0

I would like to forward internet traffic on a specific port to VLAN30 on our network for our security cameras. I have a Cisco RV134W VDSL gateway connected to a D-LINK DGS-1210-28 switch.

The port on my switch is set to Untagged 30 and the port on the RV134W is set to Tagged 1 (Default VLAN). I would assume that the port forwarding rule would forward the packet with the local IP address and VLAN1 after which the access port on the switch would re-tag it VLAN30. What am I doing wrong?

Improve this question
3
  • In the end this problem was an incorrect gateway configured on the security hardware located internally on my VLAN30. To help anyone in this situation, configuring a gateway to forward ports to IP addresses internally will automatically forward packets to the correct VLAN based on the routing table, at least they did on my Cisco RV134W.
    – Ben Druitt
    May 28, 2021 at 7:41
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Nov 19, 2022 at 23:24
  • @BenDruitt Has any answer solved your question? Then please accept it or your question will keep popping up here forever. Please also consider voting for useful answers.
    – Zac67 ♦
    Jul 15 at 15:01

1 Answer 1

Reset to default
0

You don't port forward aka DNAT to a VLAN but to a private IP address. The path to that IP and the (VLAN sub)interface for that is chosen from the routing table.

If you want the forwarded packet to use VLAN 30 then the router needs to use a subinterface tagging for VLAN 30 for egress, connecting to a trunk port on the switch. Alternatively, you can use an untagged interface on the router and a dedicated access port on the switch configured for VLAN 30 untagged.

If you configure VLANs differently on both sides of a link they won't work and there's no connectivity. You need to configure them in the exact same way. If your WAN gateway tags a frame with a VLAN that your switch doesn't know, the frame is just dropped.

Also, you should never use port forwarding to expose a device to the hostile Internet that has not been explicitly hardened for that purpose (by the vendor and by your configuration). You might want to look at a VPN approach.

Improve this answer
2
  • Thank you @Zac67. To be clear I am port forwarding to a private IP address which exists on VLAN30. Are you telling me that the default behaviour of my gateway should be for such a packet to be tagged with VID 30? That's what I'd expect, also, but it doesn't seem to work. My ports are all allowing tagged VLAN 30 packets.
    – Ben Druitt
    May 26, 2021 at 12:43
  • You require some kind of connectivity between the NAT router and the private IP address it forwards to. That can be via an intermediate gateway or direct on a shared subnet. If it is direct, the shared subnet needs to work on the data link layer. So yes, if the switch tags VLAN 30, so must the router. It's not a default behavior, all VLAN interfaces require explicit configuration.
    – Zac67 ♦
    May 26, 2021 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.