A virtual network refers to configuring the logical topology of a network on top of a physical network infrastructure by utilizing the functions of switches and routers, thereby allowing network administrators to arbitrarily aggregate any number of network segments within a local area network into user groups, as if they were a single LAN. Some small networks have modest network requirements, and to save costs, many LANs adopt a simple structure segmented by routers. Under such a network, broadcast data packets on each LAN can be received by all devices on that segment, regardless of whether those devices need them.
I. Port-based Virtual LAN division is a popular and the earliest method. Its characteristic is grouping router ports, with each group defined as a Virtual LAN. Port grouping is currently the most commonly used method for defining VLAN members, and the configuration is quite straightforward. Purely using port grouping to define VLANs does not allow multiple VLANs to contain the same physical segment. Its characteristic is that all terminals on the various ports of a VLAN are within a single broadcast domain; they can communicate with each other. Communication between different VLANs requires routing. The advantage of this VLAN division method lies in its simplicity and ease of implementation. Broadcasts sent from one port are directly forwarded to other ports within the VLAN, which also facilitates direct monitoring.
II. Virtual LANs based on hardware MAC-layer addresses have different advantages and disadvantages. Since the hardware-layer address is hard-wired to the workstation’s network interface card, a VLAN based on hardware-layer addresses allows network managers to move workstations on the network to different physical locations while enabling the workstation to automatically retain its original VLAN membership. In this way, a VLAN defined by hardware-layer addresses can be viewed as a user-based VLAN.
III. Penetrating an internal network means the VPN Client can be located within a network using internal addresses, while the VPN server is on a public network with a legitimate IP address. Chaining refers to dialing into one VPN server first, and then dialing into a second VPN server.
IV. Implemented through netsh.exe, the specific commands are as follows:
1. netsh ras ip set addrassign method = pool
Assigns IPs using an address pool;
2. netsh ras ip add range from = 192.168.3.1 to = 192.168.3.254
The address pool range is from 192.168.3.1 to 192.168.3.254; here, a virtual internal address pool is used;
3. netsh routing ip nat install
Installs the NAT protocol;
4. netsh routing ip nat add interface= "Local Area Connection" mode = full
Sets the "Local Area Connection" network card as the external-facing card for address and port translation. Note that the RemoteRegistry service must be in a running state at this time;
5. netsh routing ip nat add interface= "Internal" mode=private