VLAN Bridge with layer2 filtering

From: Csaba Urban (ucsaba_at_freemail.hu)
Date: 04/26/05

  • Next message: Jose M Rodriguez: "Re: VLAN Bridge with layer2 filtering" 
    Date: Tue, 26 Apr 2005 09:56:25 +0200 (CEST)
To: freebsd-net@freebsd.org

    Hi,

    I have a number of users on a VLAN enabled switch - each users on his
    own VLAN. They have fixed IP address sharing the same IP subnet and
    gateway.
    I want to grant them access to the internet throug a FreeBSD box
    which prevents them from communicating with each other in Layer2
    and which also prevents them to use other user's IP or MAC. I don't
    want to use static ARP so it seems that best solution is a VLAN enabled
    filtering bridge - in each VLAN only one certain IP address is allowed.

    I am pretty new to FreeBSD and have a couple of questions:

    1. FreeBSD 5.3 and em() driver: I have a Supermicro P4SCi board with
    integrated Intel 82541 NICs. I see there are a lot off issues with the
    em driver when using VLANs and I couldn't figure it out whether they
    are already solved. Maybe it would be better to use other NICs?

    2. Bridge setup: since in FreeBSD I can't give the bridge an IP address I
    think I have to create a VLAN that doesn't belong to any of the users
    and this vlan would have an IP - this will be the users' gateway
    address:

    ifconfig vlan0 inet 192.168.0.1 netmask 255.255.255.0

    Other vlans are bridged with vlan0:

    sysctl net.link.ether.bridge.config=vlan0,vlan1,vlan2,vlan3

    Is it the right way of doing it?

    3. MAC spoofing: if a user tries to use an other users MAC then there
    will be two identical MACs on the bridge - in two separate VLANs. Can I
    have the bridge transmit packets to both destination? If so, can I filter
    packets later - when leaving the interface - whether the have the right
    VLAN-IP combination?

    4. Filtering ARP: I can't simply block ARP. Is there a way in IPFW to look
    into ARP messages and filter out wrong VLAN-IP combinations?

    5. Performance: there will be a number of VLANs here (200-300) with a
    1Gbps link to the switch and 100Mbps to the internet. What
    performance can I expect with a 2.4GHz P4 proc and 512MB RAM?

    +1: if I want to set up a DHCP relay agent will it be able to determine in
    which VLAN the request came in?

    I would really appreciate any help!

    thanks,

    csaba

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Jose M Rodriguez: "Re: VLAN Bridge with layer2 filtering"

    Relevant Pages

    • Re: Cisco 2811 with HWIC-4ESW
      ... Does anyone have the foggiest idea of how to get fa0/0 to share a vlan ... "Extending VLANs within Layer 3 switches" and seems to be close but it ... wasn't all that essential for me to have the other interface. ... bridge group, and they're together. ...
      (comp.dcom.sys.cisco)
    • Re: 876W Wireless
      ... interface Dot11Radio0 ... encryption vlan 1 mode ciphers tkip ... did or didn't you get the bridge working? ... I have the same conf (authentication apart, I'm at the beginning) but it doesn't work ...
      (comp.dcom.sys.cisco)
    • Re: Cisco 2811 with HWIC-4ESW
      ... Does anyone have the foggiest idea of how to get fa0/0 to share a vlan with ... Then you create a bridge virtual interface for the router to use instead of the vlan interface that connects to the switch module. ... Join both the vlan interface from the switch and the physical interface from the ouside of the router into the bridge group, ...
      (comp.dcom.sys.cisco)
    • Re: CFR: bridge locking
      ... |> | If you get bridge to send/receive packets to/from vlan interfaces ... | ifconfig vlan0 200.220.254.190/26 ...
      (freebsd-net)
    • Re: 1811W - PCs can no longer see eachother AT ALL!!! (HELP!)
      ... sh ip arp ... sh ip dhcp bindings ...
      (comp.dcom.sys.cisco)