最终效果：
vlan 2模拟局域网服务器，手动配置地址，也能上公网
vlan 3、4用dhcp分配地址
vlan 4的用户之间不能互通，但可以和其它vlan通，也能上公网
vlan 3的用户不受任何限制可以和任何vlan通，也能上公网

交换机vlan上启了mux vlan 就不能配子接口了，所以dhcp在交换机上也用不了了，所以要单独拿 一台设备当dhcp服务器

接口上放行二层数据包通过，只要二层的dhcp广播包能过去正常得到地址就行

R1

dhcp enable

acl number 2000
rule 5 permit source 192.168.0.0 0.0.255.255

interface GigabitEthernet0/0/0.2
dot1q termination vid 2
ip address 192.168.2.1 255.255.255.0
arp broadcast enable

interface GigabitEthernet0/0/0.3
dot1q termination vid 3
ip address 192.168.3.1 255.255.255.0
arp broadcast enable
dhcp select interface

interface GigabitEthernet0/0/0.4
dot1q termination vid 4
ip address 192.168.4.1 255.255.255.0
arp broadcast enable
dhcp select interface

interface GigabitEthernet0/0/1
ip address 1.1.1.2 255.255.255.0
nat outbound 2000

ip route-static 0.0.0.0 0.0.0.0 1.1.1.1

sw1

vlan batch 2 to 4

dhcp enable

vlan 2
mux-vlan
subordinate separate 4 //这个vlan下的用户都是二层隔离的不能通
subordinate group 3//这个vlan下的用户不受限制

interface GigabitEthernet0/0/1
port link-type access
port default vlan 3
port mux-vlan enable

interface GigabitEthernet0/0/2
port link-type access
port default vlan 3
port mux-vlan enable

interface GigabitEthernet0/0/3
port link-type access
port default vlan 4
port mux-vlan enable

interface GigabitEthernet0/0/4
port link-type access
port default vlan 4
port mux-vlan enable

interface GigabitEthernet0/0/5
port link-type access
port default vlan 2
port mux-vlan enable

interface GigabitEthernet0/0/6
port link-type trunk
port trunk allow-pass vlan 2 to 4