Need simple help with Zeroshell bridge

Home Page Forums Network Management ZeroShell Need simple help with Zeroshell bridge

This topic contains 5 replies, has 0 voices, and was last updated by  georgemason 10 years, 9 months ago.

Viewing 7 posts - 1 through 7 (of 7 total)
  • Author
    Posts
  • #41041

    georgemason
    Member

    Hi,

    I’m trying to configure a Zeroshell bridge to implement QoS on my LAN. I use VMware ESX server and so have configured everything as follows:


    Internet
    > Cisco PIX Firewall
    > Zeroshell bridge VM
    > LAN
    (VLAN4) (VLAN3)

    I followed the instructions on Zeroshell/QoS and all seemed to go as planned. Now though any machines on the LAN have very limited access to anything behind the Zeroshell VM. There is someconnectivity (for example I was able to get a DHCP request through) but no HTTP, SMTP, etc.

    To test that the VLANs are working correctly I moved all of the machines into VLAN4 whereupon they can see the Internet and each other as expected. In VLAN3 they can see each other but not the Internet.

    Any help would be appreciated.

    George

    #46522

    georgemason
    Member

    Sorry, should have mentioned that I’m using the Zeroshell VMware applicance (ZeroShell-1.0.beta9-VMWARE.zip).

    #46523

    imported_fulvio
    Participant

    Are you sure that VLAN3 and VLAN4 are necessary in your setup? the VLANS are 802.1q trunks? In this case post us more details about the subnets you use and how you create the bridge.

    Regards
    Fulvio

    #46524

    georgemason
    Member

    Hi fulvio, thanks for the reply.

    I put the VLANs in place to seperate the two parts of the network which the bridge then connects, providing the QoS. I will attempt to explain in more detail below.

    Basically the servers, and the Zeroshell are all running on virtual machines in the same VMware ESX server. The servers and workstations are all on the Inside VLAN, the Zeroshell VM has two interfaces, one of which is on the Inside VLAN, the other on the same VLAN as the firewall.

    All machines have addresses on the 192.168.11.0/24 network. The firewall is also on this range. My understanding was that the Zeroshell should act as a L2 bridge between the two segments, therefore forwarding all packets it receives on either interface and doing QoS according to the rules I have created. This doesn’t seem to be happening at the moment, although broadcasts must be getting through, because a test laptop I used managed to get an DHCP IP across the Zeroshell. If I didn’t use VLANs, then when the machines try to get to the default gateway (i.e. the firewall) then they will access it directly, therefore no QoS. Or is this incorrect?

    To give an example, my test machine is 192.168.11.10, so the network map is like this:

                VLAN3                                           VLAN4
    PC
    > Zeroshell
    > Firewall
    > Internet
    192.168.11.10 192.168.11.252 192.168.11.254

    Thanks,

    George

    #46525

    georgemason
    Member

    Just to clarify, the Zeroshell machine doesn’t see the 802.1q trunks, it just has one interface in one segment (VLAN3) and one in another (VLAN4).

    #46526

    georgemason
    Member

    I have thought more about this, and I am fairly sure that I will have to use a L3 (i.e. routed) setup. The reason for this is that I’m trying to use a VM as the bridge, this would be fine if:

    – all of the traffic came from the same virtual switch as the Zeroshell VM AND
    – I could enable promiscuous mode on the virtual switch port and virtual NIC of the Zeroshell VM

    However some of the traffic comes from the physical LAN, hence same VLAN but seperate switch, and I think that promiscuous mode is disabled by default in VMware ESX.

    What is required to change from a bridged to a routed configuration?

    Thanks, George

    #46527

    georgemason
    Member

    Just to close off this topic, here’s a quick update.

    I managed to get QoS working in my environment by changing from a bridged to routed configuration. I’m still not clear on why the bridged setup didn’t work, but by moving everything to layer 3 everything is working as expected.

    What I did:

    – Gave ETH00 and ETH01 IP addresses, on different IP networks/VLANs
    – Changed inside IP of firewall to same IP subnet/VLAN as ETH01
    – Gave ETH00 the firewall’s old inside IP
    – Configured the default gw on Zeroshell to point to the inside IP of firewall
    – Default gw of other machines on network were already pointing at Zeroshell, as ETH00 had the firewall’s old IP

    After making these changes traffic flows and I can see the effect of shaping when I alter the QoS parameters.

    Thanks for making such a useful product open-source. I love linux! 😀

    George

Viewing 7 posts - 1 through 7 (of 7 total)

You must be logged in to reply to this topic.