this post was submitted on 07 Apr 2025
48 points (96.2% liked)
Selfhosted
60426 readers
206 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Could you elaborate why the question of trust invalidates using just subnets?
Subnets are on layer 3 not layer 2. You can easy access other devices on layer 3 by finding the right subnet on layer 2. ARP is used to resolve IP addresses into MAC addresses and vis versa.
Thanks, but isn't ARP contained inside a subnet? I guess you could find everything if you inspected the MAC table of the main switch
ARP is in the broadcast domain (otherwise known as a lan)
Vlans create multiple lans
Ah, I see. Thanks
no. Arp bridges layer 1 and 2. It's switch local. With a VLAN, it becomes VLAN local, in the sense that 802.1q creates a "virtual" switch.
Sorry, I'm not sure what you mean by "ARP bridges L1 and L2". I'll have to read more about this. Other than that, I understand what you said.
ARP is in a single broadcast domain which can span multiple switches.
A VLAN is (theoretically) equivalent to a physically separated layer 2 domain. The only way for machines to communicate between vlans is via a gateway interface.
If you don't trust the operating system, then you don't trust that it won't change it's IP/subnet to just hop onto the other network. Or even send packets with the other network's header and spoof packets onto the other subnets.
It's trivially easy to malform broadcast traffic and hop subnets, or to use various arp table attacks to trick the switching device. If you need to segregate traffic, you need a VLAN.
Edit: Should probably note that simply VLAN tagging from the endpoints on a trunk port isn't any better than subnetting, since an untrusted machine can just tag packets however it wants. You need to use an 802.1q aware switch and gateway to use VLANs effectively.
Thank you for the great comment.
This line cleared it up for me:
It is indeed as you say. VLANs on a trunk port wouldn't really work for security either. This is making me reconsider my entire networking infrastructure since when I started I wasn't very invested in such things. Thanks for giving me material to think about