From owner-freebsd-current@freebsd.org Sun Jul 16 21:05:29 2017 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id D32E4C7A35F; Sun, 16 Jul 2017 21:05:29 +0000 (UTC) (envelope-from ohartmann@walstatt.org) Received: from mout.gmx.net (mout.gmx.net [212.227.17.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "mout.gmx.net", Issuer "TeleSec ServerPass DE-2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4C2E367378; Sun, 16 Jul 2017 21:05:28 +0000 (UTC) (envelope-from ohartmann@walstatt.org) Received: from thor.intern.walstatt.dynvpn.de ([77.180.117.19]) by mail.gmx.com (mrgmx103 [212.227.17.168]) with ESMTPSA (Nemesis) id 0Mhhr5-1dIjz93LL1-00MuvK; Sun, 16 Jul 2017 23:05:20 +0200 Date: Sun, 16 Jul 2017 23:05:14 +0200 From: "O. Hartmann" To: "Andrey V. Elsukov" Cc: FreeBSD CURRENT , "O. Hartmann" , FreeBSD Questions Subject: Re: Inter-VLAN routing on CURRENT: any known issues? Message-ID: <20170716230514.0c2e5c65@thor.intern.walstatt.dynvpn.de> In-Reply-To: References: <20170712214334.4fc97335@thor.intern.walstatt.dynvpn.de> <20170713211004.13492aef@thor.intern.walstatt.dynvpn.de> Organization: WALSTATT User-Agent: OutScare 3.1415926 X-Operating-System: ImNotAnOperatingSystem 3.141592527 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; boundary="Sig_/3qsbMR6CK7Fssjmpq_roxte"; protocol="application/pgp-signature" X-Provags-ID: V03:K0:csqe9xBwHYAzLXIMemUpylzIJAl/ZVbCSXYUYOUtOWYdwFMBKJv 07J69gne2YwwfAtQA4c7DFkzxNDbMUlrW6CgXoxdFXTC7O28UJ9XyxLiLFh/1OoIzfdQzhb v1g2r5/zdqPXNZTvkoMVrbI+Z4mb67OIein5O80ICigog4m56IjUiW2kFLiZdZhdeOa5aAB B9Mn4LRvVU99rtIGy13hg== X-UI-Out-Filterresults: notjunk:1;V01:K0:9mus4ySV6jE=:1hJ4c2v5dP247gknmJ8cup o+bO+vunKARdFRz/aU9/fCEDCKVHk9rN7K9+Nemp5RVsjuf4vIzu92gXT+qpDIU/+V7huwvMS 5pObROr1LAL2s00RxUbw3udeztkQw4LZPVnjIKW9/nwcqRZ7fUP+9qqVLyNpvfgjRoH4n2eH8 +pJyYMUxxgDfNk5u8ijXyxVMkFkhmXMZk9uVgBq1wKN9AQq8JwAWJ85fdSc8HTja4yHOYUa2h Wqjzy+YjmMDI3x3JtByn3nrdT7MyX9eP7T1jMQYzeTOv1BmpeUp9/y1O+2gKXZJqGiFOhxPvW 1dUPpdCcCzijtYH6sXxBwuKJE8jyhsi53nbGOlQvbn04UR/wpa0RvY49TErd4rCEgJ2tr7u8E IgHPqGlRVkW9oqRUeAERgZKRSZO3i8Ks6tw1AHC/aS3X9Mxcp4/MO4m2WmozEhyu9c2wsPfrk sKXuNz1fMKpJw9haGTbXZU4WtzrWa+fobqu82+xexIoEXk8R/sAKtKhn86J4+bPHIv9KkXr7U Iln7pxA8i/rcJpbiN/ZuA+PGfQjVIhdNnNsZhotRQrAYjiqCUqiBKa6ZU+stvtquil1qHuIwi xvmHRWJfunXK3DOpiOf4lENGlVyTiLEBLDVsHTq5/y0IODoDcYASRw1NaKZQFmqMPowr6C1Cb 0JHypG9fKRHuoHzWqZh00CZSSJSv91U6qaylXF8ZBXf+lQBI/0NFD8RW9qBSwHOWmWVZfcpYc 9O3Fh1RGYCIDXOjo12qwSwVo4bl82wEv72pgWEskZOVOMD9UmAe7+l4ydBEG/2ZnvaOfNuBBg 3Iayql+mGbB7iMdIx1tENJPh6n7ZA== X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Jul 2017 21:05:29 -0000 --Sig_/3qsbMR6CK7Fssjmpq_roxte Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Am Fri, 14 Jul 2017 15:00:30 +0300 "Andrey V. Elsukov" schrieb: > On 14.07.2017 14:42, O. Hartmann wrote: > > I use in-kernel NAT. IPFW is performing NAT. In firewall type "OPEN" fr= om the > > vanilla rc.conf, IPFW has instance "nat 123" which provides then NAT. = =20 >=20 > I never used default config types for firewall, so, it would be nice to > see what rules do you have. >=20 > # ipfw show > # ipfw nat show config >=20 > >> VLANs work on the layer2 =20 > > According to 1): > >=20 > > I consider the settings of the switch now as correct. I have no access = to the > > router