VLAN an’ Network Segmentation

Here ya’ll split a network into segments an’ figure out which traffic gets to ride through. Ya need da address, prefix, gateway, an’ port from IP, subnets, an’ default gateway an’ network protocols.

Start off with da VLAN example, Task 1, an’ da firewall drill. Da trail is access plan listin’ what traffic’s allowed in an’ what stays out. Makkin’ any real changes needs its own blessed test setup an’ a way back ta how it was before. If ya don’t got that kind o’ access, use da example fer plannin’; ya ain’t touchin’ da school’s net. Subnet math an’ DHCP setup are optional rides.

Why Segment?

Segmentation splits the network into smaller chunks. VLANs separate traffic at layer 2. A router or layer-3 switch can still pass traffic between ‘em, but firewalls or access rules decide what’s actually allowed through.

What’s a VLAN?

A virtual local area network (Virtual Local Area Network, VLAN) splits up one physical switch into logical networks. The VLAN ID marks which VLAN the traffic belongs to. You got to steer access between VLANs on top of that too.

Video: How a VLAN Splits Up a Physical Network

The video explains how a VLAN divides one physical network into multiple logical networks and separates the traffic between them.

In this example, each VLAN uses its own IPv4 subnet:

Tagged vs. Untagged Traffic

So that VLANs work across multiple switches (or between a switch and router), taggin’ gets used:

A regular ol’ PC usually hooks up to an access port without markin’ its own traffic with a VLAN ID. A trunk can carry several allowed VLANs, not necessarily ‘em all. A trunk might also have an untagged, so-called native VLAN. Check out the actual setup on the port profile before you try to figure out where the traffic is headed.

Task 1 - See VLANs in Practice

Got permission to read the network setup in UniFi or another tool? Go check it out without touchin’ a thing:

• Look at which VLANs are configured
• Which ports is set as access, and which ones be trunk?
• Compare the PC’s IP setup with the subnet and port profile. The IP address alone don’t confirm the VLAN membership.

Without admin access: Use the example table. A client has the address 10.0.30.10/24 and gateway 10.0.30.1. Which of the examples subnets does that fit into, and what kind of port would you pick for a regular ol’ PC? Expected answer is the student subnet and an access port on VLAN 30. This here is just interpretin’ the example, not measurin’ your own net.

Firewall Rules Between VLANs

First, describe who is supposed to start a connection, what the destination is, and which protocol/port it uses. A generic label like “employees to servers” is too broad to configure directly. The table is an example policy that must be made specific:

Return traffic doesn’t mean the server gets to start new connections to everyone. Rules for established/related and the order of rules must fit the firewall. Traffic between devices in the same VLAN usually doesn’t go through the firewall controlling routing between VLANs.

This here’s the final policy we want, ain’t no call for throwin’ a wide block on first in a network that’s already up an’ runnin’. Keep them needed admin bits, DNS, an’ DHCP while we tweak that limited test setup over there.

Exercise: Client via proxy, not directly to the app

Use these example roles or similar known values from a test environment:

The client should get access to open the app through the proxy, but not directly on the app port. Docker Level 3 shows how the proxy and app are set up and controlled. Write down the plan in its own document:

In this example, the proxy and app reside in the same VLAN. The connection between them is tested directly, but it isn’t governed by these rules across VLANs. A successful test through the proxy proves the app was reachable via that route; a failed direct test alone doesn’t prove the firewall blocked correctly.

Practical Test in an Approved Testing Environment

Use a already workin’ proxy/app setup. Jot down the usual state and current rules, and keep the console or other admin trail handy so ya can roll back any changes. Check the source, destination, port, direction, and rule order before messin’ with just one limited rule.

From the client side, you test the app name through the proxy. For direct access to the app, you can use:

curl --fail --show-error --connect-timeout 5 --max-time 10 http://10.0.50.20:5000/status

That address is straight from the example; swap it out for your test setup’s app address. Once that block goes in, this client shouldn’t be able to establish an HTTP connection. A timeout could have other causes on top of that; compare the results with the firewall log or rule counter when the tool spits one out, and make sure the app still answers through the proxy while you’re at it. If you get a HTTP 404 or 500 off the app port, that means the HTTP connection made it across, even if curl --fail throws a fit.

Checkpoint: Planned vs. Actual Access

Show both tests with source, target, expected result, and actual outcome. Explain the rule and what the tests confirm. When there’s a discrepancy, check one rule or one traffic path at a time and repeat the verification. Roll back if the change breaks required access.

If you’ve only used the example, mark the results as expected and explain which trials are still outstanding. The plan is set in stone then, but implementation and actual effect ain’t been demonstrated yet. Subnet calculation and DHCP below are optional add-ons after this checkpoint.

Subnettin’

Re-election: Use [[Level 3 Protocols - IP, Subnet, and Default Gateway|IP and Subnets]] when you need to pick a different address range. The numbers below apply to regular IPv4 subnets and show the count of host addresses after the network and broadcast addresses:

Task 2 - Calculate a Subnet

Optional calculation exercise: Use the method from the IP lookup or a subnet calculator, such as subnet-calculator.com:

• Enter 10.0.60.0 with mask /24. How many addresses do you get?
• What happens if you change it to /25? Or /23?
• Which one would ya pick fer a classroom with 30 students?

Check: /24 gives 254 host addresses, /25 gives 126 and /23 gives 510. Justify yer choice based on all devices that need an address, including the gateway and other gear; the number of students ain’t the whole address requirement.

DHCP per VLAN

Optional lookup: Clients that need to get their IP setup automatic-like require a DHCP that hands out the right settings for the subnet. Static addresses don’t need no DHCP. Network services and server roles explains what DHCP is all about along with reservations.

Here’s an example fer the Student VLAN:

Summary

• Segmentation splits the network into parts where traffic can be controlled.
• A VLAN is a virtual network on the same physical switch.
• Access ports connect devices to one VLAN; trunk ports carry multiple VLANs.
• Firewall rules determine what’s allowed between VLANs.
• In this example, each VLAN has its own subnet; DHCP applies when addresses are assigned automatically.
• Final policy: block unnecessary traffic and allow agreed-upon services.

Sources: UniFi: access rules and return traffic and access/trunk ports.