I'm not a network wizard, but I know my way around a TCP stack and have employed the help of Wireshark and tcpdump quite a few times. Now my company has been tasked to grant somebody else access to several machines in our DMZ via VPN.
For the optimal protection of our infrastructure, I had the idea to allow access only to the required machines and not the whole network segment. For that, we could maybe use a VLAN. However, I am not fluid in it.
My question(s) is/are: Apart from the required router capabilities (which I will check tomorrow), is it possible to build a VLAN with machines in the same subnet, yet have non-sequential IP addresses, without interfering with the machines' original access throughout their own network segment? And if so, is it theoretically possible to access one of these machines through the VLAN, then use this machine (with maybe RDP) to access other machines not in the VLAN, because the machines should still be able to interoperate will all machines in their network segment, not just the VLANed ones?
I really hope I made my question clear.
If the access limitation stated above is not possible, we will implement this via specific firewall rules for every accessible machine.