Recommended Posts

secure from what standpoint? Just putting devices in different vlans does not make it secure? What ACLs do you have between the vlans?

From the info you have given all that can be assumed is broadcasts will not be seen between vlan1 and vlan2 ;)

ok..i will go into more details,

basically....

i have 5 server, 1 of them is a file server which store office files...

the 20 office computer has are able to read/write to a certain directory (eg . Office Doc) in D: drive

but not able to change any setting on this server.

the other 4 server are mail sever and web server etc..

putting them in seperate vlan is not allowing the user to ping or access the server. including the 40 user that are connected wirelessly.

now i wish to include 10 address space(wireless) for guess which only allow browsing of http and nothing else. <--how should i setup this

and putting them all in same switch but in diff vlan, how secure are information is kept?

just like what u said broadcasts should not be seen on different vlan

lets say vlan 1 for server

vlan 2 for users

vlan 3 guess network

Again just putting things in vlans does not prevent access.. Unless you don't route between the vlans, which then how do the users access the servers? Kind of pointless to have servers that users can not access.

So do you have a firewall routing traffic between the vlans? Or is the switch just routing intervlan traffic - if so what acls are you putting into place?

You clearly stated "the 20 office computer has are able to read/write to a certain directory" So you must be routing traffic between the vlans, so how are they now secure?

I think you misunderstand what a vlan is, a vlan is just another network segment. What is your security device between them? Firewall, just acls on the switch. What is the exact model of switch, is it layer 4?

If all you have done is create 2 network segments and are now routing traffic between them - all you have done is create 2 different broadcast domains to limit the broadcast traffic the servers will see ;)

If you are not routing traffic between the segments -- how do the uses or guests access your servers services?

Any computer or server needing to access each other needs to be on the same VLAN.

Any computer or server not needing to access each other can be put in a different VLAN.

This is not true. You can have servers and computers on as many vlans that you want, it is the routing (or layer3) that needs to link them together. Most managed switches are capable of layer 3 these days but there are quite a few that do not and because of this makes vlaning a useless feature on those switches (IMO anyway).

^ exactly

The OP has not given enough details for a discussion of any sort of security. Since he states his servers are on 1 vlan, and his users are on another - I have to assume he is routing between them or how would they access the server their files are on?

Now maybe that is the OP issue, maybe he created 2 vlans and he has no routing between them? Yeah that would be secure ;) but kind of useless in accessing user files stored on the server..

If he is just routing between the vlans - then no there is no security by just having the devices on different segments/vlans.. What is handing the routing? Is it the switch just doing intervlan routing.. Unless the switch is capable of acls again we don't have any security.

Now if he has a firewall that is doing the routing between the segments - then sure he could say you can only access IP on server vlan via port 80, or via smb/cifs to different IP in the server vlan from the users/guest vlan.

Need more info from the OP to continue this discussion.

This is not true. You can have servers and computers on as many vlans that you want

Your saying servers and computers can be on VLAN 1,2,3,4....... even for the same servers and computers I'm not talking about that for the first line yes you could do that but not the second line which is a server to be on VLAN 1 only and a computer not to be on that same VLAN 1 but to be on VLAN 2 only.

VLAN can be flawed even without mirroring in that VLAN 1 is linked to VLAN 3 and VLAN 2 is linked to VLAN 3 with a MAC that is the same in VLAN 1 and VLAN 2 so that when traffic is received by VLAN 3 its sent to a MAC thats in both VLAN 1 and VLAN 2. That shouldn?t happen but it does because the VLAN is flawed in not sending it to the MAC with the lowest VLAN ID of course different IP's in the two VLAN with the same MAC is not a problem if the routeing table does MAC & IP but even then it can still happen. Which is why its not secure because no one put the option in for VLAN switch or VLAN hub mode per port as part of the VLAN design.

But all that is just the reason why VLAN is not secure.

PeterUK sounds like your taking about vlan hopping or attacks against vlans... Sure there are attacks that could allow you to hop vlans.. Now is the switch he is using open to some of these attacks? Not sure since he has not given the details of his switch.

Sure there are mac flooding attacks, there are vlan tagging attacks, there are multicast attacks, encapsulated attacks -- lots of attacks that could be used to hop a vlan or break the switch to bleed traffic between the vlans. Depends on the switch being used how secure it is against such attacks.

But generally speaking you have to assume that traffic between vlans is isolated, are we talking DOD secure or just how companies do business?

