Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

can you help me configure linux box with vlan support with shoeewall firewall. I tried many configurations but nothing works. This is my network intefaces:

allow-hotplug eth0
auto eth0
iface eth0 inet static
address 192.168.1.1
network 192.168.1.0
netmask 255.255.255.0
broadcast 192.168.1.255
dns-nameservers 192.168.1.1
gateway 192.168.1.1

allow-hotplug eth1
auto eth1
iface eth1 inet manual

auto vlan10
iface vlan10 inet static
address 192.168.10.1
netmask 255.255.255.0
network 192.168.10.0
broadcast 192.168.10.255
vlan_raw_device eth1

auto vlan20
iface vlan20 inet static
address 192.168.20.1
netmask 255.255.255.0
network 192.168.20.0
broadcast 192.168.20.255
vlan_raw_device eth1

auto vlan99
iface vlan99 inet static
address 192.168.4.1
netmask 255.255.255.0
network 192.168.4.0
broadcast 192.168.4.255
vlan_raw_device eth1

Internet is connected to eth0. eth1 is connected to linksys managable switch port which one is configured as a trunk port. There are configured 3 vlans on the switch.

Do I need to create some kind of bridged interfaces between vlans and eth1 or something?

share|improve this question
What does shorewall have to do with this? And why aren't you using the standard VLAN interface naming convention? – womble Jul 23 '12 at 11:44
Shorewall is for routing between vlans and act as a firewall. I did a working setup with 3 phisical NICs (internet and two lans and everything works fine - dns, firewall, dhcp, filtering), but I want to use VLANs. "And why aren't you using the standard VLAN interface naming convention?" What is the standard VLAN interface naming convention? – skurg Jul 23 '12 at 12:10

closed as off topic by womble, Tim Brigham, Scott Pack, Ward, rnxrx Aug 23 '12 at 16:44

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

1 Answer

up vote 0 down vote

Your network configuration looks correct, however we don't know what you are trying to accomplish, so it's hard to make any comment as to what your Shorewall configuration should look like. There isn't anything special you need to do with Shorewall to support vlans, because they are just additional interfaces. You'll need to add each vlan interface into /etc/shorewall/interfaces and assign zones from /etc/shorewall/zones, and then define your access permissions in /etc/shorewall/policy and /etc/shorewall/rules. Take a look at the Shorewall setup guide if you need more detailed help.

I'm assuming you installed the correct packages and loaded the correct modules to support VLANs, (if not this guide for Ubuntu works perfectly in Debian: https://wiki.ubuntu.com/vlan).

The standard VLAN interface naming convention would be eth1.10, eth1.20, eth1.99. However, there have been a few obscure bugs in the past (such as this) that have forced me to use the vlanXX convention as well, so it works fine if you like it better.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.