0

I would like to forward internet traffic on a specific port to VLAN30 on our network for our security cameras. I have a Cisco RV134W VDSL gateway connected to a D-LINK DGS-1210-28 switch.

The port on my switch is set to Untagged 30 and the port on the RV134W is set to Tagged 1 (Default VLAN). I would assume that the port forwarding rule would forward the packet with the local IP address and VLAN1 after which the access port on the switch would re-tag it VLAN30. What am I doing wrong?

1
  • In the end this problem was an incorrect gateway configured on the security hardware located internally on my VLAN30. To help anyone in this situation, configuring a gateway to forward ports to IP addresses internally will automatically forward packets to the correct VLAN based on the routing table, at least they did on my Cisco RV134W. – Ben Druitt May 28 at 7:41
0

You don't port forward aka DNAT to a VLAN but to a private IP address. The VLAN subinterface for that is chosen from the routing table.

If you configure VLANs differently on both sides of a link they won't work and there's no connectivity. You need to configure them in the exact same way. If your WAN gateway tags a frame with a VLAN that your switch doesn't know, the frame is just dropped.

Also, you should never use port forwarding to expose a device to the hostile Internet that has not been explicitly hardened for that purpose (by the vendor and by your configuration). You might want to look at a VPN approach.

2
  • Thank you @Zac67. To be clear I am port forwarding to a private IP address which exists on VLAN30. Are you telling me that the default behaviour of my gateway should be for such a packet to be tagged with VID 30? That's what I'd expect, also, but it doesn't seem to work. My ports are all allowing tagged VLAN 30 packets. – Ben Druitt May 26 at 12:43
  • You require some kind of connectivity between the NAT router and the private IP address it forwards to. That can be via an intermediate gateway or direct on a shared subnet. If it is direct, the shared subnet needs to work on the data link layer. So yes, if the switch tags VLAN 30, so must the router. It's not a default behavior, all VLAN interfaces require explicit configuration. – Zac67 May 26 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.