Re: VLAN with/and NATD

From: Chuck Swiger (cswiger_at_mac.com)
Date: 07/27/03

  • Next message: Evren Yurtesen: "Re: VLAN with/and NATD" 
    Date: Sat, 26 Jul 2003 20:01:31 -0400
To: Evren Yurtesen <eyurtese@tekniikka.turkuamk.fi>

    Evren Yurtesen wrote:
    > Now the problem is that I want to use NAT inside VLANs that, lets say I
    > want to be able to use use 192.168.1.0/24 IP block in every VLAN and in
    > different VLAN's the same IPs should be able to be used.
    >
    > Does anybody have any suggestion how to do this? I would guess that I need
    > multiple IP addresses in the outside interface but how do I map the VLAN
    > interfaces to use those IPs with NAT?

    I think I understand what you're asking about, but it's important to seperate
    VLANs (which are used to logically seperate the network at layer-2) and IP
    netblocks, which are used by layer-3 IP routing.

    You should also be aware that VLAN implementations are not perfect; you may and
    probably will sometimes get packets leaking from one VLAN to another for reasons
    which include a failure to tag them with a VLAN id, buggy switches, and who
    knows what else. Having IP addresses be unique within the "network you manage"
    is a really good idea. [call this an opinion]

    That being said, configure your switches with a VLAN ID 0 where the NAT
    boxes/routers live and your external Internet connection, and VLAN ID 1, 2, 3
    will be used for each of your 192.168 networks, network-1, network-2, etc.

    If you've got enough public IPs to give one per network, have NAT-box-1 in VLAN
    ID 0 and 1 and translate traffic to public-ip-1, etc. If NAT-box-1 is
    dual-homed, have one interface be in each VLAN, otherwise you can use an
    ifconfig's alias and vlan keywords to do this over a single interface.

    Of course, if all of your NAT boxes will be dual-homed, you could simply put one
    interface onto each network and the other onto another switch and form the
    "external subnet" I'm talking about that way. But you asked how to do this via
    VLANs, so....

    Lather, rinse, repeat for NAT-box-2, network-2, -3, and so forth.

    Configure the external subnet to route traffic via the local Internet
    connection, and you're done. Oh, yeah-- if you don't have enough public IPs and
    you need to coalesce this further, use 10.0.0.0/8 addresses on these NAT boxes,
    then set up another layer of NAT translation which maps everybody on the 10/8
    subnet into a single public IP.

    [ NAT sucks. NAT'ing twice sucks worse: persistent connections don't work very
    well and tend to have a livetime which is inversely proportional to the amount
    of network traffic (hence dynamic entries) going by. ]

    -Chuck

    _______________________________________________
    freebsd-isp@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-isp
    To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"

  • Next message: Evren Yurtesen: "Re: VLAN with/and NATD"

    Relevant Pages

    • [fw-wiz] "VLAN jumping" attack?
      ... no IP address or VLAN assigned to the physical interface, ... interface ethernet1 vlan1702 physical ... The "inside" network, VLAN1702, the one assigned to the physical ... Ethernet1 attaches to a Foundry 2402 switch, wherein the "default VLAN" is ...
      (Firewall-Wizards)
    • Re: Configuring VLAN in 6500 Switch
      ... IP address of the external interface. ... I would like to set up a "routable" VLAN... ... The network my external interface is on ... If port is configured as pure Layer3 interface, ...
      (comp.dcom.sys.cisco)
    • config for securePlatform
      ... Cisco 3548XL Enterprise switch ... What I am trying to do is to utilize the VLAN feature so that I have ... one interface for all internal subnet's and one external interface. ... I am still not able to ping any adress in the network where the IP ...
      (comp.security.firewalls)
    • scp/rcp hang with vlan-if
      ... using the on-board interface card bge i defined 2 interface like this: ... which are behind vlan 160 going over the cisco. ... the sun-server in vlan 160 going over the default-gw in network 172.18.x.y. ... but is defined as vlan 160 and bge0 has in ip-adress of vlan 160 range. ...
      (comp.unix.solaris)
    • Re: VLAN with/and NATD
      ... I figured out that I have a logical problem. ... About making NAT of NAT to have more external IP addresses. ... >> multiple IP addresses in the outside interface but how do I map the VLAN ...
      (freebsd-isp)