Is that what the user is asking? Should he use physical switches vs vlans so that there is a physical separation between the segments? I really am not clear to what the OP is after. But I can tell you with most companies vlans are highly used and considered secure.. Now what might be required in a DOD or government network -- they might not allow just vlans and require physical network segments?

From the info given I would be more worried about using wireless AP on the same vlan/segment as the users than being worried about only vlan separation between his users and his servers.

never stated vlans in itself was secure. It really doesn't matter what vlan servers are on, in many instances the vlans are quite open. There are other things that should be added into the network to make your network secure. Install a NAC appliance for instance would make your network pretty secure, well it will keep out unauthorized equipment from attaching to your network anyway, this would "fix" your vlan issue.

http://en.wikipedia.org/wiki/Cisco_NAC_Appliance

The server doesn't have to be on the same vlan, but it does have to be on an accessible vlan.

server 1 can be on vlan2 and workstations can be on vlan5, vlan2 can access vlan5 and vice versa...provided you have a layer 3 switch or something doing some sort of bridging/routing.

The server doesn't have to be on the same vlan, but it does have to be on an accessible vlan.

server 1 can be on vlan2 and workstations can be on vlan5, vlan2 can access vlan5 and vice versa...provided you have a layer 3 switch or something doing some sort of bridging/routing.

Because your bridging which is nothing to do with vlan2 can access vlan5 and vice versa it is because of bridging. I doubt bridging is needed in this setup any way.

If any server is going to be accessed from any other vlan, you would need to do bridging or you would need to have a second nic in the server attached to the other vlan.

Whats the difference between accessing the server on a difference VLAN by bridging then accessing the server on the same VLAN without bridging?

Your accessing the server either way.

Any computer or server needing to access each other needs to be on the same VLAN.

Any computer or server not needing to access each other can be put in a different VLAN.

Machines in different VLANs can communicate, it all depends on the ACLs on the device.

It wouldn't be bridging on a L3 switch / router it would be InterVLAN routing.

You don't need two NICs either, you can have a server with a single NIC in VLAN30 which is accessible from VLAN10 and VLAN20, but still have VLAN10 and 20 unable to access each other.

You would have rules allowing traffic from VLAN10 to VLAN30 and VLAN20 to VLAN30, but with an explicit deny rule on traffic from VLAN10 with a destination in VLAN20 and VLAN20 with a destination in VLAN10

One requires the proper hardware on the network the other requires the proper hardware in the server.

No thats side stepping question bridging breaks VLAN thats the only reason a server on a difference VLAN can be accessed be another VLAN is by bridging even without VLAN you can access the server by bridging.

I haven't seen a switch allow you to have multiple untagged vlans to a port. You can do trunking but you would need an os that would handle that. Then yes you could do that with a tagged port.

Try this - 24 Port Switch

P1-10 Untagged Members of VLAN10

P11-22 Untagged Members of VLAN20

P23 - Untagged Member of VLAN30

P24 Tagged Member of VLAN 10,20,30

P24 into a VLAN tagging aware router, in my normal case a Cisco or Zyxel USG series.

How and the hell did bridging come up? I doubt the user is doing any bridging..

I would wait to hear back from the OP before any continued discussion. Unless you feel you understand what the user is asking? I am not clear what he wants. Now that I reread what he posted, he might just be asking if vlans in general are secure enough - or should he break it out to a physical switch.

Comes down to what security policy your trying to adhere too -- yes in day to day businesses vlans are more than enough for separation. Keep in mind that yes their are attacks for hoping vlans, etc. But generally speaking your fine, we run multiple customers traffic over switches with just vlan isolation between the segments.

My point was that if you route traffic between the vlans - then vlans are not the security barrier, that would be where you route between them.

Is bridging not the term when connecting two networks together. In essence connecting vlans together (whether it be via a router or internally on a switch) is a form of bridging although that term really doesn't mean a whole hill of beans in today's networks. Dig deep to old school days.

Try this - 24 Port Switch

P1-10 Untagged Members of VLAN10

P11-22 Untagged Members of VLAN20

P23 - Untagged Member of VLAN30

P24 Tagged Member of VLAN 10,20,30

P24 into a VLAN tagging aware router, in my normal case a Cisco or Zyxel USG series.

Oh my. You completely missed it. Was talking about a server not a hardware router. I can do similar with VMware and hyper-v nothing to try there I know what it does and how it works. Like I said you need an os that supports it.

Trying not to add any other pieces of networking hardware other than the switch itself or the servers to stay on topic.

