Cigarette Pack Size Ethernet Bridges?

Lots of poeple make tiny single board computers with a variety of interfaces and with a Linux port for the CPU and drivers for the IO devices. I know there are some with multiple ethernet jacks and they are frequently used as routers. Linux is Linux. You can make it a filtering bridge if you want.

SysAdmin magazine always has adverts for this stuff. Maybe you can find the vendors on the website.

Have you considered a 24 port switch that supports VLANs? This could be used to create 12 'virtual' 2 port switches.

To get the manageability you want you will have to spend a bit but it will be less that some of the alternatives. I know that for example a Cisco Catalyst 2950 would do.

Google - [two port ethernet switch]

As far as I can see following are all Copper-Fiber convertors and may not be suitable for you. You need to have a look yourself though since I just had a glance.

Allied Telesyn AT FS201 2-Port Ethernet Switch (AT-FS201-20)

It's made as a 10/100 convertor. Perfect if 10 is OK but it looks like they do GBE ones too.

today announced the AT-WLMT wall-mount bracket set for its MC- and FS- series of standalone and bridging media converters. The AT-WLMT brackets are particularly useful in locations where a single media converter needs to be physically anchored.

Available in packs of 10, the AT-WLMT includes all necessary fitting components to ensure trouble-free and fast installation. The AT-WLMT can be used for all of the Allied Telesis bridging media converter series (AT-FSxxx & AT-GS2xxx for Fast Ethernet and Gigabit).

Google - [three port ethernet switch]

Google - [five port ethernet switch] - These are cheap and common but most not managable. Try [four port too]

Alternately, there is a feature sometimes called PVE (Private Virtual Edge). Supported on some Cisco and Linksys devices amongst others. Doesn't inherently give you the advanced filtering desired, but should be more secure (in theory) than using VLANs.

What are the greatest typical weaknesses in VLANs, and how does PVE improve on that?

For VLANs, whether a packet is allowed to egress a particular port depends on whether information *in the packet* matches the selection criteria. If you can trick a switch into accepting the information that -you- put into the packet, then you can get it to write out to ports that you shouldn't have access to.

For PVE, the restriction of ports is done through some unspecified method (not necessarily the same for any two models of switch), but which probably involves only information in internal headers that the switch wraps around the packet, with the packet contents never being examined for this purpose. You cannot play multihop VLAN spoofing games because the PVE information is not transitive and is completely internal, stripped off before packet egress.

Note that PVE is not the same thing as "IP in IP" or "private VLANs" or "nested VLANs": PVE is control information specific to a particular switch, configured on the switch, and not transmitted anywhere.

Does Netgear make any managed switch with something similar to the PVE feature? I gather that Linksys makes a few of these.

Which models of Cisco and Linksys GigE copper switches support the private VLAN feature that is "spoof-proof"?

Are any of these generally in plentiful supply as surplus product at a pretty steep discount?

I don't work for Cisco (or Linksys), and don't have access to any of their internal technical documents, and I don't have access to any Cisco switches (and only some older Linksys ones). Thus, I am not in any position to make a statement that any particular model is "spoof-proof".

The statement I made, which is quoted above, is that PVE is more secure in theory. I do not know the extent to which that theory has been put to the test. I'm just going by the specs and summary discussions.

I don't see anything -obvious- on the netgear pages, or on the specs of their advanced FSM* layer 2 or layer 3 managed switches. Sometimes features like this (that don't have an associated standard number) are buried in the user manual. The jumps of logic in Netgear manuals tend to make my head hurt, so I don't look at them very often.

Agreed on that. It looks to me in their GSM7324 like they had three groups of people all competing to implement the same features in different ways and different parts of the UI.

Cisco VLAN security WP

this references a 3rd party test for various vlan potential weaknesses.

Private VLANs:

switches that support private vlans: