LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 10-08-2015, 02:19 PM   #1
upnort
Senior Member
 
Registered: Oct 2014
Distribution: Slackware
Posts: 1,893

Rep: Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161
Testing a VLAN


I configured a VLAN to isolate one physical system. This is my first venture with a VLAN. What tests should I perform to ensure this box is isolated?

I am using DD-WRT in a Linksys WRT54-GL. I created a separate VLAN for port 4. This port is for a testing box that I want to keep isolated from my LAN. Mostly the box is used for testing distros. The system came with Windows 7 installed but I rarely use Windows.

My LAN is on subnet 192.168.1.x. The router is assigned to 192.168.1.1.

The port 4 VLAN is on subnet 192.168.40.x. The DHCP server for that VLAN assigns addresses starting at .102. The VLAN is not bridged.

My nominal testing with the installed Fedora 22 and a LMDE live USB indicates the system is correctly assigned an IP address of 192.168.40.102.

I can ping the router at 192.168.1.1, but pinging other systems on my LAN subnet fail, as I expect and desire. Browsing with the built-in Caja Samba browser does not find my LAN Samba server.

Is there anything further to do to ensure this system is truly isolated?

Thanks.
 
Old 10-08-2015, 04:11 PM   #2
nini09
Senior Member
 
Registered: Apr 2009
Posts: 1,839

Rep: Reputation: 160Reputation: 160
Assign different IP subnet for VLAN network and add a new entry in route for the subnet.
 
Old 10-09-2015, 07:08 PM   #3
upnort
Senior Member
 
Registered: Oct 2014
Distribution: Slackware
Posts: 1,893

Original Poster
Rep: Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161
Quote:
Assign different IP subnet for VLAN network and add a new entry in route for the subnet.
I do not understand. I explicitly wrote that the port 4 VLAN is on subnet 192.168.40.x.

I asked for ways to test whether the VLAN was truly isolated, not how to configure.
 
Old 10-12-2015, 04:04 PM   #4
nini09
Senior Member
 
Registered: Apr 2009
Posts: 1,839

Rep: Reputation: 160Reputation: 160
To answer your question, ways to test whether the VLAN was truly isolated, I need to know why you want to use, providing different subnet or something else. Normally, VLAN traffic can be isolated in router, could be isolated in subnet.
 
Old 10-12-2015, 04:36 PM   #5
upnort
Senior Member
 
Registered: Oct 2014
Distribution: Slackware
Posts: 1,893

Original Poster
Rep: Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161
Why? I thought I addressed that in the original post. A testing machine.

Okay, let's make this juicier. Suppose this is a Windows machine used to connect to a corporate VPN and network. I do not want corporate sys admins having any knowledge of my LAN, let alone potential access.

Or make this even more fun, to test malware infections. Malware is being designed more craftily and testing in a VM won't succeed with some malware, such as ransomware. Only way to test and learn is a physical machine connected to the web.
 
Old 10-13-2015, 03:27 PM   #6
nini09
Senior Member
 
Registered: Apr 2009
Posts: 1,839

Rep: Reputation: 160Reputation: 160
Quote:
Okay, let's make this juicier. Suppose this is a Windows machine used to connect to a corporate VPN and network. I do not want corporate sys admins having any knowledge of my LAN, let alone potential access.
If VPN is terminated on corporate router and then the traffic is routed to your local router, it is impossible to hide your private LAN. Your private LAN is gone after your local router.
 
Old 10-13-2015, 04:09 PM   #7
upnort
Senior Member
 
Registered: Oct 2014
Distribution: Slackware
Posts: 1,893

Original Poster
Rep: Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161
Quote:
If VPN is terminated on corporate router and then the traffic is routed to your local router, it is impossible to hide your private LAN. Your private LAN is gone after your local router.
I understand that the routing table changes when connecting to a VPN. Yet in my example, the machine is already on a VLAN, which uses a different subnet than my LAN. I do not see how anybody on the VPN subnet sees the LAN subnet, which is different from the VLAN subnet.
 
Old 10-14-2015, 03:33 PM   #8
nini09
Senior Member
 
Registered: Apr 2009
Posts: 1,839

Rep: Reputation: 160Reputation: 160
Let's say there are two sides on your local router, one side connect to you local LANs and another side connect to corporate network.
Yes, you can use VLAN to isolate testing machine from LAN subnet. Any machine on LAN subnet can't see any packet generated from testing machine.
But if testing machine access Internet, VLAN is gone after your local router.
 
Old 10-14-2015, 06:22 PM   #9
upnort
Senior Member
 
Registered: Oct 2014
Distribution: Slackware
Posts: 1,893

Original Poster
Rep: Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161
Quote:
But if testing machine access Internet, VLAN is gone after your local router.
Are you saying that once the VLAN machine connects to the web that anybody on the web can access the LAN across the VLAN subnet? If yes, I do not understand that because the VLAN is not bridged to the LAN subnet.
 
Old 10-15-2015, 03:20 PM   #10
nini09
Senior Member
 
Registered: Apr 2009
Posts: 1,839

Rep: Reputation: 160Reputation: 160
Quote:
Are you saying that once the VLAN machine connects to the web that anybody on the web can access the LAN across the VLAN subnet? If yes, I do not understand that because the VLAN is not bridged to the LAN subnet.
No, LAN still can't see VLAN machine traffic.
 
Old 10-15-2015, 04:15 PM   #11
YankeePride13
Member
 
Registered: Aug 2012
Distribution: Ubuntu 10.04, CentOS 6.3, Windows 7
Posts: 262

Rep: Reputation: 55
Unless you set up a route (port forwarding, your machine/router gets owned) for the public to get into your LAN, there is no way for it to happen.
 
Old 10-16-2015, 09:39 AM   #12
upnort
Senior Member
 
Registered: Oct 2014
Distribution: Slackware
Posts: 1,893

Original Poster
Rep: Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161Reputation: 1161
Okay, thanks. Back to the original question. Is there anything further to do to ensure this VLAN is truly isolated?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Why would a client on a VLAN be able to reach the gateway of another VLAN? gmjs Linux - Networking 8 08-25-2014 02:49 PM
Route non-vlan packet to a vlan interface mic.sed Linux - Networking 2 04-23-2010 03:39 AM
VLan help on Cisco 870 to Linux vlan spide21 Linux - Networking 4 07-30-2009 09:20 AM
DHCP Config for VLAN's using 1NIC and non VLAN router. scottgutman Linux - Networking 1 07-22-2009 02:41 AM
VLAN configuration - native VLAN and setting PVID kumarwaiting Linux - Networking 0 07-24-2006 03:51 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 11:08 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration