..! depending on my understand of VLANs -( maybe this is wrong so please correct me)- ""when we create VLAN1 and VLAN2 forexample we can't reach VLAN1 from VLAN2 and visa versa until we introduce a gateway between two VLANS. so this two VLANs is completely separated from each other, so we don't need to create any firewall rule and add more load to CPU.
is this correct..?

Sob · Sun Sep 11, 2022 11:59 pm

It's not incorrect, but it doesn't help you, because here the router is such gateway. Untagged VLANs (access ports) are separated exactly same as physical ethernet ports, i.e. if you don't configure any IP addresses and just plug some devices in them, they won't be able to communicate. But once you add IP addresses and make the router gateway for connected devices, there's no isolation at this level, because router by default routes everything it can. And if you don't want that, you need firewall to block it.

Some isolation can be done also using VRF, but I wouldn't say that it's simpler at all. And if your goal is to make things more efficient using switch, this won't help with that either.

Buckeye · Mon Sep 12, 2022 1:00 am

i have four ethernet port. eth1 is out interface, eth2 is data interface eth3 is wifi interface and eth4 is pbx interface and i want to separate all eth2 & eth3 &eth4 interface using VLANs. in my current situation now all this interfaces is separated using Firewall so i drop in and out ping and packet from each interface, so that's why i am asking about VLANs to separate those interfaec by VLANs

You still didn't provide any details. And you are still asking an XY problem type question (thinking that using vlans is the solution to the problem). Do eth2, eth3, and eth4 all have ip addresses that are in separate subnets? If so, then traffic between them will need to be routed (that gateway that was mentioned). If there is no firewall in place to prevent this traffic from being routed, the router will route the traffic it can; that is what a router does.

@Sob gave you the correct answer several times.

Head over to Ed Harmoush's Practical Networking site https://www.practicalnetworking.net Ed has recently started a Networking Fundamentals course and he is putting the first module (with multiple videos) on Youtube. It's a good intro with very little assumptions about previous knowledge, and even if you think you already know this stuff, if you watch it, and give it your utmost attention, you will probably get a deeper understanding than you currently have. Ed has some of the best explained info about vlans Virtual Local Area Networks (VLANs) See the challenge quiz if you think you understand vlans. Ed also has a video covering the same info VLANs – the simplest explanation Here's an index to the vlan pages on PracticalNetworking And here's a good starting point for Networking topics in general (don't be put off by the CCNA, this is pretty generic info that you need to know, and explained in an easy to understand way. CCNA Index (The ACL stuff is Cisco spedific, and unless you use Cisco, probably isn't worth reading).

anav · Mon Sep 12, 2022 2:45 am

You need to understand L2 traffic at the mac address level and L3 traffic at the IP level, roughly speaking.
To ensure separation at L2 vlans by their nature do that,
To ensure separation at L3 you need firewall rules to ensure the router doesnt route traffic from one vlan to another.

Techsystem · Mon Sep 12, 2022 5:58 am

i have four ethernet port. eth1 is out interface, eth2 is data interface eth3 is wifi interface and eth4 is pbx interface and i want to separate all eth2 & eth3 &eth4 interface using VLANs. in my current situation now all this interfaces is separated using Firewall so i drop in and out ping and packet from each interface, so that's why i am asking about VLANs to separate those interfaec by VLANs
You still didn't provide any details. And you are still asking an XY problem type question (thinking that using vlans is the solution to the problem). Do eth2, eth3, and eth4 all have ip addresses that are in separate subnets? If so, then traffic between them will need to be routed (that gateway that was mentioned). If there is no firewall in place to prevent this traffic from being routed, the router will route the traffic it can; that is what a router does.

yes it has ..eth2=192.168.10.1/24-from this port there is a patch cord goes to CAMs switches
eth3=192.168.20.1/24-from this port there is a patch cord goes to DATA swittches
eth4=192.168.30.1/23-from this port there is a patch cord goes to WIFI swittches -(poe switch with access points connected to it)-

for the third times..there is a firewall rules that make all this interface separated from each others -(so no ping and no packet flow between them)- SO is there another way that i can use to achive this separation..? my suggestion was using VLANs but it seems that i don't know what VLANs is . SO is there is another way..?
@Sob gave you the correct answer several times.

Head over to Ed Harmoush's Practical Networking site https://www.practicalnetworking.net Ed has recently started a Networking Fundamentals course and he is putting the first module (with multiple videos) on Youtube. It's a good intro with very little assumptions about previous knowledge, and even if you think you already know this stuff, if you watch it, and give it your utmost attention, you will probably get a deeper understanding than you currently have. Ed has some of the best explained info about vlans Virtual Local Area Networks (VLANs) See the challenge quiz if you think you understand vlans. Ed also has a video covering the same info VLANs – the simplest explanation Here's an index to the vlan pages on PracticalNetworking And here's a good starting point for Networking topics in general (don't be put off by the CCNA, this is pretty generic info that you need to know, and explained in an easy to understand way. CCNA Index

anav · Mon Sep 12, 2022 1:23 pm

[quote=Techsystem post_id=956485 time=1662951536 user_id=195215
for the third times..there is a firewall rules that make all this interface separated from each others -(so no ping and no packet flow between them)- SO is there another way that i can use to achive this separation..? my suggestion was using VLANs but it seems that i don't know what VLANs is . SO is there is another way..?[/b]
[/quote]
As stated there are two concerns separating traffic at layer 2 and separating traffic at layer 3.
VLANs are handy because they separate traffic at layer 2 due to the fact that they are independent entities from all other traffic (each has its own tunnel or path).
However the router knows where all the interface are located and therefore attempts to connect all requests to its interfaces (hence its name).
Therefore one has to use firewall rules to stop the router from connecting interfaces. This is true for any interface on the router, vlan or not.
THis is easily accomplished by drop all rules at the end of the forward chain which blocks all vlan to vlan traffic.
All one needs to do is add ahead of this rule any traffic they want to have, be it vlan to WAN or lets say vlans to a shared printer on one vlan.

mkx · Mon Sep 12, 2022 6:08 pm

there is a firewall rules that make all this interface separated from each others -(so no ping and no packet flow between them)- SO is there another way that i can use to achive this separation..?

As a few people already mentioned ... and I'll rephrase it slightly differently, perhaps it'll be easier to understand.

If communication between devices in different IP subnets should not happen, then it is necessary to block it on IP level. That's role of IP firewall.
If communication between devices in different ethernet segments should not happen, then those ethernet segments should be connected to different interfaces of firewall. Having ether3-5 configured in stand-alone manner (i.e. not part of bridge) this is already achieved.
If devices have to share physical ethernet infrastructure (e.g. because of lack of cabling), then it is possible to achieve separation on ethernet level by introducing VLANs ... together with switches that can work with VLANs. In this case different VLANs are "connected" to differentVLAN interfaces (they are kind of virtual interfaces) on router.

Items #2 and #3 are interchangeable and complementary (can be either of them or both of them), but item #1 has to be there always.

Which in essence means that you current config is just fine, VLANs (just because) won't give any improvement.

separate two interface in same router using VLANs

separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Re: separate two interface in same router using VLANs

Who is online