Virtual LANs & Network Segmentation

Skip to content

Avast ye! This be a machine-translated text, an’ it may contain errors, aye!

Aye, picture a school network where students, teachers, administration, and IoT devices (printers, smart boards, cameras) all share the same network. All can see each other, in theory. ‘Tis neither secure nor efficient, it be. The solution be segmentation.

Why Segment, Aye?

Segmentin’ be meanin’ to split yer network into smaller pieces, see? Each piece be isolated from the others, so traffic don’t flow freely between ‘em.

Benefit Explanation
Security A compromised IoT camera can’t reach the servers, savvy?
Performance Less broadcast traffic per segment
Control Different rules for different groups o’ users
Troubleshooting Easier to isolate problems to a specific segment

A useful treasure map

In a school, the network might look like this:

  • VLAN 10: Administration - Pay, HR, and the captains. Access be strictly guarded.
  • VLAN 20: Crew - Teachers and other hands on deck. Access to shared booty and printers.
  • VLAN 30: Scallywags - Only internet access and learning platforms.
  • VLAN 40: IoT - Printers, smart screens, and spyglasses. No internet access (or very limited, indeed).
  • VLAN 50: Servers - Internal servers, unreachable directly from other VLANs.

What be a VLAN?

VLAN stands fer Virtual Local Area Network. It’s a way ta’ create many logical networks on the same physical switch. Instead o’ buyin’ a separate switch fur each network, ye configure th’ switch t’ treat different ports (or traffic) as separate networks.

Each VLAN has its own address range (subnet):

VLAN Name Subnet Gateway
10 Administration 10.0.10.0/24 10.0.10.1
20 Crew Members 10.0.20.0/24 10.0.20.1
30 ‘s Apprentices 10.0.30.0/24 10.0.30.1
40 IoT 10.0.40.0/24 10.0.40.1
50 Servers 10.0.50.0/24 10.0.50.1

Subnetting short and sweet

/24 means the first 24 bits be the network part o’ the address. In practice, it means ye have 254 available addresses (.1 to .254) in every VLAN.

  • 10.0.10.0/24 gives addresses from 10.0.10.1 to 10.0.10.254
  • The Gateway be usually the first address (.1)

Taged versus Untagged Traffic

To make VLANs work across multiple switches (or between a switch and a router), ye be usin’ taging:

Type Explanation Use
Untagged (access) The port belongs ter one VLAN. Th’ device knows naught of VLANs. PCs, printers, telephones
Taged (trunk) The port carries traffic from several VLANs, marked with th’ VLAN ID. Between swiches, towards routers

Devices such as PCs an’ printers needna know they’re on a VLAN. They connect ter an “access” port which ha’s been assigned the correct VLAN. Th’ connection betwixt two swiches or betwixt a switch an’ a router uses an “trunk” port that bears all th’ VLANs.

Easy Task 1 - Behold the VLAN in Practice

If ye have access to Unifi or another network management platform at the school:

  • Observe which VLANs be configured
  • Which ports be set as access, and which as trunk?
  • Try to discover which VLAN yer PC be connected to (hint: check yer IP address and compare with the subnet table)

Firewall Rules Between VLANs

Creatin’ VLANs be just half the work, aye. Without firewall rules, traffic can still flow between ‘em through the router/gateway. Ye must explicitly decide what be allowed:

From (source) To (destination) Allowed? Reasonin’
Students Internet ✅ Aye Needed for learnin’
Students Servers ❌ Nay Students need no access to servers
Staff Servers ✅ Aye File storage and internal systems
IoT Internet ❌ Nay (or limited) IoT devices rarely need the internet
IoT Students/Staff ❌ Nay IoT should be isolated
Servers All ✅ Aye (outbound) Servers can respond to requests

Standard: block all, allow what ye need

A hearty firewall policy begins with blockin’ all traffic ‘tween the VLANs, and then openin’ only what be needed. ‘Tis much safer than startin’ with all open and tryin’ to block what ye don’t want.

Subnetting

Each VLAN needs its own subnet, aye. A subnet defines the address range for the network:

Subnet Network Mask Number o’ Addresses Typical Use
/24 255.255.255.0 254 Most VLANs
/25 255.255.255.128 126 Smaller segment
/16 255.255.0.0 65 534 Large networks

Easy Task 2 - Calculate a Subnet

Use an online subnet calculator, such as subnet-calculator.com:

  • Enter 192.168.1.0 with mask /24. How many addresses do ye get?
  • What happens if ye change to /25? Or /23?
  • What would ye choose for a classroom with 30 scallywags?

Each Plank Needs Its Own Loot Map (DHCP)

Every single plank needs its own map to ensure every scallywag gets the proper coordinates for their part o’ the ship. Ye can set this up on yer captain’s wheel or a dedicated treasure chest server.

Example fer the Student Scallies:

Setting Treasure Maps
Subnet 10.0.30.0/24
Captain’s Wheel 10.0.30.1
Range of Crews 10.0.30.100 - 10.0.30.250
Spyglass Locations 1.1.1.1 / 8.8.8.8

Summary

  • Segmentation divides da network into isolated parts fer security an’ control
  • A VLAN be virtual networks onna same physical switch
  • Access ports connect devices to one VLAN, while Trunk Ports carry multiple VLANs
  • Firewall rules determine what’s allowed between tha VLANs
  • Each VLAN needs its own Subnet and DHCP configuration
  • Starting point: block all, allow only whut be needed