I would like to separate several hosts from the local network and put them behind a firewall. I would like to use VLANs to "physically" separate them instead of using just different subnets. My idea is to use a switch that supports VLANs, and build up the network like this:
P1 and P2, P3 and P4 are four different hosts that belong to two separate, "physical" networks (VLAN 1 and 2). They should be protected by firewall/gateway on P5.
P5 should act as firewall/gateway that controls the data between the separated hosts and the existing network. It only has one NIC that needs to connect to the existing network (no VLAN) and the two VLANs.
P6 is the uplink to the existing network.
My questions now are:
- Can this idea work as expected (given a correct configuration) – i.e., that the host on P5 can have multiple IPs/be part of multiple networks with just a single NIC, that it acts as gateway/firewall between the separated hosts and the existing network, and if there are no pitfalls/flaws that I didn't consider which might allow data flow between networks bypassing the firewall?
- I guess the switch needs to be able to support tagged VLAN (instead of just port-based VLAN) because of P5?
Best Answer
Yes and yes.
This is the setup I have at home. P5 is connected to small factor PC running Linux and doing the routing, firewalling and serving as DHCP and DNS server.