How do I fix my vlans connection to the Internet?

Question

I have the following abridged configuration for a Ubiquiti switch:

interfaces {
    ethernet eth1 {
        address 192.168.4.1/24
        vif 101 {
            address 10.10.254.1/24
        }
        vif 103 {
            address 10.1.1.1/24
        }
    }
}
protocols {
    static {
        route 10.1.1.0/24 {
            next-hop 192.168.4.254 {
            }
        }
        route 10.10.254.0/24 {
            next-hop 192.168.4.254 {
            }
        }
    }
}

where 192.168.4.254 is the Gateway and the vifs share the exact same firewall configuration with eth1.

Devices on eth1's network can see devices on vif101 when they are configured to talk to the gateway for the vifs subnets through the following route entries:

10.1.1/24          192.168.4.254      UGSc            1        2     en5
10.10.254/24       192.168.4.254      UGSc            0        0     en5

However, the switch cannot reach devices on either vif and devices on the vifs cannot reach the Internet despite being able to reach the gateway and devices on eth1 even with the static routing. Devices on eth1 are able to communicate with the Internet.

The routing table on the switch is:

S>* 0.0.0.0/0 [1/0] via --redacted--, eth0
S   10.1.1.0/24 [1/0] via 192.168.4.254
C>* 10.1.1.0/24 is directly connected, eth1.103
S   10.10.254.0/24 [1/0] via 192.168.4.254
C>* 10.10.254.0/24 is directly connected, eth1.101
C>* --redacted-- is directly connected, eth0
C>* 127.0.0.0/8 is directly connected, lo
C>* 192.168.4.0/24 is directly connected, eth1

The routing table on one of the devices on vif101 is:

  Destination           Gateway           Flags  Ref     Use     Interface 
-------------------- -------------------- ----- ----- ---------- --------- 
default              10.1.1.1             UG        4       1954 net0      
10.0.1.0             10.0.1.38            U         4        958 net1      
10.1.1.0             10.1.1.7             U         3          1 net0      
127.0.0.1            127.0.0.1            UH        2          0 lo0    

I don't have networking knowledge so I'm not sure if there's something obvious I'm missing. How do I get the vifs to communicate with the Internet?

Answer 1

I don't have much experience with ubiquiti switches but normally you wouldn't add static routes for networks that are directly connected interfaces. What I think you are looking for is a default route that will send all traffic to a router that is connected to the internet.

I tried looking for a configuration example but couldn't find one. Basically, you would create a static route for 0.0.0.0/0 and point that to 192.168.4.254. From the routing table you provided, it looks like the 0.0.0.0/0 route is being sent out eth1 and that may not be correct.

0.0.0.0/0 -> 192.168.4.254

The 192.168.4.254 device will then need static routes back to your switch with a configuration like this:

10.10.254.0/24 -> 192.168.4.1
10.1.1.0/24 ->192.168.4.1

Let me know if that works!

Josh

Answer 2

I am not able to understand any of the config, which commands are these?

I can tell you about vlans and routing them to the internet.

1. Create vlans.
2. Terminate the vlans. This can be a L3 switch where the vlan gateway is an virtual vlan interface on the switch itself or subinterfaces on a router.
3. The router between your vlans and the internet should have a static route back to each of your vlans. Because the router can't see of your vlans and doesn't know those networks and hence can't send back the reply packets to them.

Use this and this for better understanding.

Answer 3

Do you have routes in 192.168.4.254 that point back to the addresses in the switch?

You need to point 10.10.254.0/24 to 10.10.254.1 and 10.1.1.0/24 to 10.1.1.1 inside 192.168.4.254.

Answer 4

Please know that vif1 at 103 at 10.1.1.0 will not able to communicate, as you have conflicting routing statements:

S 10.1.1.0/24 [1/0] via 192.168.4.254

C>* 10.1.1.0/24 is directly connected, eth1.103

These statements, will cause the packet to never leave the router: Packet sourced from 10.1.1.50 (Random host) sends traffic across LAN, the traffic hits gateway at 10.1.1.1 (router) the router looks at the routing table, the static route to 192.168.4.254 has an AD of 1 (Very reliable), however the connected route on eth1.103 has an AD of 0 (Best, indicated by the "*"). By this reason the router will forward the traffic back through the eth1.103

Same with the 10.10.254.0 respectively to its network