D-Link Enterprise > DGS-1100-Series

VLAN to isolate some ports


Hi there,

I would like to isolate ports from my switch from the other devices of my network but they need an internet access.

1st of all: my network :

1st router (192.168.0.x) --> to 3 switches (1, 2 & 3)

switch 3 :
Port 1 : from my router (192.168.0.x) - vlan 1
Port 2 : PC - vlan 1
Port 3 : Printer - vlan 1
Port 16 : to WAN port of a 2nd router - vlan 1

Port 10 : from LAN port of the 2nd router (192.168.2.x) - vlan 2
Port 11, 12, 13 : PC - vlan 2

Vlan2 need to be isolated from vlan1.

Is it possible to do ? If yes, how ?

I've tried to configure the switch but the pc in the vlan 2 can ping the pc in the vlan1 and I don't understand why...



not sure if I understood things right, because you mention 3 switches, but in what follows I can only see one switch (#3) with two routers?
I assume both routers do NAT?

Does the following figure depict things correctly?

  .------.    .--------.                               .--------.
 (INTERNET)---+ 1st RT |--- VLAN 1 ( ---| 2nd RT |--- VLAN 2 ( ---|
  `------    `--------                               `--------

If yes, any PC in VLAN 2 can probably ping any PC in VLAN 1 and the Internet, but a PC in VLAN 1 cannot ping any PC in VLAN 2?

If so, here is why: At layer 2 (Ethernet) of course VLAN 1 is separated from VLAN 2 (which you can check if you unplug the LAN or WAN port of the 2nd RT). But at layer 3 the 2nd RT routes (and NATs) form VLAN 2 to VLAN 1:

If you ping PC1 in VLAN 1 from PC2  in VLAN 2, the ping gets routed (because of the default gateway setting of PC2) to the 2nd RT which replaces the packet's source address (PC1's address) by its IP address at the WAN interface and then forwards the modified packet to to PC1. From the point of view of PC1 the ping comes from the 2nd router's WAN address, hence it replies to this address. The 2nd router receives the reply and because it had established a NAT session as a result of the initial ping it 'knows' that it has to replace the reply's destination address (its WAN interface address) by PC1's address and then forward the modified reply back to PC1.

Because this NAT mechanism only works in one direction you cannot ping PC2 from PC1.

But anyway, I think this is not what you want - you probably want devices become separated within two or more groups (each one forming a VLAN) within a single IP network, but all groups shall share some resources like printers or the Internet access via the 1st RT?

If so, you can solve this demand via so called "asymmetic VLANs", given that your switches support this feature.

So please tell if this is what you want and if so please tell what type of switch(es) you use (to see, if it supports asymmetric VLAN)



You've almost understood :)

I just want 3 ethernet cable in a VLAN2 which have access to internet and nothing else.

So :

Internet --> 1st Router (  --> Switch 1 (Living room)
                                                         --> Switch 2 (garage)
                                                          --> Switch 3 (My desk)    VLAN 1 --> PC, Printer, Wan of 2nd Router
                                                                                                VLAN 2 --> 3 PC + Lan from the 2nd Router (

At this time, I've solved my problem with ACL on my 2nd router which block the trafic to all except

Switch 3 is a DGS-1100-16

Hope this help :)

Hi again,

now the description of your scenario looks complete. Well, with your isolation demands solved using ACL within your 2nd router, are you still interested in an alternative solution using asymmetric VLANs? You could save the 2nd router and use a single subnet The idea is similar to what I described in this thread recently. But this solution requires all switches to support asymmetric VLANs (e.g. switches #1 and #2 also DGS-1100?), only switch #1 connected to the router and switches #2 and #3 connected to switch #1.



The other switches are not manageable.

I will keep using ACL...

Best regards and thx for your time.


[0] Message Index

Go to full version