Thanks to Chris B's encouragement, I have reworked my network to not
rely on the "Bypass firewall rules..." crutch.
Short answer, I moved my OpenVPN server to a new interface where it
is the only host on that interface. Since there are no other hosts
(other than the gateway) to access, there is no subnet-1 (OpenVPN
virtual subnet) to subnet-2 (interface subnet) access. All routes
include a pass through two DIFFERENT interfaces on the m0n0wall.
I used an HP Procurve 1800-8G switch with my net4801, to create a
VLAN trunk on the sis2 ethernet port. This is my first experience
with vlans... now I have four vlans isolating my asterisk/SIP phones,
wifi wireless, openvpn server, and switch management. Defining the
vlans on the Procurve was very straightforward with its web interface.
m0n0wall continues to impress me... truly a rock solid tool.
On Mar 11, 2007, at 2:30 PM, Lonnie Abelbeck wrote:
> So, are you saying that if I *have* to put multiple subnets on the
> LAN segment, I should expect the firewall rules anomalies I have
> encountered and simply check "Bypass firewall rules..." to short-
> circuit those anomalies?
> In my OpenVPN server application, I am not aware of any other way
> to configure things other than creating multiple subnets on a
> segment, ie. the OpenVPN server acting as a gateway to the virtual
> I appreciate the guidance.
> On Mar 11, 2007, at 11:00 AM, Chris Buechler wrote:
>> On 3/10/07, Lonnie Abelbeck <lists at lonnie dot abelbeck dot com> wrote:
>>> I am quite satisfied keeping "Bypass firewall rules..." checked, but
>>> I want to understand why m0n0wall is dropping LAN subnet1 to LAN
>>> subnet2 traffic in the firewall.
>> Because you're doing this:
>>> The question centers around having multiple subnets on a single
>> And have been told you shouldn't do this and there can be undesirable
>> consequences or other problems. Case in point - this, and potentially
>> other things as well.
>> To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch
>> For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch