Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't know much about TCP/IP and what I'm trying to do seems fairly basic to me but I can't seem to figure it out.

I have one central router connecting to my ISP, and all computers connected to this router are currently able to see each other. I would like to isolate one of the physical ports so that computers connected to this specific port can't see the rest of the network, but are still able to access the internet.

The isolated network will be connected via a managed switch (GS105E). The switch can configure VLANs based on ports and 802.1Q, but I have no clue if that's what I need in order to achieve what I'm after.

So far when I create a different VLAN, the computers on that network can't use the DCHP server and can't connect to the internet.

A possible solution is to add another router instead of the switch, but I was hoping the switch would be able to provide a more efficient and lightweight solution to this.

Is it possible to do this with one router and one switch? Or do I really need 2 routers to create 2 networks?

share|improve this question

migrated from Mar 19 '11 at 13:32

This question came from our site for professional and enthusiast programmers.

Your router should be able to put port(s) to different VLANs. Say, there are 3 computers A, B, C and a router R. If you want to allow A and B see each other, but isolate them from C, you have an option to add both A and B to vlan1 and C to vlan2. You also need to include R to vlan1 and vlan2 so that both VLANs are able to connect to R. No extra routers are needed.

share|improve this answer
By default, the router will happily route traffic between A,B on one side and C on the other. However, broadcast traffic will not pass between the two VLANs. – Vatine Jun 17 '11 at 11:35

What isn't entirely clear is if your "physical port" is a port on the router or a port in your switch fabric, the right answer changes subtly depending on this. You are, however, talking about VLANs and that makes me suspect it's a port in your switch fabric.

If it's a port in your switch fabric, you need to configure trunking from that port to the central router. You will also need to have one of "trunk ports with native VLAN" or "put all other ports in another VLAN". You will then need to configure two VLANs inside the central router, one for the new and one (possibly untouched) for the existing LAN. After that, you need to filter traffic from the new VLAN to the old.

If it's a physical port, you configure the new port with an IP address range that isn't in use on the existing LAN (or at least will not be in use, afterwards), then configure access-lists (filtering, basically) stopping traffic from the new to the old.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.