VLAN an’ Network Segmentation

Ye shall divide a network into segments an’ justify which traffic be allowed to pass through. Ye need address, prefix, gateway an’ port from IP, subnets an’ default gateway an’ network protocols.

Start with the VLAN example, Task 1 an’ the firewall drill. The base route be an access plan with expected permitted an’ blocked traffic. Practical changes require their own approved test environment an’ a way back to the previous setup. Without such access, use the example fer planning purposes only; ye must not alter the school’s net. Subnet calculation an’ DHCP configuration are optional choices.

Why Segment?

Segmentation splits the network into smaller pieces. VLANs separate traffic at Layer 2. A router or Layer-3 switch can still relay traffic between ‘em, but firewalls or access rules decide what’s actually allowed through.

What be a VLAN?

A virtual local network (Virtual Local Area Network, VLAN) splits one physical switch into logical networks. The VLAN ID marks which gang the traffic belongs to. Access between gangs must be controlled separately, ye scurvy dogs!

Video: How a VLAN splits up a physical network, matey!

The video, arr, explains how a VLAN carves one physical network into several logical networks and separates the traffic between ‘em like a true buccaneer would divide his treasure chest.

In this example here, each VLAN uses its own IPv4 subnet, ye scurvy dog:

Tagged vs. Untagged Traffic

In order fer VLANs to function across multiple switches (or between a switch an’ router), we use taggin’:

A common PC is often connected to an access port without markin’ its own traffic with a VLAN-ID. A trunk can carry several allowed crews, not necessarily all hands on deck. A trunk may also have an untagged, so-called native crew. Read the actual setup in the port profile before ye interpret the path of the traffic.

Task 1 – Spot the Vlan in action

Got a spyglass to peer into the network charts bein’ held by UniFi or another device o’ trade, ye scan without touchin’:

• Cast yer eye on which Vlan’s are rigged up
• Which ports be set as access, an’ which ones be trunk?
• Compare the shipmate’s IP riggin’ with the subnet an’ port profile. The IP address alone don’t confirm she belongs to that Vlan.

Without captain’s orders: Use the example chart below. A client holds the coordinates 10.0.30.10/24 and her homeport is 10.0.30.1. Which o’ the sample subnets does she fit into, an’ what kind o’ port would ye choose fer a regular deckhand? Ye expect the answer to be the apprentice crew’s quarter an’ an access port in Vlan 30. This be readin’ of the example map, not soundin’ ur own waters.

Firewallerules ‘twixt the V-L-A-N’s

First ye must declare who be startin’ a connection, to what destination, and on which protocol/port. A broad label like “crew to servers” be too coarse-grained fer direct configuration. The table below be an example policy that needs sharpening:

Return traffic doth NOT mean the server gets to launch new attacks at all hands. Rules fer established/related and the order o’ rules must match yer specific firewalls. Traffic ‘twixt nodes in same VLAN typically bypasses the firewall governin’ routing between V-L-A-N’s.

Arrr matey, this be the desired final policy, nothin’ like a broad blockade order on a network already in use! Keep yer necessary administration, DNS, an’ DHCP while ye tweak that limited test setup.

Drill: Client via proxy, not direct to the app

Use these example roles or similar known values from a test environment:

The client must be able to open the app through the proxy, but not directly on the app port. Docker Level 3 shows how the proxy and app are set up and controlled. Write the plan in its own document:

Proxy and app lie in the same VLAN in this example. The connection between them is tested directly, but is not steered by these rules between VLANs. A successful test through the proxy proves that the app was reachable via this route; a failed direct test alone does not prove that the firewall blocked correctly.

Hands-on trial in a sanctioned testing grounds

Utilize an already functional proxy/app rig. Jot down the standard state and current regulations, keep ye console or other command path handy so th’ changes can be rolled back. Check source, destination, port, direction, an’ rule order afore ye alter one specific regulation.

From me client, I’ll test the app name through t’proxy. For direct access to t’app, ye may use:

curl --fail --show-error --connect-timeout 5 --max-time 10 http://10.0.50.20:5000/status

The address be from the example; swap it for the test environment’s ship address. After the blockade, this client shall not forge a HTTP connection. A timeout may have other causes; compare ye results with the firewall log or rule counter when the tool gives ‘em, and check that the app still answers through the proxy as well. HTTP 404 or 500 from the app port shows that the HTTP connection reached its mark, even if curl --fail ends in failure.

Checkpoint: Planned vs Actual Access

Show both tests with source, target, expected result, an’ actual outcome. Explain the rule an’ what the tests confirm. If there’s a discrepancy, ye inspect one rule or one traffic path at a time an’ repeat the check. Roll back if the change breaks necessary access.

If ye’ve only used the example, mark the results as expected an’ explain which trials remain. The plan is ready then, but implementation an’ actual effect ain’t demonstrated. Subnet calculation an’ DHCP below are optional extensions after this checkpoint.

Subnettin’

Re-election: Ye shall use [[Protocols Level 3 - IP, subnets and default gateway|IP an’ subnets]] when ye be choosin’ a different address range. The numbers below concern common IPv4 subnets an’ show the count o’ host addresses after the network an’ broadcast addresses:

Task 2 - Calculate a Subnet

Optional calculation exercise: Use the method from the IP lookup or a subnet calculator, fer instance subnet-calculator.com:

• Enter 10.0.60.0 with mask /24. How many addresses do ye get?
• What befalls if ye change to /25? Or /23?
• Which would ye choose for a classroom with 30 lads and lassies?

Check: /24 yields 254 host addresses, /25 yields 126 an’ /23 yields 510. Justify yer choice based on all devices that need an address, including the gateway an’ other gear; the number o’ students ain’t the whole address requirement.

DHCP fer VLAN

Optional lookup: Clients who needs to get their IP setup automatic like a breeze, they need DHCP that gives ‘em the right configuration fer the subnetwork them there. Static addresses don’t require no DHCP. Network Services an’ Server Roles explains on about DHCP an’ reservations.

Example fer the Student-VLAN:

Summary

• Segmentation splits the network into parts where traffic can be controlled
• VLANs are virtual networks on the same physical switch
• Access ports connect devices to one VLAN, trunk ports carry multiple VLANs
• Firewall rules determine what is allowed between the VLANs
• In this example, each VLAN has its own subnet; DHCP is relevant when addresses are assigned automatically
• Final policy: block unnecessary traffic, allow the agreed-upon services

Sources: UniFi: access rules and return traffic and access/trunk ports.