Example VLAN without any Router -- Security Problems?

Question

I was reading a VLAN setup walkthrough, and the author had an interesting idea for setting up VLANs without a router (which you don't normally see). At first glance, this doesn't seem like it actually works how the author expected it to, but, I've been wrong before.

• In the switch, he set up three VLANs (2, 3, and 4).
• Then he assigned one group of ports to VLANs 2 and 3, with a (untagged) PVID of 3.
• The second group of ports was assigned to VLANs 2 and 4, with an (untagged) PVID of 4.
• The port out to the router was then assigned to all three VLANs (2, 3, and 4), with an (untagged) PVID of 2.

This setup supposedly separated the network traffic from VLAN 3 and VLAN 4. It does prevent pings or direct network traffic from one router to another. The problem that I see, however, is that all packets coming from the router will be sent out to both groups of devices (VLANs 3 and 4). This seems to, at least partially, defeat the security, since any packets from the router will go out to all the devices.

Is the author's solution valid, security-wise, or is it, in fact, routing reply packets from the WAN into both VLANs?

Answer 1

• Then he assigned one group of ports to VLANs 2 and 3, with a (untagged) PVID of 3.
• The second group of ports was assigned to VLANs 3 and 4, with an (untagged) PVID of 4.

Most hosts will not recognize tagged frames, and will discard tagged frames, so the hosts will only use the untagged VLANs. Packets from the router will only be addressed for the network of one VLAN, and the router will only use the MAC address of the destination host, so the frames will still only be delivered to a single host.

Switches also will build MAC address tables, and they will then only deliver frames to the interface where the MAC address was last seen.

This is really a security problem because some hosts, e.g. servers, can be configured to trunk, and this allows them to send and receive traffic on multiple VLANs. Also, broadcasts, e.g. ARP, may be leaked to other VLANs, allowing an attacker to see and spoof a MAC address.

This configurations is really goofy, and you should have a really good reason to do it.