I'm trying to get my network up and running with my new provider's vdsl router, which can't operate in "modem-mode" or "bridge-mode".
My setup so far is as follows:
I have two managed switches, both with several 192.168.x.0/24 vlans (vlanX is mapped to network 192.168.X.0/24). All these vlans are connected over a trunk port to my openbsd firewall (ip forwarding enabled). Each computer on the network has the address of the virtual nic on the firewall set as default gateway. For example, the network for vlan20 is 192.168.20.0/24, the firewall has the address 192.168.20.1 and this address is set as the default gateway for each client on this vlan. With this setup, I can ping between all clients on the same or different vlans/switches.
Here comes the problem: The VDSL-Router is connected to the firewall via another dedicated 192.168.x.0/24 vlan, say 192.168.100.0/24, with the firewall ip 192.168.100.2 and the vdsl-router ip 192.168.100.1. I've setup 192.168.100.2 as the default gateway on the firewall and can now sucessfully reach the internet from the firewall, but not from my other machines. Traceroute shows that the packets are stuck at the gateway of the client-vlan, for example, if I try to reach something outside from client 192.168.20.100, packets are stuck at the client gateway 192.168.20.1.
I have disabled all firewall rules (for testing purposes) and also tried enabling nat on the firewall for the vdsl-vlan (the vdsl-router of course does its own nat on the internet port as well). Am I missing something obvious?
The vdsl-router is connected to an "access" port of the switch and thus not aware of the vlan. Also, due to physical restrictions, I can't remove one of the switches in between.
Thanks for your help!