F5F Stay Refreshed Power Users Networks VLANs and DHCP servers

VLANs and DHCP servers

VLANs and DHCP servers

B
BrutalPenguin
Junior Member
6
12-13-2022, 05:22 PM
#1
Hi Everyone, I was planning to install a managed Unifi switch for configuring Vlans. Using those Vlans, I intend to create separate DHCP servers for different device categories in the house. The setup would resemble this: 10.0.0.x - Main Home WiFi, Access to servers on subnet 10.0.10.x - Restricted network for kids 10.0.20.x - IoT restricted network only 10.0.30.x - Guest LAN.

My main concern is whether a device on 10.0.0.x can print to a printer on 10.0.30.x. Also, if I’m a guest on 10.0.40.x, I wouldn’t want access to printers, speakers, TVs, etc. Is this achievable with a UniFi Edgerouter 4? I’ll be building a PFSense box later.
B
BrutalPenguin
12-13-2022, 05:22 PM #1

Hi Everyone, I was planning to install a managed Unifi switch for configuring Vlans. Using those Vlans, I intend to create separate DHCP servers for different device categories in the house. The setup would resemble this: 10.0.0.x - Main Home WiFi, Access to servers on subnet 10.0.10.x - Restricted network for kids 10.0.20.x - IoT restricted network only 10.0.30.x - Guest LAN.

My main concern is whether a device on 10.0.0.x can print to a printer on 10.0.30.x. Also, if I’m a guest on 10.0.40.x, I wouldn’t want access to printers, speakers, TVs, etc. Is this achievable with a UniFi Edgerouter 4? I’ll be building a PFSense box later.

K
KawaiiPotato4
Member
132
12-27-2022, 10:03 PM
#2
You need one DHCP server running on Windows or Linux, covering each subnet individually. Set up scopes for every subnet and then configure a DHCP relay on the non-local networks (the three without the server) to connect to that central server. This works if you don’t have a firewall blocking traffic between 10.0.0.X and 10.0.30.X. For your second point, you’d probably create a rule on the EdgeRouter to block communication between those subnets.
K
KawaiiPotato4
12-27-2022, 10:03 PM #2

You need one DHCP server running on Windows or Linux, covering each subnet individually. Set up scopes for every subnet and then configure a DHCP relay on the non-local networks (the three without the server) to connect to that central server. This works if you don’t have a firewall blocking traffic between 10.0.0.X and 10.0.30.X. For your second point, you’d probably create a rule on the EdgeRouter to block communication between those subnets.

B
britney100521
Member
52
12-29-2022, 03:24 PM
#3
It's referred to as inner VLAN routing, and it's definitely possible. You can set it up as open or implement east-west filtering between VLANs. This allows you to control traffic based on what you deem safe, such as restricting guest access to only external resources while keeping internal systems secure.
B
britney100521
12-29-2022, 03:24 PM #3

It's referred to as inner VLAN routing, and it's definitely possible. You can set it up as open or implement east-west filtering between VLANs. This allows you to control traffic based on what you deem safe, such as restricting guest access to only external resources while keeping internal systems secure.