On Sun, 2 Jul 2017 13:40:01 +0200
"Hartmann, O." <ohartm...@walstatt.org> wrote:

[ snip ]

> On igb1.2 (vlan tag 2) I want to run an asterisk PBX (that is the main
> goal). The interface is attached with the IP The NIX is
> attached to a VLAN capable switch and VLAN 2 is for VoIP telephones.
> To not use a routing daemon due to the small size of my network, I
> desided to use static routes, in rc.conf I placed the following
> variables:
> static_routes="igb1.2 igb1.10"
> route_igb1_2="-net -interface igb1.2"
> route_igb1_10="-net -interface igb1.10"
> igb1 is assigned to IP/NET
> netstat -Warn gives me (as dummy, since I have no direct access to the
> box via serial console from the system I write this mail):
> Internet:
> Destination      Gateway         Flags       Use    Mtu      Netif
>        link#3          UH       334564  16384        lo0
>   link#4          U         23452   1500       igb1 
>      link#4          UHS       29734  16384        lo0
>   link#5          U           271   1500       igb1.2 
>      link#5          UHS           0  16384        lo0

I think you did not include network on igb1.10...

> For readability, the Expire column has been avoided.
> Since I use some tuning and security advisories for advanced settings,
> for the tests they were disabled or reset to FreeBSD's defaults, i.e.
> blackhole etc.
> gateway_enable="YES" is set, I checked the sysctl also. Further,
> icmp_drop_redirect="NO" and "net.inet.ip.forwarding=0". I followed
> basically chapter 30.2 "Gateways and routes" of the recent handbook in
> addition to the Wiki "NetworkPerformanceTuning" of FreeBSD's.

This is kind of contradiction here - if you have line


in /etc/rc.conf, then you should have set


after system boot. If you edited /etc/rc.conf, setting will be
activated after reboot.

> From the routing device itself, it is possible to ssh into a VoIP
> client attached to the switch to which igb1.2 trunks the net. Pinging
> is also possible.
> Attached to igb1 is the network with a bunch of hosts.
> From any host within this network it is possible to ping the
> network and its hosts within, but no SSH, not web (80,
> 443). 

Weird - if icmp (ping) works and tcp (web, ssh) not, something is
filtering traffic. But with net.inet.ip.forwarding=0, even pinging host
should not work. Try tcpdump to see what's going on. 

> Since my IPFW setup is a catastrophy, I switched it off (ipfw firewall
> disable) in combination with setting
> "net.inte.ip.fw.default_to_accept=1". So, this should ensure that
> anything is passed the ipfw. But the result is still the same. What am
> I doing wrong here? Is inter VLAN routing in FreeBSD CURRENT even
> possible?

>From network architecture view, there is no difference - vlan is
network interface just like physical ethernet. Basically everything is
the same (sometimes there is issue with mtu, but this hardware


freebsd-current@freebsd.org mailing list
To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"

Reply via email to