0

Here is the setup:

ISP -> WRT -> Switch: Box 1,2,3...

I need to let box 3 out on then internet and I need to forward a port or two to box 3.

I found some information on setting up a vlan by port, but I need (guessing) is a vlan by MAC. There is no way to physically go from box 3 to the WRT or I would have done that already.

Any input would be appreciated.

Specs: ASUS WL-520GL running DD-WRT v24-sp1 (07/27/08) vpn

1
  • D’oh it doesn’t sound like this is possible with the current setup. The switch is of the dumb variety.
    – NitroxDM
    Sep 23, 2009 at 16:03

4 Answers 4

1

From your comments to the other answers, it seems that what you want to set up is a DMZ. The only way to control and isolate Box3 would be via firewall rules, forcing the connections to go through the WRT and handling the filtering there. As long as they are connected through a dumb switch, Box3 would be able to communicate with Box1 and Box2 directly.

1
  • 1
    D'oh! The switch is dumb.
    – NitroxDM
    Sep 23, 2009 at 16:05
1

If you do not need to let boxes 1 and 2 to the Internet, then set 2 IPs on box 3 on a different (sub)nets, and use one of the subnets for internal traffic, and the other one only for WRT and box3.

I.e. WRT (internal IP) - 192.168.0.1

Box 3 - 2 IPs on the same interface - 192.168.0.3 and 192.168.1.3

Box 2 - 192.168.1.2

Box 1 - 192.168.1.1

If you need Box2 and Box1 to have access to internet, set some routing (NATing) on Box3, and make it default gateway for 1 and 2.

As you not say what OS you have on these boxes:

  1. Windows - you can use internet connection sharing to set Box3 to share it's connection to the WRT.

  2. *nix - set a proper routing rules with iptables to NAT all requests from 192.168.1.x network trough 192.168.0.1

3
  • That would work but all the boxes need to access the internet.
    – NitroxDM
    Sep 22, 2009 at 21:36
  • edited the answer.
    – Sunny
    Sep 23, 2009 at 21:11
  • Wouldn't box 3 still be able to access 1 and 2 because of the 192.168.1.x address?
    – NitroxDM
    Sep 24, 2009 at 14:35
0

I don't think you'll need to mess with vlans...

  1. Give box3 a statically mapped IP in the wrt's dhcp server
  2. Forward the ports to that IP
  3. You're done!

All 3 boxes can access the Internet. Box1 and box2 get a random IP. Box3 always gets the same IP and has some external ports forwarded to it.


Update:

If you really need to use vlans, you need to set up a vlan trunk between the wrt and the switch. This means that every packet between the devices will have a vlan tag associated with it. Your switch has to support this (ie: be a "Layer 2 managed switch"). On your switch, you can then define which of the other ports are on which vlan. Box3's port will be on its own vlan.

There is no such thing as a vlan by MAC, because vlans partition at layer 2 to create multiple layer 2 broadcast domains.

3
  • Until box3 gets a virus or someone runs a network scanner. Security by obscurity isn't going to cut it on this one. Box3 needs to be isolated from the rest of the network.
    – NitroxDM
    Sep 22, 2009 at 23:33
  • Either I've misunderstood your question or you've misunderstood my answer. Are you saying Box3 needs to be isolated from Box1 and Box2? Where exactly is your logical security perimeter on this network?
    – lukecyca
    Sep 23, 2009 at 0:37
  • Your saying I should give box3 an IP like 192.168.1.10 and have a DHCP range of 50 starting at 192.168.1.100. Right or did I completely miss the ball on that one? What do you mean by logical security perimeter? (Sorry it that is a silly question, I’m not a networking guy… yet. )
    – NitroxDM
    Sep 23, 2009 at 15:59
0

You can't. Not with a dumb switch in the way.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .