Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm not a network wizard, but I know my way around a TCP stack and have employed the help of Wireshark and tcpdump quite a few times. Now my company has been tasked to grant somebody else access to several machines in our DMZ via VPN.

For the optimal protection of our infrastructure, I had the idea to allow access only to the required machines and not the whole network segment. For that, we could maybe use a VLAN. However, I am not fluid in it.

My question(s) is/are: Apart from the required router capabilities (which I will check tomorrow), is it possible to build a VLAN with machines in the same subnet, yet have non-sequential IP addresses, without interfering with the machines' original access throughout their own network segment? And if so, is it theoretically possible to access one of these machines through the VLAN, then use this machine (with maybe RDP) to access other machines not in the VLAN, because the machines should still be able to interoperate will all machines in their network segment, not just the VLANed ones?

I really hope I made my question clear.

If the access limitation stated above is not possible, we will implement this via specific firewall rules for every accessible machine.

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

'is it possible to build a VLAN with machines in the same subnet, yet have non-sequential IP addresses'

Yes, VLANs are a Layer 2 thing, they don't care one jot about anything to do with IP, though you could make things overly complex if you don't plan this right.

'is it theoretically possible to access one of these machines through the VLAN, then use this machine (with maybe RDP) to access other machines not in the VLAN'

Yes, if your routing is setup correctly.

So yes you can do this but it may well not be the best way to actually do it, mostly in terms of safety. VLAN boundarys can, in some circumstances, be hacked on a trunk line, exposing one to another, which is enough to stop people using VLANing solely as a viable security method. Personally I'd be more tempted to trunk the VLAN to your firewalls and then let your routers/L3-switches break the traffic into VLANs from there.

share|improve this answer
    
Thank you for answering. I see the second point, the hopping onto other machines by accessing their (say) network shares when using one of the machines in the VLAN via RDP as a security risk. However, it might not be possible to prevent this on lower layers, this might be an application layer problem. Am I right? –  Dabu Jun 30 '11 at 9:16
add comment

(Oh boy....)

It's kind of hard to read your question, but I'm guessing that you want to move servers from VLAN 1 to VLAN 2, and keep the IP addresses. That is not possible, unless you use NAT with two different routers. This is something you really do not want, as you'll have to set up port forwarding between subnets. Ugly.

What you are loooking for is a firewall with more than two interfaces, so that you can control who goes where. I'm afraid you'll have to change the network subnet on one of the VLAN's either way.

share|improve this answer
    
Thanks for answering, however, you misunderstood me. There is currently no VLAN, it's just a normal DMZ with several machines on different IP addresses. Now a customer needs access to some of them, so we plan to provide this with a VPN Tunnel between their network and our DMZ, and want to limit the access of the customer over VPN to only the machines he actually needs access to. –  Dabu Jun 30 '11 at 9:15
    
Ok. Thats done with ACL's on the firewall infront of the DMZ (wich i'm guessing is also the VPN terminator?) –  pauska Jun 30 '11 at 9:16
    
You're guessing right. We already have a VPN tunnel from our site to this DMZ running. –  Dabu Jun 30 '11 at 9:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.