[ampapa]

Hardware - Nighthawk R7000
Firmware: DD-WRT v3.0-r28000M kongac (10/24/15)

I'm having a problem connecting to machines that are on my 192.168.2.0 VLAN that I created. I believe the VLAN is setup correctly as I am able to ping the ip address of 192.168.2.1 from 192.168.3.100.

However, I can't ping any other machine on the VLAN subnet for example 192.168.2.11 from 192.168.3.100.

I was following this guide (http://www.flashrouters.com/blog/2015/04/06/what-is-a-vlan-how-to-setup-vlan-ddwrt/) and I haven;t put in any firewall rules as of yet but the VLAN seems to already be unreachable to some extent.

What am I missing here????

My ultimate goal is that I don't want the VLAN 192.168.2.0 subnet to be able to see anything on my 192.168.3.0 subnet but I do want my 192.168.3.0 subnet to be able to reach any machine on the 192.168.2.0 subnet. I want to run my webserver on the 192.168.2.0 subnet as well as a media server for the 192.168.3.0 subnet.

192.168.3.0 > 192.168.2.0 GOOD
192.168.2.0 > 192.168.3.0 BAD

Let me know if this isn't clear and I'll try to explain better.

Any help is appreciated.

p.s. can anyone tell me what this iptables entry is attempting to do?

iptables -I INPUT -p udp --sport 67 --dport 68 -j ACCEPT

[ampapa]

Would an entry like this in iptables allow all trffic from the 192.168.3.0 subnet to 192.168.2.0?

iptables --append INPUT --protocol tcp --src 192.168.3.0 --dst 192.168.2.11 --jump ACCEPT

[EDIT]

or something similar to the following?

iptables -I FORWARD -i vlan1 -d 192.168.2.0 -j ACCEPT
iptables -I FORWARD -o vlan1 -s 192.168.2.0 -j ACCEPT

or

iptables -I INPUT -i vlan3 -j ACCEPT
iptables -I FORWARD -s 192.168.3.0/24 -d 192.168.2.0/24 -j ACCEPT

[Per Yngve Berg]

http://www.linklogger.com/UDP67_68.htm

The INPUT Chain is for accessing resources on the router.
Routing from one segment to the outer is the FORWARD Chain.

iptables -I FORWARD -i vlan1 -o vlan3 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan3 -o vlan2 -m state --state NEW -j DROP

Allow new connections from vlan1 to vlan3, but not the reverse.

[ampapa]

Thanks for the reply.

I'm assuming you meant VLAN1 here?


iptables -I FORWARD -i vlan1 -o vlan3 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan3 -o vlan1 -m state --state NEW -j DROP

The new iptables and a reboot of the router seems to have solved it, thanks

[EDIT]

This did not work...

[ampapa]

OK... a few more screenshots... VLAN1 cannot ping 192.168.2.11 but can ping 192.168.2.1, it was able to do this before the new rules also.

[Per Yngve Berg]

What is on 192.168.3.9?

It will much easier to have a consistent address plan i.e the router is on 192.168.2.1 and 192.168.3.1 respectively.

[ampapa]

192.168.3.9 is the router address VLAN1.

VLAN2 is 192.168.2.0

[Per Yngve Berg]

You can enable login in Security->Log and see if the packets is dropped or accepted.

[ampapa]

The logs are empty...even when set to "high"

[Per Yngve Berg]

Have you tried to change the iptables rules to LOGDROP and LOGACCEPT?

[ampapa]

Do you have a link to a how to or any more info you can share on LOGDROP or LOGACCEPT?

Is what I am attempting to do out of the norm or something DDWRT can't handle?

Thanks for the assistance.

[ampapa]

So are you saying to change ACCEPT and DROP to LOGACCEPT and LOGDROP so that the info is logged to /tmp/var/log/messages?

[Per Yngve Berg]

Download with ftp.

[ampapa]

I don't understand why there isn't a log being generated??

I modified the commands being sent to logging, I believe this is correct. I then ran a ping from all the machines expecting some logging and got nothing.

See attached, messages is blank.

[ampapa]

Making a little progress here... I finally got some logging the log commands are case specific.

I essentially logged in as root on the router and ran an ifconfig and found the following: