VLANS + ROUTER

[Piotr Kirklewski]

Hi Guys
I have 3 Vlans configured already at my 3COM switch:
VLAN1 - 192.168.1.x
VALN2 - 192.168.168.x
VLAN3 - 10.0.0.x

I have single DSL modem:
DSL - 192.168.70.1

Now I need to build a router/firewall with Linux box.
The router should make all Vlan's be able to see the internet and AD Windows Server (192.168.70.4).
The client's machines are PC with Windows XP.
I don't know much about vlaning on Linux - could you please provide some ideas on how to sort it out ?
Some Linux commands I have to run on the box in order to route the traffic to the internet and Windows Server?

The network looks somewhat like this:

[INTERNET]
|
[DSL]
|
[ROUTER/FIREWALL]
|
[SWITCH]
|
[VLAN1] [VLAN2] [VLAN3]

[Pieter 't Hart]

I don't know the linux commands, but i can describe the steps to take

First you need to configure the system to communicate to all vlans.
So if you have only one physical interface, you need to create subinterfaces for each vlan. Give each subinterface an ip-adress in its own vlan.
http://www.cyberciti.biz/tips/howto-configure-linux-virtual-local-area-network-vlan.html
And configure the switch to forward packets from all vlan's to the linux box.
If you have multiple NIC's configure each with an ip-adress in its own vlan. and connect it to a switchport in the respective vlan.

Maybe you need to configure a DHCP server for each sbnet ?
http://www.yolinux.com/TUTORIALS/DHCP-Server.html

Then you can configure the firewall to forward packets from each subnet to the internet. How to do this will depend on the firewall package used.
http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch14_:_Linux_Firewalls_Using_iptables

[Piotr Kirklewski]

Thank you.
What I don't get is - how come the VLAN's will talk to the gateway when the gateway is of different IP range.
Can yo uexplain that ?
Regards
Peter

[Pieter 't Hart]

Hi Peter,
vlans don't communicate with a gateway.
nodes with interfaces in a vlan communicate with other interfaces in the same vlan.
(layer-2 of the layered netwok design)
an interface with an ip-adress communicates with other adresses in the same subnet.
(layer-3 of the layered netwok design).

so you need something in the communication between the router/firewall and the switch for the switch to determine what vlan to send to.
this is done with a special field in the network-packet : a vlan-tag.
by creating subinterfaces on the router, it will use this vlan-tag in its packets to the switch.
The switch must be configured to accept these packets, recognize the vlan-tag and forward to the right vlan (and back offcourse). This is done by configuring this port as a vlan-trunk. so it will send all packets with vlan-tag to the router.
Now only level-2 is done.

Second the interface on the router must be configured with an ip-adress in the right subnet for the vlan. so it can communicate with use of the tcp/ip protocol to other hosts.

Third offcourse the router must route between these subnets (connect the subnets on layer-3).

And fourth the router/firewall must selectively send packets to and from the DLS using another interface with a correct ip-adress for that subnet (192.168.70.x).

this is networking in a nutshell
hope this clarifies?

Pieter

[Piotr Kirklewski]

Ok
So how do I configure my network cards ?
Can you give an example?
Regards
Peter

[Pieter 't Hart]

have you read the article in my previous post ?
http://www.cyberciti.biz/tips/howto-configure-linux-virtual-local-area-network-vlan.html