What's new

Tagged VLAN ping router but no internet

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

law1213

New Around Here
Hi -

Can anyone help me with this configuration. I have an L2 tagged VLAN (20) which can ping all it's peers and the router @ 10.1.1.1, it can even resolve DNS via the router but it cannot connect to the internet, I'm at a loss as to why.

All my devices connect through port 1 on the Asus N66U router, so I have 2 VLANs on port 1, tagged and untagged like so...

Code:
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.254   *               255.255.255.255 UH    0      0        0 eth0
192.168.1.0     *               255.255.255.0   U     0      0        0 eth0
10.1.1.0        *               255.255.255.0   U     0      0        0 br0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         btbusinesshub   0.0.0.0         UG    0      0        0 eth0
admin@RT-N66U:/tmp/home/root# robocfg show
Switch: enabled gigabit
Port 0: 1000FD enabled stp: none vlan: 2 jumbo: off mac: d0:57:94:ae:91:db
Port 1: 1000FD enabled stp: none vlan: 1 jumbo: off mac: d2:10:5f:a3:a5:fc
Port 2:  100FD enabled stp: none vlan: 1 jumbo: off mac: 00:17:9a:24:48:a1
Port 3:   DOWN enabled stp: none vlan: 1 jumbo: off mac: 00:00:00:00:00:00
Port 4:   DOWN enabled stp: none vlan: 1 jumbo: off mac: 00:00:00:00:00:00
Port 5:   DOWN enabled stp: none vlan: 1 jumbo: off mac: 00:00:00:00:00:00
Port 8: 1000FD enabled stp: none vlan: 2 jumbo: off mac: 74:d0:2b:5d:e8:40
VLANs: BCM53115 enabled mac_check mac_hash
   1: vlan1: 1 2 3 4 8t
   2: vlan2: 0 8u
  20: vlan20: 1t 8t

brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.74d02b5de840       yes             vlan1
                                                        eth1
                                                        eth2
                                                        wds0.1
                                                        vlan20

For the setup of VLAN 20 I followed the setup I've had working for guest traffic previous, the only difference being the guest traffic was on an entirely different port, unfortunately with current cabling setup I have all devices coming in on one ethernet cable to port 1.

Tagged VLAN20 traffic from the server on that VLAN is correctly differentiated from untagged traffic, it can ping the router and other devices on that VLAN, but doesn't seem to be able to ping anything internet wise, I thought 8t which is router CPU would allow this.

I don't understand why the router doesn't seem to forward internet traffic for VLAN 20, is this maybe some limitation of L2 tagging on the same subnet and port as the untagged traffic and how the WAN side works?

I should mention there are some switches involved between the server (VLAN20) and router, but given the server can ping the router these must be correctly forwarding tags (and I would expect so they are cisco switches)

Any ideas?
 
Last edited:
Guys -

For info, I solved this, it was nothing to do with the router, that configuration was correct, but rather a bridge the server is using that didn't have ipv4 forwarding enabled.

All working with this enabled.

Hi -

Can anyone help me with this configuration. I have an L2 tagged VLAN (20) which can ping all it's peers and the router @ 10.1.1.1, it can even resolve DNS via the router but it cannot connect to the internet, I'm at a loss as to why.

All my devices connect through port 1 on the Asus N66U router, so I have 2 VLANs on port 1, tagged and untagged like so...

Code:
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.254   *               255.255.255.255 UH    0      0        0 eth0
192.168.1.0     *               255.255.255.0   U     0      0        0 eth0
10.1.1.0        *               255.255.255.0   U     0      0        0 br0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         btbusinesshub   0.0.0.0         UG    0      0        0 eth0
admin@RT-N66U:/tmp/home/root# robocfg show
Switch: enabled gigabit
Port 0: 1000FD enabled stp: none vlan: 2 jumbo: off mac: d0:57:94:ae:91:db
Port 1: 1000FD enabled stp: none vlan: 1 jumbo: off mac: d2:10:5f:a3:a5:fc
Port 2:  100FD enabled stp: none vlan: 1 jumbo: off mac: 00:17:9a:24:48:a1
Port 3:   DOWN enabled stp: none vlan: 1 jumbo: off mac: 00:00:00:00:00:00
Port 4:   DOWN enabled stp: none vlan: 1 jumbo: off mac: 00:00:00:00:00:00
Port 5:   DOWN enabled stp: none vlan: 1 jumbo: off mac: 00:00:00:00:00:00
Port 8: 1000FD enabled stp: none vlan: 2 jumbo: off mac: 74:d0:2b:5d:e8:40
VLANs: BCM53115 enabled mac_check mac_hash
   1: vlan1: 1 2 3 4 8t
   2: vlan2: 0 8u
  20: vlan20: 1t 8t

brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.74d02b5de840       yes             vlan1
                                                        eth1
                                                        eth2
                                                        wds0.1
                                                        vlan20

For the setup of VLAN 20 I followed the setup I've had working for guest traffic previous, the only difference being the guest traffic was on an entirely different port, unfortunately with current cabling setup I have all devices coming in on one ethernet cable to port 1.

Tagged VLAN20 traffic from the server on that VLAN is correctly differentiated from untagged traffic, it can ping the router and other devices on that VLAN, but doesn't seem to be able to ping anything internet wise, I thought 8t which is router CPU would allow this.

I don't understand why the router doesn't seem to forward internet traffic for VLAN 20, is this maybe some limitation of L2 tagging on the same subnet and port as the untagged traffic and how the WAN side works?

I should mention there are some switches involved between the server (VLAN20) and router, but given the server can ping the router these must be correctly forwarding tags (and I would expect so they are cisco switches)

Any ideas?
 
I've noticed I'm experiencing some packet loss, does anyone know if it's possible to have port 1 in two vlans one tagged one untagged like my above configuration?

I'm losing traffic on the untagged vlan only :(
 
Last edited:
Guess I'll just answer all my own questions (hopefully it will help someone)...

Looks like I needed to add the following ebtable rules, maybe someone can enlighten me as to why. I'm still testing it atm but it seems to be working.

I think this says something along the lines of...
if it's from vlan20 and it isn't going to eth0 (WAN) then drop it
if it isn't from eth0 (WAN) and it's going to vlan20 drop it

Code:
ebtables -t filter -I FORWARD -i vlan20 -o ! eth0 -j DROP
ebtables -t filter -I FORWARD -i ! eth0 -o vlan20 -j DROP
 

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top