VLAN to VLAN blocked routing not working (SOLVED)

Home Page Forums Network Management Networking VLAN to VLAN blocked routing not working (SOLVED)

This topic contains 23 replies, has 0 voices, and was last updated by  wifiguy 9 years, 2 months ago.

Viewing 15 posts - 1 through 15 (of 25 total)
  • Author
    Posts
  • #42184

    wifiguy
    Member

    Hello all,

    Huge fan of Zeroshell. Great product, very surprised something like this is free!

    I have two VLANs currently set up on this server. The Native VLAN, and VLAN20. I have a forwarding rule set up and it is as follows:

    DROP all opt — in * out * 10.0.0.0/8 -> 192.168.1.0/24 (Active)

    This doesn’t seem to work and I am not sure what I am missing. Any ideas as to why this isn’t working?

    Any help would be greatly appreciated.

    Thanks all,

    #49543

    ppalias
    Member

    What is the output of the command

    iptables -L -v

    ran on a shell?

    #49544

    wifiguy
    Member

    I am going to redo this install on a different server. I’ll get that up and running and let you know. BRB

    #49545

    Marcelo
    Member

    Try moving your restrictive rules to higher priorities, possibly the first ones.

    Chances are you have other rules with higher priorities that are allowing the packets to go through.

    Regards

    #49546

    wifiguy
    Member

    @ppalias wrote:

    What is the output of the command

    iptables -L -v

    ran on a shell?

    Hey ppalias,

    I got the system configured on a new server, the server we plan on going into production with. I got my DHCP Pools and VLAN’s set up. On question though, even before I worrie about firewall filtering, how do I make certain VLAN’s not NAT?

    For example, VLAN 20, 30 and 70 need to be NAT’d, but VLAN 74 does not need to NAT’d. We have a /22 which is a direct allocation from ARIN and we do not need VLAN74 NAT’d.

    Can you help me with this configuration?

    #49547

    ppalias
    Member

    Check my latter posts in this forum, another friend asked the same thing as you did.

    #49548

    wifiguy
    Member

    @ppalias wrote:

    Check my latter posts in this forum, another friend asked the same thing as you did.

    Aw. So would it look something like this?

    eth0 – 123.45.678
    Eth1 – 10.0.0.1/24 (NAT’d with eth0)
    eth1 (vlan74) 192.168.1.1/24

    iptables -t nat -I 1 POSTROUTING –src 192.168.1.0/24 -o eth1-74 -j MASQUERADE

    #49549

    ppalias
    Member

    Nope, not that. You don’t want to NAT vlan 74, so you will create rules for the rest of the networks.

    #49550

    wifiguy
    Member

    @ppalias wrote:

    Nope, not that. You don’t want to NAT vlan 74, so you will create rules for the rest of the networks.

    I am assuming I want to put those commands into the scripting. Where do I want this script to run? Pre-Boot?

    #49551

    wifiguy
    Member

    I put these commands in the “Pre-Boot” section of the script Editor.

    iptables -t nat -l 1 POSTROUTING –src 172.30.0.0/16 -o eth1 vlan 20 -j MASQUERADE
    iptables -t nat -l 2 POSTROUTING –src 192.168.1.0/24 -o eth1 vlan 30 -j MASQUERADE
    iptables -t nat -l 3 POSTROUTING –src 152.93.0.0/16 -o eth1 vlan 70 -j MASQUERADE

    We are getting the follow errors with the above commands.

    iptables v1.4.0: Unknown arg _-l’
    Try _iptables -h’ or ‘iptables –help’ for more information.
    iptables v1.4.0: Unknown arg _-l’
    Try _iptables -h’ or ‘iptables –help’ for more information.
    iptables v1.4.0: Unknown arg _-l’
    Try _iptables -h’ or ‘iptables –help’ for more information.

    [Pre Boot]: ERROR (2)

    Thoughts?

    #49552

    ppalias
    Member

    This letter is a capital “i” not small “L”
    Also the number should be after the chain, not before it, my wrong. You should also fix the interface and remove the “vlan 20”,
    Eventually the command should look like that:

    iptables -t nat -I POSTROUTING 1 --src 172.30.0.0/16 -o eth1.20 -j MASQUERADE
    #49553

    wifiguy
    Member

    @ppalias wrote:

    This letter is a capital “i” not small “L”
    Also the number should be after the chain, not before it, my wrong. You should also fix the interface and remove the “vlan 20”,
    Eventually the command should look like that:

    iptables -t nat -I POSTROUTING 1 --src 172.30.0.0/16 -o eth1.20 -j MASQUERADE

    Aw, gotcha. Is this comman something that is run from the shell?

    #49554

    ppalias
    Member

    Yes you have to enter it in the shell, or in the pre-boot script.

    #49555

    wifiguy
    Member

    @ppalias wrote:

    Yes you have to enter it in the shell, or in the pre-boot script.

    Any pros or cons to doing it in the shell VS the pre-boot script?

    #49556

    Marcelo
    Member

    Running from the shell will make it effective just until next reboot, adding it to the preboot scripts will make it to be run automatically on every reboot.

    Chances are you’ll want to do both, on the shell to have the changes to take effect immediately and in the pre-boot scripts so that when you reboot they get executed again…

Viewing 15 posts - 1 through 15 (of 25 total)

You must be logged in to reply to this topic.