Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Given n (e.g. 200) clients in a /24 subnet and the following network structure:

client 1 \
.         \
.          switch -- firewall
.         / 
client n /

(in words: all clients connected to one switch and the switch connected to the firewall)

Now by default, e.g. client 1 and client n can communicate directly using the switch, without any packets ever arriving the firewall. Therefore none of those packets could be filtered. However I would like to filter the packets between the clients, therefore I want to disallow any direct communication between the clients.

I know this is possible using vlans, but then - according to my understanding - I would have to put all clients in their own network. However I don't even have that much IP addresses: I have about 200 clients, only a /24 subnet and all clients shall have public ip addresses, therefore I can't just create a private network for each of them (well, maybe using some NAT, but I'd like to avoid that).

So, is there any way to tell the switch: Forward all packets to the firewall, don't allow direct communication between clients? Thanks for any hint!

share|improve this question

5 Answers 5

up vote 3 down vote accepted

You can separate clients within a VLANM if your switch supports PVLAN (private VLAN) which can be configured to allow any host to talk to the firewall while being unable to communicate with any other device. You can additionally configure your PVLAN to also allow communication amongst limited groups of servers.

What sort of switch are you using?

share|improve this answer
It's an HP Procurve 4108gl out of the 4100gl series. should be layer 2 with some limited layer 3 capabilities, but I am not quite sure. Found lots of manuals, but I am missing some kind of features overview for it. do you know if it's also called "PVLAN" on HP switches? Thanks :-) – Jun 3 '12 at 14:47
This link seems to imply that PVLAN's aren't a feature of that switch: In addition, this link seems to imply that the switch only supports 30 VLAN's: – joeqwerty Jun 3 '12 at 14:59
Thank you, the 30 VLANs maximum wouldn't have been a problem, one big vlan and client isolation in this vlan would have been enough. I assume you didn't find anything like PVLAN or did you find something explicitely stating "not available"? Thanks :-) – Jun 3 '12 at 15:08

You may need a different switch in order to implement PVLAN's. Below is a link to Cisco's product matrix for Cisco switches that support PVLAN's:

And here's a link to a Cisco Catalyst 2948G at

share|improve this answer
interesting, not that expensive :-) however, before buying a new switch I simply won't implement such a limitation - would have been nice if it was possible, but it's not totally necessary here. Anyway, I learned something new here :-) – Jun 3 '12 at 15:11

When the clients are connected to the same switch, they will communicate with each other via passing through the firewall. You can not tell the switch to forward the traffic to the firewall to be filtered. The switch is transparent to the client and firewall in the network.

You need to distribute the clients in different subnets in order to do some filtering at layer 3 (IP). So, using VLANs is the best option in this case. If you need to use public IPs and you don't have much of them, you can just assign private IPs and do NAT on the firewall.

share|improve this answer

Hosts do not have to be in separate subnets in order to have a firewall between them.

Firewalls come in different flavors such as a routing firewall or a bridging firewall. When firewalls are mentioned without specifying which kind, it is generally assumed you mean a routing firewall. But in order to firewall traffic between hosts on a single subnet, what you need is a bridging firewall. Some firewalls are capable of acting as both a routing firewall and a bridging firewall at the same time.

A routing firewall is a router which can filter packets based on a set of rules.

A bridging firewall is a switch which can filter packets based on a set of rules.

The best performance would be achieved if the switch interconnecting the hosts could itself act as a bridging firewall. However assuming performance isn't a high priority and you need to keep using the same switch, you can look at other options.

By putting each host on a separate VLAN and tagging all the traffic on the port connected to the firewall, you will then be able to configure the firewall to act as a bridging firewall. (Assuming your firewall is capable of acting as a bridging firewall).

Such a setup requires nothing more from the switch than VLAN support. It does touch one corner case of VLAN switching which is easy to overlook in the design which means it is conceivable that some switches have a design flaw preventing them from working correctly with a bridging firewall between the VLANs. The tricky part is that every single MAC address will be visible to the switch on different ports depending on which VLAN tag is used. If the switch uses only destination MAC address as key when looking up in the CAM it will not work, a correctly implemented VLAN capable switch uses the combination of VLAN tag and MAC address as key for CAM lookups.

share|improve this answer

I would solve otherwise. I precede to install a PPPoE server, which all clients are isolated because they are in a tunnel and have to connect to the server

share|improve this answer
Would you care to elaborate? – Deer Hunter Jul 16 at 6:57
I can't see why anybody would want such a solution, when there are alternatives which are transparent to the clients. – kasperd Jul 16 at 11:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.