I'm interested in providing a VLAN for my kid's computer. Since there's more of a risk for him (or one of his buddies) accidentally downloading some bit of malware (you know how teenagers are) sticking him behind his own firewall seems fairly straight forward.

I have an old router/home gateway. If I plug that in to one of the ports on our main home router, with NAT turned on will that provide the level of segmented security described in the article? Basically, I don't want his computer to be able to see any of the other computers or network devices on our home network. Would I need to put the port his router's on in a DMZ?

You have the right idea, but all you need to do is set up a "DMZ" for your kid's computer (assuming all of the proper protective measures and configurations are made). If you set up a "DMZ", you won't need to implement your old router if there's only one PC, just connect it up to the existing router to the port assigned to the "DMZ".

If you have more than one computer meant for the DMZ, then you could use the old gateway as a regular switch, using the upstream port to connect to the DMZ port on the existing router. That way multiple computers could be connected to the DMZ (such as your kid's friends coming over for a LAN game) over a switch on the DMZ and it keeps all computers off your "safe" network.

One last note: The DMZ features of your router may not have things like DNS and DHCP available. You may have to set up static entries for IP and DNS on the kid's PC.

As Doug noted, VLANs are not the same as firewalls. They provide security only by limiting broadcast traffic.

As for using two routers, our article How To: One Internet connection - Two Private LANs shows a
three router configuration that keeps traffic separated between two LANs.

If you have only two routers, you would connect up the second as you describe (plug its WAN port into a LAN port). Then connect your son to the router directly connected to the Internet and any clients that you want to "protect" from them to the second.

"Indeed, pings from components in the Data VLAN did not reach components in the VoIP VLAN, and vice versa, which is what I want."

It is possible to route between VLANs. A ping request coming from VLAN 2 destined for VLAN 3 should be routed through the router to VLAN 3 (attempting to ping a device between VLANs should work fine). Layer 3 addressing/path determination (Internet Protocol) comes into play now. Since the router operates on layer 3, the VLAN ID (layer 2) does not hinder packet path/destination. Routers route packets (layer 3) based the logical address (IP) of the each known subnet address (network address) which each VLAN should have configured. Since each VLAN is assigned to its own 'logical' network (layer 3 addressing down to layer 2 segmentation), it has a default gateway. A router running routing code and a basic routing protocol (ie. RIP, EIGRP, IGRP, OSPF) will know the default route (IP address) on which interface to forward packets out to reach the destination IP address.

I think a better design would be very simple. The up link for the switch should be tagged with all three VLAN IDs (2-4). The down link on the router to the switch should also be tagged for all 3 VLANs. Each port on the switch will need to be untagged in the correct vlan. As was said, the point of a VLAN is logical segmentation. The internet is accessible by all devices on the network because of layer 3 routing.

VoIP should be in its own VLAN. The previous configuration still puts the laptop in the same VLAN as the VoIP stuff which makes it susceptible to broadcasts (from your laptop running a Microsoft OS -- way to many network services running by default). This network also has access to the internet (remember, layer 3 routing).

The data VLAN should also be in its own VLAN (sensitive data needs to be separated from the rest of the network). I would suggest configuring the firewall/ACL settings on the router to limit traffic in/out bound to this subnet/network. You may want to only allow traffic from the network that your laptop exists on (layer 3 concept) or a single IP address that you want to access the data network.

The last VLAN would contain the workstations and printers that you use at your house.

I could write for hours on this stuff but I think this covers the basics.

I guess my point was that VLANs need to be separated, not overlapped and with proper configuration, there is communication between VLANs.

The configuration that you suggest is certainly possible, with a Layer 3 switch and/or router capable of handling multiple VLANs.

However, the intent of this article was to show how simple LAN segmentation could be achieved with low-cost products and without the added complication of configuring routing in addition to VLANs.

Two months ago I replaced my old switches with new netgear smart switches. The servers that face the outside-world are on one switch and each is on it's own vlan so that they cannot talk to each other. The goal being that a single hacked server doesn't allow all of them to be hacked. The traffic from the switch has to go through our firewall in order to get to the rest of the network.

Inside I used a stacked switch to connect my 150 end user machines. Admin users can talk to their admin groups, super admins can see everything and individual users can't see anything other than the firewall which will then either route them to an insider server, outside server, or the internet.

The best thing to do is to go in small steps, make sure you are locking down what you think you are locking down and not cutting off services you didn't mean to.

I currently use IPCop as a linux router with 3 seperate networks running through it (GREEN, BLUE, ORANGE and RED). The blue and green are totally seperate from each other with their own DHCP servers with the notable except that anybody on the green can access the blue but not vice versa which is great for wireless connections.

So there are different devices out there that can do VLANs, some not so obvious as I pointed out with the linux router but it's there.

I am surely green on VLAN, could anyone tell me why the "Data" and "VoIP" VLAN remains seperated with the existence of the "Network" VLAN? Thanks.

Routing is not the same as VLAN. Routing is a Layer 3 technology, VLAN is Layer 2.

I've got a couple of SRW224P switches and am looking at adding more in the SRW family, and this is very timely, and helped me work out some of my confusion about ow to configure things.

Thanks!

WPNS

Does the RV042 serve both VLANs with IP adresses over DHCP? If yes, they all are in the same range (eg. 192.168.0.XXX) aren't they?

By the way, great tutorial!

Is this possible with the SLM2008? Can I achieve the same result with SLM2008 instead of the SRW

Yes, the SLM2008 will work. But the settings are different. The example in this review might be more helpful.

If I were to NOT have a printer plugged in and instead had a gbit switch (unmanaged) with a PC, and two other devices such as Xbox and Voip device, am I able to see those devices in the list in some way, such as a MAC address to add them to a VLAN? So for example, I would want the PC on the data vlan but want the xbox and voip on the other vlan. Is this possible? I also ask because, assuming I had an SRW2008, but had more devices, I might need to add switches which I would prefer to be unmanaged given the price difference.

Great article. Answered several questions I have and I understand this much better now. Thanks for that.

I would like to use a Dell PowerConnect 3024 managed switch to create two network segments on my home network. One VLAN for IPTV and one VLAN for data. How do I split IPTV traffic onto an isolated VLAN while routing all other traffic only another VLAN?

After reading this article,I know how I could set up my switch to do this if I got IPTV traffice on a separate physical cable from my provider, but since it is combined, I can't figure out how to do this.

I thought I could just use IGMP flitering to do this, but for the life of me, I can't figure out how? Is what I'm trying to do possible? With this Dell switch? I'm a novice here, but I'm afraid that i need a layer 3 switch (very expensive) to do what I want and that the PowerConnect won't do this.

Anyone know? Thanks much!!

Stuck in the sticks and can only get 3MBit DSL... Anyone know of a device I can use to combine 3 x 3MBit into a single usable 10MBit(I know it's 9) stream that I can connect to the WAN port of my router... I don't mind paying for the service, but my ISP can only get 3MBit through the copper at my distance from the CO... multiplexing the traffic across the 3 pipes (or more) seems like my only viable solution

There are many muti-WAN routers that you could use. We've reviewed a few:
Netgear FVX538
Linksys RV042
Netgear FVS336G
Peplink Balance 30