[SOLVED] more lan (on vlan interface): how to isolate each lan?

cybermod

Hi all!
I have a little problem.
My scenario:
1-wan -1 phisical interface, more (around 20) logical interface on vlan.

phisical lan named em1, then each logical interface with vlan is on em1
-vlan1 on em2
-vlan2 on em2
-vlan3 on em2 etc etc

I need to isolate each logical lan, so, if i ping vlan2 interface from vlan1, i MUST NOT get reply….

This rule make me crazy!!

Suggestions?

Regards

ConfusedUser

Hello,

I'm using the same scenario on a test system which is working as expected and honestly… I don't understand why it is not working for you.
Create a VLAN, assign it to an interface, configure the interface with the IP and subnet mask and set up the rules you need. On my system it doesn't make a difference if I use physical or virtual LANs - they behave in the exact same way.

One thing which I saw below: Be careful when you use VLAN 1. Switches seem to treat it differently as some of them seem to treat it as untagged. I rather not use VLAN 1 on my setups.
Another possible incompatibility could be the NICs you use. I use Intel/PRO Gigabit PCIe NICs and they work perfect with tagged VLANs.

Mike

cybermod

hi confuseduser, sorry but my english is poor, so i ask you: can you use a simple english? :-[

i have not problem with vlan, my clients behind vlan run (internet for example).

i try to clarify my scenario.

Phisical Lan name: em1
logical Lan name: vlan1_customer1 ip 192.168.1.1
logical Lan name: vlan2_customer2 ip 192.168.2.1
logical Lan name: vlan3_customer3 ip 192.168.3.1

(each logical lan is assigned on phisical interface lan named em1

Ok?

Well, now we have one client behind vlan1, one client behind vlan2 and one behind vlan3.

i want that the client behind vlan1 cannot ping or make a ipscan the vlan2. Now, if i ping the ip address of clients behind vlan2 or vlan3, they reply me.

Simply: i want to isolate each vlan (network in my case).

How i make this? that is the right rule?

regards

georgeman

This is probably happening because you have an ALLOW ALL rule on the VLANs.

For easy management, you can create an alias with all the VLAN's subnets, and then create a QUICK floating rule, type BLOCK, applied to all VLANs, with direction: IN, destination: "alias you created".

Another way would be to modify each of the "allow all" rules on each VLAN by setting: destination NOT: "alias you created"

cybermod

great georgeman, your have centered my problem, and solved it

I LOVE YOU!

TheEnergy

Thanks man… that really helped me alot. But i have an extended question here. I have alot of vlans running.

I have 2 companys running on 2 different vlans

VLAN65
VLAN70

Now i have blocked all vlans to access eachother. How is the easy way to make VLAN65 and VLAN 70 to talk to eachother without anyone else will be able to reach these networks?

cybermod

i try:

a rule for vlan64 and another rule for vlan70.

the rule, simply, grant traffic.

So, for vlan65: tipe PASS source vlan65 destination vlan70

the same, in rule for vlan70 but with source and destination inverted.