How to divide network segments with routes Restrict the external network of some clients

What router are you using?

You didn't draw a picture, I guess you are a Layer 2 switch connected to the AB network segment at the same time, and the router is also connected to the switch. You can set two virtual interfaces on the port where the router is connected to the switch and set the address, one in segment A and one in segment B, so that segment A can access the server and the Internet through the router. For direct access to the server in segment B, make an ACL on the router and restrict segment B's access to segment A and the external network.

It's a good idea to attach a logical topology diagram.

Generally, ACL and MAC binding are used on the egress router to control Internet access, so please ask your network management personnel for details.

In fact, you just need to control the Internet in the part, right, you just need to bind the MAC, and then do policy control, most routers support, if you are not familiar with the route, you can find network control software, such as: network post can be competent.

Personnel are divided into two VLANs

The server has two NICs, each connected to two VLANs

Set the rules, one can go to the Internet, and the other can't.

The so-called ability to access the Internet is to assign routes, which are configured differently for different switches, and the rules are the above two rules.

It's very simple, just all computers can be on the intranet at the same time, the external network, you only need to write the IP and MAC of the machine that needs to go to the external network to the router, and other people who don't need the external network will naturally not be able to go to the external network, the internal network is casual.

Set the DCHP service to a static IP

Ordinary routers can't set multiple network segments, if you want to restrict access to the Internet, use the MAC address in the router's firewall to filter this function. (MAC address filtering to control computer access to the Internet in a local area network).

The more advanced router has the requirements that the "Internet access" option can meet, but it is not possible to set multiple network segments.

The main router is connected to the LAN port of the wireless router, and the WAN port of the wireless router is not used, and the DHCP function is disabled.

The IP address of the computer connected to the wireless router is automatically obtained.

The following methods can be used:

First of all, find your router's IP pool (DHCP) and then limit the number of IP addresses, such as this IP segment should not be the same network segment as the intranet, and the intranet is, for example, , and then set the wireless route to allow the IP segment to go online, such as only allowing this segment of the Internet, so that because the 2 routes are not managed by the same network segment, the Internet machine will not be able to access the intranet.

You should think clearly that only one network segment can access each other! It's so much easier!

A single router can do it. Throttling bandwidth and allocating IPs.

Then buy an 8-port router. Or 16 mouthfuls.

Ordinary NMS routers can only limit the bandwidth of the IP segment, and only routers such as CISC H3C and Huawei that use command mode can limit the bandwidth of the port.

Yes, as you said above, the main function of the router is to communicate with different network segments, and DHCP is just an additional function for him.

DHCP must be turned on, otherwise you can't access the Internet, the computer will automatically IP, and you don't need to manually IP

Wired cascade, A external network router, B internal network router, 2 wiring methods, B settings.

Any LAN port of 1:A is connected to the WAN port of B with a network cable.

Network settings--- WAN port settings--- select "Dynamic IP" for connection mode", click Save.

Wireless settings --- wireless basic --- SSID (wireless name), this remembers, even wifi to use.

Wireless settings --- wireless security--- select WPA WPA2-PSK, enter the 8-digit passcode to save.

System Tools --- restart the router --- OK. Once you've succeeded, you're done.

2: Any LAN port of A is connected to any LAN port of B.

Wireless settings --- wireless basic --- SSID (wireless name), this remembers, even wifi to use.

Wireless settings --- wireless security--- select WPA WPA2-PSK, enter the 8-digit passcode to save.

Network settings --- DHCP service --- turned off.

System Tools --- restart the router --- OK. Once you've succeeded, you're done.