There are several key pieces that we don't know. First what is meant by secure (inside attack, outside attack, malware attack, who knows maybe by this vague description he wants to know if he is secure from a std his girlfriends sister has who he never met...might as well be, we have about enough information to possibly to come to a conclusion about that). Second we know very little about his network, it's got vlans and what are we supposed to be able to tell with that information? I have some or all of the parts to put you in orbit, is it possible..that is similar to all of the information that was given in the initial post. Third, what exactly is he trying to accomplish? By attempting to understand the the limited information given he may not have the proper hardware and/or software in place to make this work.

Short answer: Not secure

Long answer: We need more idea of your setup - perhaps a diagram and parts list.

On a basic theory level VLANs are no more secure than having 3 different physical switches. It's all in how you connect them together that counts.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Segra 1.6.2 by Razvan Serea Segra is a free, open-source OBS-powered game recorder offering fast gameplay capture, instant clips, AI highlights, deep game integration, and seamless uploads—perfect for gamers, streamers, and content creators. Lightweight, fast, zero bloat. Segra key features: Automatic Game Recording: Begin capturing gameplay the moment your game launches, with zero manual setup. Instant Clipping: Save important moments instantly using a customizable hotkey—perfect for highlights, montages, or quick shares. Segra AI Highlights: Let Segra automatically detect kills, assists, deaths, and key events to generate polished highlight reels without manual editing. Gameplay Uploads: Upload recordings and clips directly to Segra.tv for fast sharing and cloud access. Deep Game Integration: Enjoy advanced game-data tracking across hundreds of supported titles, enabling smart highlight generation and stat-informed clipping. High-Performance Capture: Record up to 4K at 144 FPS using OBS-powered technology with minimal performance impact, supporting NVENC, AMD VCE, and custom quality controls. Segra Editor: Edit recordings easily with timeline controls, segment management, and event-based navigation to build the perfect clip. Customization Options: Adjust hotkeys, output formats, storage paths, codecs, capture quality, and performance settings for a tailored recording experience. Segra 1.6.2 changelog: UI: Improved the transition from the loading skeleton to the real content card. Security: Added Segra.dll code signing and automatic VirusTotal upload. Settings: Fixed the settings header to highlight Account when scrolled to the top. Recording: Updated OBSKit.NET to 1.4.1. Download: Segra 1.6.2 | 74.5 MB (Open Source) View: Segra Homepage | Github | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Hey Google, these are the Gemini features I want in 2026 by Aditya Tiwari Google Gemini has been around for over three years. The AI chatbot started its journey back in 2023 (as Bard) when ChatGPT was already a talk of the town. However, it quickly attracted criticism after misrepresenting facts about the James Webb Space Telescope. The search giant spent a year fine-tuning Bard before rebranding the chatbot and its underlying generative AI model to Gemini, drawing inspiration from NASA's first human spaceflight program. Note that Bard was initially powered by LaMDA and PaLM 2; Google has since added several new features and integrations to Gemini. That said, there is scope for improvement and a gap for new features. I have been using Gemini for a while now and have realized that the chatbot lacks several features, making it harder for me to research across topics. These are mostly function-over-form updates that can improve the overall experience. Delete individual messages from a conversation Image via DepositPhotos.com One good thing about Gemini is that it can maintain context throughout the conversation. But things might get chaotic when you want to ask a related question, but don't want it to be part of your conversation in the long run. You can't ask that related question in a fresh chat because Gemini will lose the active conversation context of what you're trying to research. If Google allowed you to delete individual question/answer pairs, you could simply ask about a sub-topic and remove it from the conversation to create a smooth flow of important stuff. Offline mode Image via DepositPhotos.com A big pain of using Gemini daily is that everything loads from the cloud. It takes time for your chats to appear, and you can't view your conversation history while offline. To get a better idea, you can open the Gemini app and see how it looks without an internet connection. While Gemini models run in the cloud, it wouldn't hurt if Google could store chats (at least the text part) on the device so we can refer to them when offline. Google can also offer a lightweight version of its AI model to help with basic drafting, summarization, and other tasks. It has the Gemini Nano model, which can perform on-device processing on Google Pixel, Samsung, and some other Android brands, but it's a system feature and not related to the cloud-based Gemini app. Make temporary chats permanent I can't thank Google enough for taking the time and effort to add incognito mode or temporary chat mode to the Gemini app. It lets you have conversations without worrying that the topics will end up in your chat history or used for model training (at least on paper). Google