I have a network with several VLANs that each contain resources or clients with different access rights.
For simplicity, let's say I have 3 VLANs:
- ID 10: Contains privileged clients and private resources only accessibly to these privileged clients
- ID 20: Contains guest-clients that only have access to public resources
- ID 30: Contains public resources that are accessible by both privileged and guest-clients
On this setup, I would like to make auto-discovery and access right management work so that clients in VLAN 10 can discover and access resources in VLANs 10 and 30, and clients in VLAN 20 can discover and access resources in VLANs 20 and 30. The resources I need to auto-discover are of different type (windows network shares, printers, security cameras, apple devices, etc.) so there are several different mechanisms at work, most of which I don't have any knowledge over.
Is it possible to make such a setup work generically, so that devices on VLAN 10 see a single network that consists of both VLANs 10 and 30 and behaves just like as if everyone were plugged into the same switch and devices on VLAN 20 see a network that consists of all devices on VLANs 20 and 30?
Would I need to create a bridge between VLANs 10 and 30 and a second bridge between VLANs 20 and 30? Would this also implicitly bridge VLANs 10 and 20 (not acceptable)? If so, can I just disallow this implicit bridging with firewall rules (like drop all packets from VLAN 10 to VLAN 20 and vice versa)?
What would be the best way to subnet such a layout and how would I go about setting up DHCP to accomplish it? My current thoughts are something like the following:
- 192.168.10.x for VLAN 10, 192.168.20.x for VLAN 20, and 192.168.30.x for VLAN 30
- Subnet 255.255.0.0 for everyone (so that devices send broadcasts across VLANs)
Is it possible to get such a setup working on a Vyatta-Linux-based router, especially the DHCP part? It seems to determine which interfaces to listen on based on the subnet I provide. So, to have it listen on eth0.10 (VLAN 10), I would need to give it subnet 192.168.10.0/24, but I would like for the DHCP clients to be told that the subnet is 255.255.0.0, not 255.255.255.0.
What other services/forwarding would I need to set up (e.g. ARP proxying) to be reasonably sure that all common auto-discovery-mechanisms should work?
Any help would be much appreciated.