Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Given n (e.g. 200) clients in a /24 subnet and the following network structure:

client 1 \
.         \
.          switch -- firewall
.         / 
client n /

(in words: all clients connected to one switch and the switch connected to the firewall)

Now by default, e.g. client 1 and client n can communicate directly using the switch, without any packets ever arriving the firewall. Therefore none of those packets could be filtered. However I would like to filter the packets between the clients, therefore I want to disallow any direct communication between the clients.

I know this is possible using vlans, but then - according to my understanding - I would have to put all clients in their own network. However I don't even have that much IP addresses: I have about 200 clients, only a /24 subnet and all clients shall have public ip addresses, therefore I can't just create a private network for each of them (well, maybe using some NAT, but I'd like to avoid that).

So, is there any way to tell the switch: Forward all packets to the firewall, don't allow direct communication between clients? Thanks for any hint!

share|improve this question

3 Answers 3

up vote 3 down vote accepted

You can separate clients within a VLANM if your switch supports PVLAN (private VLAN) which can be configured to allow any host to talk to the firewall while being unable to communicate with any other device. You can additionally configure your PVLAN to also allow communication amongst limited groups of servers.

What sort of switch are you using?

share|improve this answer
It's an HP Procurve 4108gl out of the 4100gl series. should be layer 2 with some limited layer 3 capabilities, but I am not quite sure. Found lots of manuals, but I am missing some kind of features overview for it. do you know if it's also called "PVLAN" on HP switches? Thanks :-) –  stefan.at.wpf Jun 3 '12 at 14:47
This link seems to imply that PVLAN's aren't a feature of that switch: ftp.hp.com/pub/networking/software/59692376.pdf. In addition, this link seems to imply that the switch only supports 30 VLAN's: ftp.hp.com/pub/networking/software/59692378.pdf –  joeqwerty Jun 3 '12 at 14:59
Thank you, the 30 VLANs maximum wouldn't have been a problem, one big vlan and client isolation in this vlan would have been enough. I assume you didn't find anything like PVLAN or did you find something explicitely stating "not available"? Thanks :-) –  stefan.at.wpf Jun 3 '12 at 15:08

You may need a different switch in order to implement PVLAN's. Below is a link to Cisco's product matrix for Cisco switches that support PVLAN's:


And here's a link to a Cisco Catalyst 2948G at www.amazon.com:


share|improve this answer
interesting, not that expensive :-) however, before buying a new switch I simply won't implement such a limitation - would have been nice if it was possible, but it's not totally necessary here. Anyway, I learned something new here :-) –  stefan.at.wpf Jun 3 '12 at 15:11

When the clients are connected to the same switch, they will communicate with each other via passing through the firewall. You can not tell the switch to forward the traffic to the firewall to be filtered. The switch is transparent to the client and firewall in the network.

You need to distribute the clients in different subnets in order to do some filtering at layer 3 (IP). So, using VLANs is the best option in this case. If you need to use public IPs and you don't have much of them, you can just assign private IPs and do NAT on the firewall.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.