Selfhosted

60426 readers

206 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

Basic networking/subnetting question. (lemmy.dbzer0.com)

submitted 1 year ago by marauding_gibberish142@lemmy.dbzer0.com to c/selfhosted@lemmy.world

65 comments fedilink hide all child comments

Sorry for being such a noob. My networking is not very strong, thought I'd ask the fine folks here.

Let's say I have a Linux box working as a router and a dumb switch (I.e. L2 only). I have 2 PCs that I would like to keep separated and not let them talk to each other.

Can I plug these two PCs into the switch, configure their interfaces with IPs from different subnets, and configure the relevant sub-interfaces and ACLs (to prevent inter-subnet communication through the router) on the Linux router?

What I'm asking is; do I really need VLANs? I do need to segregate networks but I do not trust the operating systems running on these switches which can do L3 routing.

If you have a better solution than what I described which can scale with the number of computers, please let me know. Unfortunately, networking below L3 is still fuzzy in my head.

Thanks!

you are viewing a single comment's thread
view the rest of the comments

[–] Goingdown@sopuli.xyz 3 points 1 year ago* (last edited 1 year ago) (2 children)

If computers are in same network, even with different ip addresses, they still can see all broadcast and multicast traffic. This means for example dhcp.

If you fully trust your computers, and are sure that no external party can access any of them, you should be fine. But if anyone can gain access to any of your computers, it is trivial to gain access and sniff traffic in all networks.

If you need best security, multiple switches and multiple nics are unfortunately only really secure solution.

[–] nottelling@lemmy.world 1 points 1 year ago

Broadcast traffic (such as DHCP) doesn't cross subnets without a router configured to forward it. It's one of the reasons subnets exist.

[–] marauding_gibberish142@lemmy.dbzer0.com 0 points 1 year ago

No, I do not trust my computers that much. Quite unfortunate, really that I'll have to build a whitebox switch to get what I want