Chris Buechler schrieb:
[...]
It looks like the virtual IPs are not existing. If I try to ping e.g.
192.168.3.1 I get Destination Host Unreachable.
From the firewall itself? I don't think that'll work (due to loopback
issues). If traffic passes in and out just fine, as intended, then
you're set.
With ping directly from the Firewall itself I got a response like that:
--- snip ---
# ping -c 5 192.168.3.1
PING 192.168.3.1 (192.168.3.1): 56 data bytes
64 bytes from 192.168.3.1: icmp_seq=0 ttl=253 time=69.730 ms
64 bytes from 192.168.3.1: icmp_seq=1 ttl=253 time=124.443 ms
64 bytes from 192.168.3.1: icmp_seq=2 ttl=253 time=67.473 ms
64 bytes from 192.168.3.1: icmp_seq=3 ttl=253 time=170.599 ms
64 bytes from 192.168.3.1: icmp_seq=4 ttl=253 time=144.830 ms
--- 192.168.3.1 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 67.473/115.415/170.599/40.933 ms
--- snap ---
The response is definitely not from the FW. With traceroute I can
trace this response back to a host inside the LAN of my ISP. :-(
From a host inside my LAN I got this response:
--- snip ---
[EMAIL PROTECTED]:~ ping -c 5 192.168.3.1
PING 192.168.3.1 (192.168.3.1) 56(84) bytes of data.
From 192.168.3.2: icmp_seq=2 Destination Host Unreachable
From 192.168.3.2 icmp_seq=2 Destination Host Unreachable
From 192.168.3.2 icmp_seq=3 Destination Host Unreachable
From 192.168.3.2 icmp_seq=4 Destination Host Unreachable
From 192.168.3.2 icmp_seq=5 Destination Host Unreachable
--- 192.168.3.1 ping statistics ---
5 packets transmitted, 0 received, +5 errors, 100% packet loss, time
4000ms, pipe 3
--- snap ---
192.168.3.2 is the IP of my LAN Host.
But if I try to setup the virtual IP manualy I get this:
# ifconfig rl1 inet 192.168.3.1 netmask 255.255.255.0 alias
That's not how virtual IP's work. There are no aliases, it's all
proxy ARP'ed in some fashion and handled that way. When you bind IP's
to the box like that, the services running on it also tend to want to
bind to those IP's, and the whole thing becomes a big mess (not to
mention potentially opening up more access to your firewall than you
intend).
Okay I believe you, but what can I do to solve my Problem with my three
LAN subnets: 192.168.0.0/24 (main), 192.168.3.0/24 and 192.168.101.0/24.
All of them are located on the same physical interface and in this
moment it is not possible to join the subnets.
Is there a way to handle that configuration?
Regards
Bastian
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
