2

A network topology question.

I have a router running OpenWrt, with several VLANs (all working correctly) with 192.168.X.2 addresses, with X being a subnet corresponding to each VLAN. There is one DHCP server for each range, on the same machine.

On the other hand, I have a firewall, which is currently an OpenWrt, but it could be another one (OPNsense, pfSense...) with 192.168.X.1 addresses, and with a WAN interface (i.e, 11.22.33.44) which connects to the internet by PPPoE, also working fine.

Something like this:

                       ---------
                       |  ISP  |
                       ---------                                 
                           |       11.22.33.44 (PPPoe,WAN)       
                     ------------- 192.168.10.1                  
                     | FIREWALL  | 192.168.11.1                  
                     ------------  192.168.12.1                  
                           |                                     
                    --------------  192.168.10.2                  
                    |   ROUTER   |  192.168.11.2                  
                    --------------  192.168.12.2                  
                     |    |    |                                  
                     /    |    \                                  
              _______|    |     |_______                          
             |            |             |                         
         VLAN 10        VLAN 11       VLAN 12                      
   192.168.10.0/24  192.168.11.0/24  192.168.12.0/24

I want the router to manage the inter-VLAN pass-through, and the firewall to take care of the internet connection, port forwards between WAN and LAN and, eventually, the packet filtering. If I set the firewall as the gateway (192.168.X.1) in the client configuration, they have access to the internet, but there is no packet passing between VLANs. If I set the router as the gateway (192.168.X.2), it does pass through between VLANs, but there is no internet connection.

I have tried setting static routes on the router so that the packets follow through to the firewall, but I have not been able to get it to work. I've also tried routing tables and rules, as shown here and here for example, but they don't work either.

I've come to think that what I'm trying isn't possible, since the move from 192.168.X.2 to 192.168.X.1 is not done between networks, but is a hop within the same network, but I know of first-hand cases where packets are passed from one machine to another in this way.

What am I doing wrong? Should I have to define a new subnet, 192.168.1.0/24, for example between the router and the firewall to ensure correct routing?

Thanks in advance

Improve this question

1 Answer 1

Reset to default
3

Subnets don't extend beyond router ports. Simply use a transfer subnet between firewall/WAN router and your internal router. The firewall isn't involved with any other private subnet.

Example:

  • set up 192.168.255.0/31 on the firewall's downlink port

  • set up 192.168.255.1/31 on the router's uplink

  • point the router's default route to 192.168.255.0

  • add a static route on the firewall for 192.168.0.0/16 via 192.168.255.1

  • for internal LAN hosts, point their default gateway to the router interface in their respective VLAN

                    ---------
                |  ISP  |
                ---------                                 
                    |       
              ------------- 10.22.33.44 (PPPoe,WAN)       
              | FIREWALL  | 
              ------------  192.168.255.0/31
                    |                                     
             -------------- 192.168.255.1/31                  
             |   ROUTER   |                   
192.168.10.1 ----.11.1----- 192.168.12.1                 
              |    |    |                                  
              /    |    \                                  
       ______|     |     |_______                          
      |            |             |                         
  VLAN 10        VLAN 11       VLAN 12                      
192.168.10.0/24 192.168.11.0/24  192.168.12.0/24
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.