Netgear GS724Tv4 inter-VLAN routing

Question

Summary

I am toying with a relatively small home LAN and I am baffled and idealess as to how to configure inter-VLAN routing on GS724Tv4. I suspect it's because of some oversight on my part or simply misunderstanding on how inter-VLAN routing is supposed to work so I would appreciate some insight.

Intent

I am trying to logically separate the small LAN into several VLANs (reasons: self-documentation, security, learn something new) and establish inter-VLAN routing thus avoiding router-on-a-stick scenario.

The VLANs correspond to areas such as "Wifi", "Storage", etc. so the idea is that a chosen VLAN where my workstation is (assume VLAN with ID 10) can access virtually all VLANs, but a client within any other VLAN could only see its own subnet and get access to internet, nothing else.

For internet accessibility, there is a router (pfSense sitting in a VM) but is irrelevant for this problem and won't be mentioning it further so as to reduce noise.

Setup

Extremely simple - just two clients, two ports and two VLANs. Operating system on both sides is Windows 7. All IPs are statically assigned. There is a single L3-capable switch sitting between the clients. There is no trunking configured (nor needed).

+---------------------------+--------------+------+------+-------------+---------------+-------------+
|          Client           |      IP      | VLAN | PVID | VLAN Member |   VLAN SVI    | Switch Port |
+---------------------------+--------------+------+------+-------------+---------------+-------------+
| Workstation (source)      | 192.168.1.40 |   10 |   10 |          10 | 192.168.1.100 | P1          |
| Workstation (destination) | 192.168.2.40 |   20 |   20 |          20 | 192.168.2.100 | P2          |
+---------------------------+--------------+------+------+-------------+---------------+-------------+

My expectation is to be able to ping from Source to Destination. As an added bonus, Destination would be incapable of pinging Source.

Additionally:

1. All ports are configured as untagged
2. SVIs are not conflicting with existing IPs (how would I determine if they did?)
3. IP routing is enabled on the router
4. IP router discovery is disabled (SVIs are not advertised as gateways)
5. Router ARP cache registers the device's IPs on their ports as well as SVIs

Results

1. I can ping IP addresses within a particular subnet/VLAN
2. I can access the internet (FWIW)
3. I cannot ping across subnets (default gateway not explicitly configured on workstation NIC)
4. I cannot ping across subnets (default gateway explicitly set to SVI's IP address on workstation NIC)
5. I cannot ping across subnets (mapped a particular port to multiple VLANs - e.g. port P1 -> VLAN member (10, 20) - this should be equivalent to VLAN trunking....and it was essentially rattling the cage, trying to provoke some change in behaviour)

Questions

I have watched scores of youtube videos (mostly Cisco), read through documentation on Netgear site and tens of articles/links - and I simply don't grok it.

As far as I have seen, after setting the SVIs on Cisco router, thing just works and it's the most enigmatic thing in this whole setup: where is the routing table? How does it know it should route traffic from subnet X to subnet Y? What happens when you have numerous VLANs, who gets to choose what goes where and, most importantly - how? How do you define ACLs for VLANs?

Should I manually define static routes? I don't think I've ever seen people configuring them in these videos. If I should define them - how should I do that? How do I say that traffic from SVI X should be routed to SVI Y? Netgear provides only two (relevant) fields per SVI row: IP address and Next Hop. If I fill the latter with e.g. SVI Y's IP, how can I expect internet access to work (I would imagine Next Hop would always be the Router's address).

I am sure I have more questions but you can see I am pretty confused here so I'll stop for now. I would be grateful for any advice you can give - theoretical or practical.

Answer 1

It's pretty easy to set up routing in the gs724tv4. The menus are self explanatory.

But the one thing you will overlook: you need to have a single out-of-band vlan configured to manage the switch. The switch's management vlan can not be in a routing vlan. So configure a port with vlan 1 or whatever you have chosen to do management over (I never use 1 for that). Then add the vlans, and then add routes. Do not use the routing wizard, because that one is stupid. Your switch needs an IP on each network it will route on, and your hosts should be configured to point to your switch as default gateway. I would generally use the CLI on this switch, but for routing I one time use the html entry, and then copy that for all my other switches. This switch is rock solid.

After that, if you want access rules between them, you need to add acl's. ACL's are not stateful though. So that might be a bit of a headache to set up "secure".