Fiddling around with a self-brewn router/firewall based on 12-CURRENT and ipfw, I run into problems when setting up a trunk port with different VLANs and static routes.
The "router" has three NICs, igb0, igb1, igb2 (it is de facto an APU 2C4 from PCengines). igb0 is attached to an external VDSL2+ Modem and not connected at the moment. igb2 is also not connected yet. igb1 bears several VLANs: 2, 10, 100 (igb1.2, igb1.10 ...) and the "native", untagged LAN (on igb1). There is no default route set, but even with the ISP's network active and igb0/tun0, via ppp configuration, with tun0 attached to the address obtained by the ISP and set as default route, the problem I try to describe persists and is the same with or without the default route. On igb1.2 (vlan tag 2) I want to run an asterisk PBX (that is the main goal). The interface is attached with the IP 192.168.2.1. The NIX is attached to a VLAN capable switch and VLAN 2 is for VoIP telephones. To not use a routing daemon due to the small size of my network, I desided to use static routes, in rc.conf I placed the following variables: static_routes="igb1.2 igb1.10" route_igb1_2="-net 192.168.2.0/24 -interface igb1.2" route_igb1_10="-net 192.168.10.0/24 -interface igb1.10" igb1 is assigned to IP/NET 192.168.0.1/24 netstat -Warn gives me (as dummy, since I have no direct access to the box via serial console from the system I write this mail): Internet: Destination Gateway Flags Use Mtu Netif 127.0.0.1 link#3 UH 334564 16384 lo0 192.168.0.0/24 link#4 U 23452 1500 igb1 192.168.0.1 link#4 UHS 29734 16384 lo0 192.168.2.0/24 link#5 U 271 1500 igb1.2 192.168.2.1 link#5 UHS 0 16384 lo0 For readability, the Expire column has been avoided. Since I use some tuning and security advisories for advanced settings, for the tests they were disabled or reset to FreeBSD's defaults, i.e. blackhole etc. gateway_enable="YES" is set, I checked the sysctl also. Further, icmp_drop_redirect="NO" and "net.inet.ip.forwarding=0". I followed basically chapter 30.2 "Gateways and routes" of the recent handbook in addition to the Wiki "NetworkPerformanceTuning" of FreeBSD's. >From the routing device itself, it is possible to ssh into a VoIP client attached to the switch to which igb1.2 trunks the net. Pinging is also possible. Attached to igb1 is the 192.168.0.1/24 network with a bunch of hosts. >From any host within this network it is possible to ping the 192.168.2.0/24 network and its hosts within, but no SSH, not web (80, 443). Since my IPFW setup is a catastrophy, I switched it off (ipfw firewall disable) in combination with setting "net.inte.ip.fw.default_to_accept=1". So, this should ensure that anything is passed the ipfw. But the result is still the same. What am I doing wrong here? Is inter VLAN routing in FreeBSD CURRENT even possible? My knowledge about routing is limited. The handbook covers the most simplest examples and from the perspective of the simple examples, VLAN static routing should be very similar - regarding to chapter 30.2, and the example of multiple (two) routers separating the network, the router with multiple "NICs/VLANs" is very much the same except the fact that in the example shown in 30.2 the routing devices do have two NICs while in my case there is only one "backend" to all NICs. What is wrong in my logic? Thanks for your patience, kind regards Oliver _______________________________________________ firstname.lastname@example.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-current To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"