OK, strange request but I want to bridge three vlans under linux 2.4. Bridging works fine with two vlans, but is failing to route when I add the third vlan. Situation is clearly to have Lan, internet and DMZ vlans. The reason they are vlans is that I am using a Linksys WRT54GS and hence you effectively have a 5 port hub on the back which can be segregated into flexible vlan groups. I clearly want to just be able to move something in and out of the DMZ depending on which port it''s plugged into, but without having to change it''s IP address or do any routing. (I like transparent firewalls and QOS!) So what''s going wrong when I try to put my third vlan into the bridge? Actually it seems to be more fundamental than that. The inet and lan vlans both have no IP address, can then build a bridge no problem. As soon as I remove the ip address from the DMZ lan, even without adding it to the bridge, my routing stops working on the machine... Is this a linux 2.4 limitation or user error? Grateful for any advice Thanks Ed W
Ed Wildgoose wrote:> OK, strange request but I want to bridge three vlans under linux 2.4. > Bridging works fine with two vlans, but is failing to route when I add > the third vlan....> Is this a linux 2.4 limitation or user error? Grateful for any adviceHmm, OK I know I haven''t given much info, but first off is this scenario actually possible? A bit of digging in the bridging howto suggests that it is. Also I just noticed that STP is off in my setup. Is this going to be mandatory when we add three vlans into a bridge? Thanks for any tips on actually debugging whats happening here Ta Ed W
Ed, can we get more information as to what devices on your network have what IP, your VLAN config, your bridge config, you IPTables(-save) config? I need some more data to stare at to try to find a problem in this mix. Grant. . . .
Taylor, Grant wrote:> Ed, can we get more information as to what devices on your network > have what IP, your VLAN config, your bridge config, you > IPTables(-save) config? > > I need some more data to stare at to try to find a problem in this mix.It''s a wrt54G, so the 5 ports on the back are really a hub plus a single net interface. However, the driver has the capability to tag and create multiple vlans from any group of ports So the end result is that if I create three vlans on the same effective net interface then routing stops working properly until I turn on STP (even if the bridge doesn''t use all three vlans). If I make the bridge use all three vlans (each vlan without a real IP or netmask) then routing stops working completely even with STP enabled. Is the limitation because of the multiple vlans on a single real net interface? Of course since the vlans are driver implemented there could be other problems arising, so simply stating whether it ought to work or not would be good at this stage... Software is "openwrt" which is a hacked 2.4 kernel for arm, and a number of pre-applied patches. I would have to dig a little to remind myself of exactly what patches are applied, but basically stuff like the bridge firewalling stuff I think. I''m testing by plugging real machines into the lan, wan and DMZ vlans and seeing if they can see each other... Any suggestions? Ed