Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is the setup:

ISP -> WRT -> Switch: Box 1,2,3...

I need to let box 3 out on then internet and I need to forward a port or two to box 3.

I found some information on setting up a vlan by port, but I need (guessing) is a vlan by MAC. There is no way to physically go from box 3 to the WRT or I would have done that already.

Any input would be appreciated.

Specs: ASUS WL-520GL running DD-WRT v24-sp1 (07/27/08) vpn

share|improve this question
D’oh it doesn’t sound like this is possible with the current setup. The switch is of the dumb variety. – NitroxDM Sep 23 '09 at 16:03

From your comments to the other answers, it seems that what you want to set up is a DMZ. The only way to control and isolate Box3 would be via firewall rules, forcing the connections to go through the WRT and handling the filtering there. As long as they are connected through a dumb switch, Box3 would be able to communicate with Box1 and Box2 directly.

share|improve this answer
D'oh! The switch is dumb. – NitroxDM Sep 23 '09 at 16:05

If you do not need to let boxes 1 and 2 to the Internet, then set 2 IPs on box 3 on a different (sub)nets, and use one of the subnets for internal traffic, and the other one only for WRT and box3.

I.e. WRT (internal IP) -

Box 3 - 2 IPs on the same interface - and

Box 2 -

Box 1 -

If you need Box2 and Box1 to have access to internet, set some routing (NATing) on Box3, and make it default gateway for 1 and 2.

As you not say what OS you have on these boxes:

  1. Windows - you can use internet connection sharing to set Box3 to share it's connection to the WRT.

  2. *nix - set a proper routing rules with iptables to NAT all requests from 192.168.1.x network trough

share|improve this answer
That would work but all the boxes need to access the internet. – NitroxDM Sep 22 '09 at 21:36
edited the answer. – Sunny Sep 23 '09 at 21:11
Wouldn't box 3 still be able to access 1 and 2 because of the 192.168.1.x address? – NitroxDM Sep 24 '09 at 14:35

I don't think you'll need to mess with vlans...

  1. Give box3 a statically mapped IP in the wrt's dhcp server
  2. Forward the ports to that IP
  3. You're done!

All 3 boxes can access the Internet. Box1 and box2 get a random IP. Box3 always gets the same IP and has some external ports forwarded to it.


If you really need to use vlans, you need to set up a vlan trunk between the wrt and the switch. This means that every packet between the devices will have a vlan tag associated with it. Your switch has to support this (ie: be a "Layer 2 managed switch"). On your switch, you can then define which of the other ports are on which vlan. Box3's port will be on its own vlan.

There is no such thing as a vlan by MAC, because vlans partition at layer 2 to create multiple layer 2 broadcast domains.

share|improve this answer
Until box3 gets a virus or someone runs a network scanner. Security by obscurity isn't going to cut it on this one. Box3 needs to be isolated from the rest of the network. – NitroxDM Sep 22 '09 at 23:33
Either I've misunderstood your question or you've misunderstood my answer. Are you saying Box3 needs to be isolated from Box1 and Box2? Where exactly is your logical security perimeter on this network? – lukecyca Sep 23 '09 at 0:37
Your saying I should give box3 an IP like and have a DHCP range of 50 starting at Right or did I completely miss the ball on that one? What do you mean by logical security perimeter? (Sorry it that is a silly question, I’m not a networking guy… yet. ) – NitroxDM Sep 23 '09 at 15:59
up vote 0 down vote accepted

You can't. Not with a dumb switch in the way.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.