0

I have the following problem: I have one interface eth0 with IP 172.20.51.61/24

I have configured 2 VLANS on the same machine:

eth0.120 : 172.20.52.61/24 
eth0.200 : 172.20.54.61/24

I also have a DELL switch which has

trunk port 2 and 
access ports 6 VLAN 120 and 
access port 10 VLAN 200.

There is a DHCP server on this machine, so when I connect two Laptops on two VLANS I get respective IP addresses:

PC1 172.20.54.234
PC2 172.20.52.114

The problem is I am not able to ping from one PC1 to PC2.

So how to enable ping from PC1 ot PC2 in different subnets.

My iptable rules are as follows:

Chain INPUT (policy ACCEPT 81 packets, 5386 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  178 19945 delegate_input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 delegate_forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  626  211K delegate_output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain delegate_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 forwarding_rule  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* user chain for forwarding */
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 zone_lan_forward  all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           
    0     0 zone_wan_forward  all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain delegate_input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   23  2206 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
  155 17739 input_rule  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* user chain for input */
   74 12353 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    3   180 syn_flood  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x17/0x02
    0     0 zone_lan_input  all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           
    0     0 zone_wan_input  all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           

Chain delegate_output (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   23  2206 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
  603  209K output_rule  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* user chain for output */
  601  208K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    2   264 zone_lan_output  all  --  *      eth0    0.0.0.0/0            0.0.0.0/0           
    0     0 zone_wan_output  all  --  *      eth1    0.0.0.0/0            0.0.0.0/0           

Chain syn_flood (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    3   180 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x17/0x02 limit: avg 25/sec burst 50
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain zone_lan_dest_ACCEPT (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    2   264 ACCEPT     all  --  *      eth0    0.0.0.0/0            0.0.0.0/0           

Chain zone_lan_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 forwarding_lan_rule  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* user chain for forwarding */
    0     0 zone_wan_dest_ACCEPT  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* forwarding lan -> wan */
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT /* Accept port forwards */
    0     0 zone_lan_dest_ACCEPT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain zone_lan_input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 input_lan_rule  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* user chain for input */
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT /* Accept port redirections */
    0     0 zone_lan_src_ACCEPT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain zone_lan_output (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    2   264 output_lan_rule  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* user chain for output */
    2   264 zone_lan_dest_ACCEPT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain zone_lan_src_ACCEPT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           

Chain zone_wan_dest_ACCEPT (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      eth1    0.0.0.0/0            0.0.0.0/0           

Chain zone_wan_dest_REJECT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 reject     all  --  *      eth1    0.0.0.0/0            0.0.0.0/0           

Chain zone_wan_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 forwarding_wan_rule  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* user chain for forwarding */
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT /* Accept port forwards */
    0     0 zone_wan_dest_REJECT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain zone_wan_input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 input_wan_rule  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* user chain for input */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:68 /* Allow-DHCP-Renew */
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 /* Allow-Ping */
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT /* Accept port redirections */
    0     0 zone_wan_src_REJECT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain zone_wan_output (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 output_wan_rule  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* user chain for output */
    0     0 zone_wan_dest_ACCEPT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain zone_wan_src_REJECT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 reject     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           
1

You need to add IP routing for the other networks in the laptops.

This is easiest if the 172.20.51.61 machine is also the default router in your network.

In this case, you need the following things:

  1. Ensure that IP routing is enabled in the router machine.
  2. Add firewall rules so that traffic between the two VLAN networks is allowed.
  3. Ensure that the two client machines have this router as the default gateway (the IP of the interface in client machine's network).

The router seems to have some kind of firewall management software installed, you should inspect that configuration instead of direct IPTables manipulation.

  • The 172.20.51.61 is a device between the two Laptops... Eth0 from this device is connected to trunk of Switch. The two Access ports of the switch (on different VLANs) are connected to respective laptops. – RootPhoenix Jul 16 '15 at 13:11
  • I added the following rules to allow traffic between two VLANs. iptables -t nat -A POSTROUTING -o eth0.120 -j MASQUERADE; ;; iptables -I FORWARD -i eth0.120 -o eth0.200 -j ACCEPT – RootPhoenix Jul 17 '15 at 5:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.