DNS DHCP VLAN VPN matching lab

Match DNS A/AAAA, DHCP reservation, VLAN guest isolation, and VPN remote access; leave port-forward-as-VPN and mask-as-VLAN unused.

Match DNS, DHCP, VLAN, and VPN tickets. Leave port-forward-as-VPN and mask-as-VLAN unused.

Objective 2.4 is concepts under pressure: name → address, lease/reservation, L2 segmentation, and encrypted remote access — not one tool for every symptom.

intranet.corp pings by IP, fails by name

Firewall and routes look fine. nslookup returns NXDOMAIN or an old address. Fix the name service first.

Label printer IP keeps changing after lease expiry

Scope has free addresses. Warehouse scanners bookmark the old IP. Keep the same address without typing a static that collides with the pool.

Guest Wi-Fi can browse corp file shares

Same closet switch fabric. Guests must not share the corporate broadcast domain. Segmentation is the ticket.

Analyst on hotel Wi-Fi needs safe access to file servers

They are off-LAN. Need authenticated encrypted remote access — not opening RDP to the world.

Still in the queue

Create/fix DNS A (or AAAA) so the name resolves to the host IP — Users type names; A/AAAA map name → address. Wrong A looks like 'the server is down.'
DHCP reservation by MAC (scope already healthy) — Printers/keepers often get the same IP via reservation — not a static typed only on the device with a colliding pool.
Place guest SSIDs / ports on a separate VLAN (router joins on purpose) — VLANs split broadcast domains. Guests should not share the corp L2 segment.
Client VPN tunnel into the corp network for the remote worker — VPN encrypts remote access over the internet. It is not a VLAN tag and not a WAN port-forward.
Port-forward RDP on the home router and call it a corporate VPN — Port-forward exposes a service; it is not an enterprise VPN with auth and encryption policy.
Change only the subnet mask on one PC to 'create a VLAN' — VLANs are switch/router segmentation. A lonely mask tweak is not a VLAN.