I want to segment out to a few different VLANS with the LAN itself only servicing the network devices with a dedicated port on the router for connecting a laptop for device management.
My end goal is probably almost accurately described in a table like so:
VLAN Name | VLAN ID | Subnet | Purpose |
---|---|---|---|
LAN | 0? | 10.10.0.0/24 | Network infrastructure |
Residents | 1 | 10.10.1.0/24 | Here there be peeps |
Servers | 2 | 10.10.2.0/24 | Servers, serving. |
IoT/NoT | 4 | 10.10.4.0/22 | My LIGHTS and stuff |
Guest | 8 | 10.10.8.0/24 | Visitors |
Work | 16 | 10.10.16.0/24 | The Jerb |
I've set up the default LAN with a 10.10.0.0/24 subnet. I'm proably going to not have it do DHCP and traffic from it to go basically anywhere, maybe anywhere private. The other VLANs will have variable but predictable access to whatever. Like IoT doesn't get to talk to anything public, ever, for example. Guest and Work only get to see the Internet, while I'll probably punch a hole to a printer for Work.Residents get to talk to anything but things on the LAN, which should only allow access to management interfaces (web, SSH) from devices on the LAN with an IP address in the right range.
Where I'm stuck is with LAN and VLAN filtering. Maybe it's LAN and VLAN? This is why I'm stuck. I'm going to have the router, 4-5 switches, 4 WAPs, and maybe a "wireless wire" bridge to an outbuilding.
I understand how to set up trunking (kinda, mostly, under EdgeOS) and having some ports only handle tagged traffic for one VLAN. That's part of setting up multiple SSIDs on the WAPs - they each direct to a different VLAN.
My questions:
Say I have a trunked port on the router that connects to a managed switch, which also has at least two trunked ports because there's a WAP or something hanging off of it. If my LAN traffic is untagged, originating from an untrunked/dedicated port on the router.
Will I be able to talk to the network devices to manage them from a laptop connected to that port?
Is untagged traffic blocked on a port for which VLAN filtering is enabled?