A VLAN is (theoretically) equivalent to a physically separated switch. The only way for machines to communicate between vlans is via a gateway interface.
If you don’t trust the operating system, then you don’t trust that it won’t change it’s IP/subnet to just hop onto the other network. Or even send packets with the other network’s header and spoof packets onto the other subnets.
It’s trivially easy to malform broadcast traffic and hop subnets, or to use various arp table attacks to trick the switching device. If you need to segregate traffic, you need a VLAN.
possiblylinux127@lemmy.zip 5 weeks ago
Subnets are on layer 3 not layer 2. You can easy access other devices on layer 3 by finding the right subnet on layer 2. ARP is used to resolve IP addresses into MAC addresses and vis versa.
marauding_gibberish142@lemmy.dbzer0.com 5 weeks ago
Thanks, but isn’t ARP contained inside a subnet? I guess you could find everything if you inspected the MAC table of the main switch
possiblylinux127@lemmy.zip 5 weeks ago
ARP is in the broadcast domain (otherwise known as a lan)
Vlans create multiple lans
marauding_gibberish142@lemmy.dbzer0.com 5 weeks ago
Ah, I see. Thanks
nottelling@lemmy.world 5 weeks ago
no. Arp bridges layer 1 and 2. It’s switch local. With a VLAN, it becomes VLAN local, in the sense that 802.1q creates a “virtual” switch.
marauding_gibberish142@lemmy.dbzer0.com 5 weeks ago
Sorry, I’m not sure what you mean by “ARP bridges L1 and L2”. I’ll have to read more about this. Other than that, I understand what you said.
possiblylinux127@lemmy.zip 5 weeks ago
ARP is in a single broadcast domain which can span multiple switches.