Thanks to Chris B's encouragement, I have reworked my network to not  
rely on the "Bypass firewall rules..." crutch.

Short answer, I moved my OpenVPN server to a new interface where it  
is the only host on that interface.  Since there are no other hosts  
(other than the gateway) to access, there is no subnet-1 (OpenVPN  
virtual subnet) to subnet-2 (interface subnet) access.  All routes  
include a pass through two DIFFERENT interfaces on the m0n0wall.

I used an HP Procurve 1800-8G switch with my net4801, to create a  
VLAN trunk on the sis2 ethernet port.  This is my first experience  
with vlans... now I have four vlans isolating my asterisk/SIP phones,  
wifi wireless, openvpn server, and switch management.  Defining the  
vlans on the Procurve was very straightforward with its web interface.

m0n0wall continues to impress me... truly a rock solid tool.

Lonnie

On Mar 11, 2007, at 2:30 PM, Lonnie Abelbeck wrote:

> Chris,
>
> So, are you saying that if I *have* to put multiple subnets on the  
> LAN segment, I should expect the firewall rules anomalies I have  
> encountered and simply check "Bypass firewall rules..." to short- 
> circuit those anomalies?
>
> In my OpenVPN server application, I am not aware of any other way  
> to configure things other than creating multiple subnets on a  
> segment, ie. the OpenVPN server acting as a gateway to the virtual  
> subnet.
>
> I appreciate the guidance.
>
> Lonnie
>
> On Mar 11, 2007, at 11:00 AM, Chris Buechler wrote:
>
>> On 3/10/07, Lonnie Abelbeck <lists at lonnie dot abelbeck dot com> wrote:
>>>
>>> I am quite satisfied keeping "Bypass firewall rules..." checked, but
>>> I want to understand why m0n0wall is dropping LAN subnet1 to LAN
>>> subnet2 traffic in the firewall.
>>>
>>
>> Because you're doing this:
>>
>>> The question centers around having multiple subnets on a single
>>> interface.
>>
>> And have been told you shouldn't do this and there can be undesirable
>> consequences or other problems. Case in point - this, and potentially
>> other things as well.
>>
>> -Chris
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch
>> For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch
>>
>>
>