> WÅ‚odzimierz FrÄ…czek wrote:
>>> WÅ‚odzimierz FrÄ…czek wrote:
>>>> I try to use m0n0nowall ver.1.21 but have troubles on begining.
>>>> My first m0n0 NIC ( LAN ) - 192.168.0.20
>>>> I create VLAN ( parent interface - LAN ) and give address 10.0.0.20 (
>>>> OPT1 )
>>>> Next I link my PC ( my address 192.168.0.100 ) to LAN
>>>> I can ping of course to LAN and after adding a trace to the routing
>>>> table in my Windows to OPT1 too.
>>>> But if I change my PC adress to 10.0.0.100 for example I can't ping
>>>> nowhere ( OPT1, LAN )
>>>> Please explain me why ?
>>> Basic reason is that your PC has not been configured to understand/work
>>> with 802.1q (VLANS).
>>> Your m0n0wall's VLAN interface, listening on 10.0.0.20, will only
>>> respond to packets that are tagged with 802.1q information for the VLAN
>>> you have configured. Your computer is sending NON-802.1q tagged ethernet
>>> frames, and as such your m0n0wall is seeing them on its LAN interface,
>>> and is probably dropping them, or just allowing them to pass (default
>>> m0n0wall LAN rule is to allow all)
>> As I wrote I can ping to VLAN interface ( OPT1 ) under some circumstaces
>> 1. My PC adress : 192.168.0.100
>> 2. My route table entry :
>> route add 10.0.0.0 mask 255.255.255.0 192.168.0.20
>> I understand that in this case my PC send packet without 802.1q frame
>> and neverthless VLAN interface answer me.
> That is correct - Since your PC is connected to m0n0wall's LAN interface
> and is on the same subnet as m0n0wall's LAN IP address is, m0n0wall's
> DEFAULT LAN rule "Allow any to any" allows your ICMP request into its
> LAN interface and then forwards it to its IP address of its VLAN
> interface on the 10.0.0.0/24 network.
> In other words, m0n0wall is allowing and then forwarding your ICMP
> requests. That is why it works.
>> By the way, if I change one of my NIC card ( INTEL PRO/100 VE )
>> property ( QoS packet tagging ) I still have the same problem.
> In this case I am guessing that you probably have not created any rules
> on the VLAN interface. So even if your PC is now properly tagging
> packets for the correct VLAN that your m0n0wall has configured, no rule
> has been added to allow that packet to pass and they will be dropped.
> Click on RULES, then select the VLAN tab and add a rule to allow traffic
> from the VLAN subnet.
According to instruction I added one rule to OPT1 interface but nothing
I expand my system by adding 802.1q compatible switch, create VLAN ( for
example ID 10 ) mark 1-st port as tagged and 2-nd as untagged.
Next I connect my PC to 2-nd port and m0n0 LAN to 1-st port.
And now I can't ping both neither to LAN neither to VLAN.
I think that now I less understand that system.
Tell me please - in that new configuration - should I see from my PC both
LAN and VLAN subnets ?
Maybe have I wrong NIC in my m0n0 ( detected as xl - 3com 905b ) ?