right now. But I did short experiments yesterday evening and it = is > > weird: loged in on thr router, I can ping every host on any VLAN, so IC= MP > > travel from the router the right way to its destination and back. > >=20 > > From any host on any VLAN that is "trunked" through the router, I can p= ing any > > other host on any other VLAN, preferrably not on the same VLAN. By cutt= ing off > > the trunk line to the router, pinging stops immediately. > >=20 > > From any host on any VLAN I can ping any host which is NATed on the out= side > > world. > >=20 > > From the router itself, I can ssh into any host on any VLAN providing s= sh > > service. That said, according to question 3), NAT is considered to be s= etup > > correctly. > >=20 > > Now the strange things: Neither UDP, nor TCP services "flow" from hosts= on one > > VLAN to hosts on a different VLAN. Even ssh doens't work.=20 > > When loged in onto the router, I can't "traceroute" any host on any VLA= N. =20 >=20 > This is most likely due to the problem with firewall rules. > If you set net.inet.ip.firewall.enable=3D0, does it solve the problem with > TCP/UDP between hosts on a different VLANs? >=20 > > According to question 2), the ability to ping from, say, a host on VLAN= 1000 to > > another host on VLAN 2 passing through the router would indicate that b= oth > > sides know their routes to each other. Or am I wrong? =20 >=20 > Yes. >=20 > > I got words from Sean bruno that there might be a problem with the Inte= l i210 > > chipset in recent CURRENT - and the hardware on the PCEngine APU 2C4 is= three > > i210. I'm aware of the problem since r320134 (the oldest CURRENT I star= ted > > experimenting with the VLAN trunking). =20 >=20 > It is very strange problems, why ICMP works, but TCP/UDP does not? :) > You can try to disable any type of offloading for the card, there were > some problems in the past with checksum offlading, that may lead to the > problems with TCP, but this usually should be noticeable in the tcpdump > output. >=20 I have not have any success on this and I must ask now, to not make a fool = out of my self, whether the concept of having several vlan over one single NIC is pos= sible with FreeBSD (12-CURRENT, as of today, r321055. Since it is even not possible to "route" from a non-tagged igb1 to a tagged= vlan igb1.2 or igb1.66 (for instance) on the same NIC, I have a faint suspect that I'm = doing something terribly wrong. I think everyone working with vlan should have those problems, but since I = can not find anything on the list, I must do something wrong - my simple conclusion. What is it? --=20 O. Hartmann Ich widerspreche der Nutzung oder =C3=9Cbermittlung meiner Daten f=C3=BCr Werbezwecke oder f=C3=BCr die Markt- oder Meinungsforschung (=C2=A7 28 Abs.= 4 BDSG). --Sig_/3qsbMR6CK7Fssjmpq_roxte Content-Type: application/pgp-signature Content-Description: OpenPGP digital signature -----BEGIN PGP SIGNATURE----- iLUEARMKAB0WIQQZVZMzAtwC2T/86TrS528fyFhYlAUCWWvVCgAKCRDS528fyFhY lAl3Af0XWwi6ukI4Mjcqly58kMFC16v84uUwL1TO4j0Y3mSnpcqCnKwPymqioc4l VWlZHt48wol9w/xQsqjA6D0Xn9E7Af9s5YSNQBMb0VCVjr5ocbVx5uY2zyndzWh9 mc6J/gb41XR4sEF5/jm3DIWYnHoU8QTvdukbIpS2oJ8xPLn1VjwP =pHUN -----END PGP SIGNATURE----- --Sig_/3qsbMR6CK7Fssjmpq_roxte--