logo elektroda
logo elektroda
X
logo elektroda

Network Segregation: Implementing VLANs for 5 Computers, IP Camera, and Printer - How To?

EjMaciejus 4683 11
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
  • #1 16628902
    EjMaciejus
    Level 2  
    I want to separate the computers on the network from each other.

    There are 5 computers in the network (3 connected via cable, 2 via Wi-Fi), one printer (via cable) and several Wi-Fi phones. Additionally, an IP camera (Wi-Fi) is connected to the network. Internet is from UPC.

    I want three computers to "see" each other and have access to the printer, the next two computers are completely separated, i.e. they cannot see any devices on the network (good if they can see the printer, but that's not a condition), phones should not see any devices either ( possibly they can see each other). The IP camera should be visible from the outside.

    I do not know much about networks, I started reading a bit about it recently and I read about virtual lan networks (VLANs) and this will probably be the solution to the topic. However, before I invest in hardware that will do the job, I have a few questions:

    1) Is it really, if the computer is assigned to a virtual subnet, it is not possible to discover devices in another subnet? Of course, I am considering the situation when the VLANs are properly configured.
    2) The second question relates to the printer - will it be able to belong to several VLANs or do you have to implement it somehow to make it visible to all computers? If there is no workaround, it will only be visible for the first three computers.
    3) How is the device assigned to the appropriate network? By MAC address or otherwise? What if a new device logs in after Wi-Fi to which network it will be assigned?

    4) What equipment do you recommend to make it relatively easy? I found Mikrotik routers, eg RB2011UiAS-2HnD-IN but maybe something cheaper is enough.

    It's also nice if the router had the option to save logs for devices logged into the network - connection log for individual devices.
  • ADVERTISEMENT
  • #2 16629148
    bogiebog
    Level 43  
    EjMaciejus wrote:
    How is the device assigned to the appropriate network?

    Usually after a physical port

    EjMaciejus wrote:
    after Wi-Fi a new device logs in to which network will it be assigned?

    to which the physical port connected to the AP is assigned
  • Helpful post
    #3 16629633
    Heinzek
    Network and Internet specialist
    EjMaciejus wrote:
    1) Is it really, if the computer is assigned to a virtual subnet, it is not possible to discover devices in another subnet? Of course, I am considering the situation when the VLANs are properly configured.

    The computer will only see what you allow it in the VLAN configuration.
    EjMaciejus wrote:
    2) The second question relates to the printer - will it be able to belong to several VLANs or do you have to implement it somehow to make it visible to all computers? If there is no workaround, it will only be visible for the first three computers.

    The printer can be in a separate VLAN and you can configure which VLANs will access it.
    EjMaciejus wrote:
    3) How is the device assigned to the appropriate network? By MAC address or otherwise? What if a new device logs in after Wi-Fi to which network it will be assigned?

    VLANs will be assigned to ports. You can also set several VLANs for one port, but an AP must be connected to this port that will tag these VLANs and it will send several ssids (e.g. company / home / guests) and each ssid will be connected to a different VLAN.
    EjMaciejus wrote:
    4) What equipment do you recommend to make it relatively easy?

    It will never be easy, once you embrace it, you will think less about it. You can easily do it on routers with OpenWRT / LEDE, even in graphics mode.
    If you do not need crazy speed, the ordinary TP-Link WR1043ND is enough for you.
  • ADVERTISEMENT
  • #4 16630219
    hermes-80
    Level 43  
    Managed switch - cheapest TP-L TL-SG2008 + router with alternative FW + packet management on the switch - ebtables.
  • #5 16630514
    EjMaciejus
    Level 2  
    Heinzek wrote:
    VLANs will be assigned to ports. You can also set several VLANs for one port, but an AP must be connected to this port that will tag these VLANs and it will send several ssids (e.g. company / home / guests) and each ssid will be connected to a different VLAN.


    If I set up several VLANs for the port with the printer, then this printer will be available to all those networks that have the port with the printer added - do I understand that?
  • Helpful post
    #6 16630532
    Heinzek
    Network and Internet specialist
    I would
    Wan in vlan1
    computers in vlan2
    printer in vlan3
    wifi on vlan4

    then rules where vlan2 has access to 1 and 3
    vlan 3 has no access to any vlan
    vlan 4 only has access to vlan1
  • ADVERTISEMENT
  • #9 16683488
    EjMaciejus
    Level 2  
    Back to the topic. I have decided that I will probably buy a router for OpenWRT but I have some doubts.

    http://eko.one.pl/?p=openwrt-vlan#obsugavlanw

    On the above page I read that the router requires a proper chip to handle VLANs.

    Can anyone know if the following device has the chip mentioned above and whether they will work properly in a VLAN-based configuration?

    TP-Link Archer C2600
    Linksys WRT1200AC


    If not these, maybe someone knows others (it's important that they handle VLANs correctly).
  • ADVERTISEMENT
  • #11 16683525
    EjMaciejus
    Level 2  
    Well, I just wrote to him on the forum, but unfortunately this question does not answer.

Topic summary

The discussion revolves around implementing VLANs to segregate a network consisting of 5 computers, an IP camera, a printer, and several Wi-Fi phones. The user seeks to configure the network such that three computers can communicate with each other and access the printer, while the other two computers remain isolated from all devices, with potential limited access to the printer. The Wi-Fi phones should not see any devices, although they may communicate with each other. The IP camera needs to be accessible externally. Participants suggest using managed switches and routers with VLAN capabilities, such as TP-Link and OpenWRT-compatible devices. Specific VLAN configurations are proposed, including separating devices into different VLANs and setting access rules accordingly. Recommendations for hardware include the TP-Link WR1043ND and TP-Link Archer C2600, with emphasis on ensuring the router has the necessary chip for VLAN support.
Summary generated by the language model.
ADVERTISEMENT