WannaCry infected other machines through the LAN. That made me think of how we use the LAN at our office: The traffic is client<->server, client<->internet, and server<->internet - never client<->client.

What would be an easy way block client<->client traffic? E.g. is it possible to make a 24-port switch regard the first 20 ports as client ports between which the traffic is blocked, and make the last 4 ports be regarded as server/internet ports which can talk to any other port?

  • how to configure a switch is off-topic here (not a security question), but blocking client-to-client traffic could be a on-topic question - are you open to non-switch-related options?
    – schroeder
    May 22, 2017 at 10:52

1 Answer 1


Some switches support the private VLANs concept, which does exactly what you describe. It's not really common on low end devices though. The alternative (which may be a bit more flexible) is to use local firewalls (which is a good idea anyway) and allow only traffic to and from specific hosts and ports.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .