Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on a project regarding Network Security and I've come to the topic regarding VLANs.

I was wondering if it is possible to set up multiple VLANs (VLAN0, 10, 20, 30) in a way that all VLANs can communicate with VLAN0 but not with eachother?

Thanks in Advance!

share|improve this question

Yes, It is possible to do that. Example in cisco product, you use something call Access List (ACL), ie

access-list 101 permit ip <vlan10 net> <mask> <vlan0 net> mask
access-list 101 permit ip <vlan20 net> <mask> <vlan0 net> mask
access-list 101 deny ip any any

Or if you only one VLAN 10 communicate with VLAN 20, add this line

access-list 101 permit ip <vlan10 net> <mask> <vlan20 net> mask

But remember to put it above the last line.

Best Regards.

share|improve this answer
This allows the VLAN to only communicate to one specific VLAN? Not giving them the ability to talk to the other VLANs? – Dempsey FoxDie Van Assche May 10 '13 at 14:31
You will add more lines into access-list to do that, have you ever tried? – cuonglm May 10 '13 at 14:32
I will, now that I know how. Thank u. – Dempsey FoxDie Van Assche May 10 '13 at 14:34
Technically, I don't think you can do this with VLAN0 as it is a reserved VLAN ID for COS/QoS. But you can certainly setup access lists to limit traffic with any other valid VLAN ID. – Rex May 10 '13 at 14:37
The basic idea is that in one VLAN you have the DHCP Server, AD, Shares, etc... I want the other VLANs to be able to communicate with the servers there. However, each VLAN must not be allowed to communicate (view) computers in other VLANs other than the VLAN that has the DHCP, AD, Shares, etc.. I believe the Access List is indeed what I was looking for... – Dempsey FoxDie Van Assche May 10 '13 at 14:41

Yes, this is entirely possible, in many ways. In Cisco terminology, you should search for settings related to isolated VLANs (vs private VLANs which isolate a single port from talking to any ports other than the one configured).

In addition to the other answer which suggests using ACLs, it should be noted that you can easily do this by controlling your routing, provided the router that interconnects the VLANs is not the same device(switch) that has the VLANs on it (and that we are actually talking about distinct subnetworks here, which are often confused with VLANs, but are totally different).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.