claims that it doesn't use your temporary chats to "personalize your Gemini experience or train Google’s AI models." However, the data is stored "up to 72 hours to respond to you and to process any feedback you choose to provide." That said, I often start researching something in a temporary chat, only to realize the chatbot's answer is good enough to refer to later. Sadly, Gemini doesn't have an option to make such temporary chats permanent. In other words, I won't be able to follow up on it if I close the temporary chat. I'm left with alternatives like copying the answers into notes or another app. My digital life will get a lot better if Gemini gets a button to make temporary chats permanent. Collapse answers for a cleaner view You're heavily invested in your research game and suddenly feel the need to go up in the chat to recall something. This is when the conversation thread starts to feel like an overwhelming, unending wall of questions and answers. What if Google added a way to collapse Q&A pairs in the Gemini chat thread? It would look quite clean and easy to navigate. You'll quickly get an overview of everything you have discussed with the chatbot. Add buttons to jump between messages Suggested mockup of the feature. This reminds me of a small but useful Gemini feature that Google could add to its chatbot: the ability to hop between prompts in a conversation. Just add simple up- and down-arrow buttons, similar to YouTube Shorts, so people can quickly scroll through the messages. A table of contents or Chat Overview It's hard to get a bird's-eye view of everything you have discussed with the chatbot during a lengthy conversation. This is where a table of contents, or Chat Overview, displayed at the top of the screen, possibly in a drop-down button, might come in handy. You'll be able to get an overview of the chat and jump between messages, serving as an alternative to the up/down arrow buttons. Temporary mode for Gemini Live Image: Google You can use Gemini Live to have real-time conversations with the chatbot, which feels like you're talking to someone in the same room. However, a downside is that Gemini Live doesn't work in Temporary Chat mode, so all your conversations end up in the chat history. Google should consider expanding the temporary chat mode to include Gemini Live. Default to a specific chat One thing that feels somewhat annoying to me is that Gemini always opens in a new chat, whether on web or mobile. Sometimes, you want to return to your last chat. Google can take cues from web browsers, which let you choose whether you want to go to a new tab or a specific web page(s). Gemini can also have options to default to a specific chat when reopened. That said, generative AI chatbots have endless possibilities given the vagueness of their work. You can mold them the way you want by attaching different connectors, adding custom instructions, and including source files. It remains to be seen what Google has in store for future updates and whether anything from this wishlist gets the green light. The search giant released a stream of new Gemini updates in recent months, including Gemini 3.5 Flash and Gemini Omni Spark, adding that it now has 13 products with more than a billion users each. What do you want to see in the Gemini app? Tell us in the comments.
    • Thank you for the post. Just a FYI that links to an outside site or promoting specific software is considered spamming here. Asking general questions is fine.
    • I have been thinking about AI detector tools as a software workflow rather than a single "AI score" widget. When someone pastes text or uploads a document, the UI can return a report with a probability-style score, sentence highlights, reliability notes, and limitations. The useful part is that it can point a reviewer toward passages worth reading again. The risky part is that a polished score can look more certain than it really is. For people who build or review web apps, what should happen before the user copies or exports that kind of report? The minimum I would expect is: A clear input boundary for pasted text versus document files. Limits shown near the workflow, including minimum text length and maximum file size. A report label that says the result is a signal, not proof of who wrote the text. Sentence highlights and evidence notes alongside the global score. Reliability notes when the sample is too short or lacks enough sentence variety. False-positive and false-negative caveats that remain visible in copied/exported summaries. I am trying to avoid the pattern where a clean report card becomes the whole product story. For AI detection, "review this evidence in context" seems more honest than "trust this score." Would you keep the warning text visible on every report, or make it collapsible so the main result stays easier to scan? Disclosure: I work on a small AI detector/reporting workflow, but I am intentionally not linking it here. I am asking about software and report design, not promoting a site.
  • Recent Achievements

    • Conversation Starter
      sumytbe earned a badge
      Conversation Starter
    • One Year In
      B4dM1k3 earned a badge
      One Year In
    • One Year In
      DarkWun earned a badge
      One Year In
    • Dedicated
      Almohandis earned a badge
      Dedicated
    • Dedicated
      JuvenileDelinquent earned a badge
      Dedicated
  • Popular Contributors

    1. 1
      +primortal
      507
    2. 2
      +Edouard
      181
    3. 3
      PsYcHoKiLLa
      86
    4. 4
      Michael Scrip
      78
    5. 5
      Steven P.
      76
  • Tell a friend

    Love Neowin? Tell a friend!