4

I have 4 physically distinct networks. Let's call them A, B, C and D.

Usually, these should be isolated. However, there are various machines that require access to any two of them. These are secured with the necessary firewalls.

Now a requirement has come in that necessitates one machine having access to all 4 networks.

My initial reaction was to just put 4 NICs in the machine and be done with it, but this seems rather insecure. The recommendation from a previous installation is to use a switch to create a common network. Again, this doesn't seem secure. My question is this:

Architecture Diagram

How would I implemente a network similar to the above diagram, where the router was a server and the 3 VLANS are my other networks. Such that:

  • The server can access any machine on any other network according to that particular network's firewalls.
  • Machines on the networks can access the server according to the applicable firewalls.
  • There is no way for machines on the different networks to communicate with another network.

I'm not looking for a blow-by-blow, just for someone to point me in the right direction.

12

Why don't you simply create a new subnet for them (or for each, if necessary)? Work on layer 3 and forget trying to solve this on layer 2. Enable routing between the networks and limit it on the firewall-router to allow only those network-host pairs and protocol that are required.

2

The routing answer works, but creating routes between the vlans opens floodgates between the subnets or vlans. You'd have to firewall everything on those vlans to keep them isolated. You don't want to risk students accessing IT workstations. If this is the one and only computer that needs access to all 4, Id' have the computer physically connected to a switch port that tags all 4 vlans on it (with one being untagged), then on the computer you would use your NIC utilities to create 4 "virtual" nics based on vlan tags.

  • 1
    OP says he now has 4 physical LANs and is only considering whether to implement them on a shared switch (VLANs). Besides your answer doesn't scale very well: each such server effectively becomes a router, and needs to have routing tables manually maintained. (Remember that VLAN 2 egress could in future lead to more than a subnet 2, but maybe to subnets 2, 2a, 2b. That's the way network grows.). – kubanczyk Mar 24 '18 at 10:11

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.