Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have home network with VLANs, one for LAN, one for WLAN and one for internet. I'd like to use bridging so that instead of configuring these same VLANs to every machine, they had own VLAN ID and bridges were LAN, WLAN and internet.

I've tried it but for some reason keep-alive/ttl seems to get broken because SSH sessions etc suddenly disconnects.

We have this same setup working in workplace for 4+ years with 100+ customers but it's custom firewall/router hardware so accessing it is impossible. I know that it runs Linux.

So what is Debian/Ubuntu default network settings doing wrong or is it just NIC driver/hw problem? I've tried to mess araund with ttl etc settings without any luck. The bad stuff is happening in the bridge because current VLAN-only setup works fine.

interfaces:

 auto lo
 iface lo inet loopback

 # The primary network interface
 allow-hotplug eth0
 allow-hotplug eth1

 iface eth0 inet static
 iface eth1 inet static

 auto vlan111
 auto vlan222
 auto vlan333
 auto vlan444
 auto br0
 auto br1
 auto br2

 # LAN
 iface vlan111 inet static
         vlan_raw_device eth0

 # WLAN
 iface vlan222 inet static
         vlan_raw_device eth0

 # ADSL Modem
 iface vlan333 inet static
         vlan_raw_device eth1

 # Internet
 iface vlan444 inet static
         vlan_raw_device eth0

 # LAN bridge
 iface br0 inet static
         address 192.168.0.1
         netmask 255.255.255.0
         bridge_ports eth0.111
         bridge_stp on

 # Internet bridge
 iface br1 inet static
         address x.x.x.x
         netmask x.x.x.x
         gateway x.x.x.x
         bridge_ports eth1.333 eth0.444
         bridge_stp on
         post-up iptables -t nat -A POSTROUTING -o br1 -j MASQUERADE
         pre-down iptables -t nat -D POSTROUTING -o br1 -j MASQUERADE

 # WLAN bridge
 iface br2 inet static
         address 192.168.1.1
         netmask 255.255.255.0
         bridge_ports eth0.222
         bridge_stp on

Sysctl:

net.ipv4.conf.default.forwarding=1
share|improve this question
    
Can you post a copy of your /etc/network/interfaces? Also, if you are going to bridge all the vlans together what is the point of the vlans? –  Zoredache May 19 '09 at 14:51
    
All VLANs are connected to different bridges. For example LAN(vlan11,vlan22), WLAN(vlan123) internet(vlan678,vlan987) –  raspi May 19 '09 at 15:03
2  
Wait what? A bridge is not a router. To get routable traffic like ssh to flow between different VLANs you need to route it. Bridging VLANs are only for non-routable traffic, like tagged VLAN frames destined to some other device which will untag it... but I might be misunderstanding the question. –  Oskar Duveborn May 19 '09 at 16:20
add comment

5 Answers

We use the following method for vlans:

auto eth0.6
        iface eth0.6 inet static
        address 192.168.6.13
        netmask 255.255.255.0
        broadcast 192.168.6.255
        pre-up vconfig add eth0 6
        post-down vconfig rem eth0.6

The case of a vlan on a bridged interface isn't much different:

auto br0
iface br0 inet static
        address 192.168.0.11
        netmask 255.255.255.0
        broadcast 192.168.0.255
        bridge_stp on
        bridge_ports eth0 eth1
        bridge_bridgeprio 60000

auto br0.6
iface br0.6 inet static
        address 192.168.6.11
        netmask 255.255.255.0
        broadcast 192.168.6.255
        gateway 192.168.6.1
        pre-up vconfig add br0 6
        post-down vconfig rem br0.6

However, looking at your setup, you appear to be attempting to bridge between two different vlans on different interfaces. I really think you mean to be routing between your networks.

Does your switch understand VLANs? You probably want to set your switch to have the correct ports set to untagged on the right VLAN for the machine connected to that port.

share|improve this answer
add comment

I don't think bridging VLANs is a good idea. VLANS basically break up a switch (or multiple switches) in multiple virtual segments. By bridging two VLANs you join their broken up broadcast domains back together, effectively making them belong to the same segment again. So, then why use VLANs in the first place?

As many people suggested, you need routing between the different subnets in your VLANs

share|improve this answer
add comment

You're combining syntax in that file.

My first suggestion is to ensure you've got ifupdown-scripts-zg2 installed to get proper vlan support, then switch to the saner ethX.VLAN naming, and remember to add the auto ethX.VLAN lines so they start on boot.

share|improve this answer
add comment

Is it an option to just plug a third network card in and have 3 different interfaces doing routing/masquerading?

Unless your ISP is giving you a tagged vlan connection at home I doubt there is much purpose in making it a VLAN.

Otherwise, can you show your routing table? To get traffic to pass between the two you'll need routes for each VLAN.

share|improve this answer
    
The point is not the internet bridge but those other bridges. It's more of "It works in workplace but why not in my home network with same software and switches etc". –  raspi May 19 '09 at 16:13
    
Right, and to do that you'll need to route the vlans between interfaces. I guess in my head its much simpler just to plug in another NIC if thats an option. Then again I don't have any NICs at home that support VLAN tagging. If you're tagged on the switch and the NIC accepts the tagged packets you'll need a routing protocol or static routes to pass traffic between the two. –  sparks May 27 '09 at 13:14
add comment

The "SSH disconnects after a time" issue sounds like my old enemy, rp_filter.

http://www.tolaris.com/2009/07/13/disabling-reverse-path-filtering-in-complex-networks/

Try this:

net.ipv4.conf.lo.rp_filter = 0 net.ipv4.conf.all.rp_filter = 0 net.ipv4.conf.default.rp_filter = 0

Set the same manually for any interface that still has 1 set.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.