I have a new 3-NIC ALIX machine running m0n0wall to act as a traffic-shaper between my LAN and my ADSL router (which provides the firewall functions itself).
I have configures WAN/vr0 as 10.1.100.252/16 and LAN/vr1 (which I planned to use for management only) as 10.1.100.253/16. OPT1/vr2 is bridged to the WAN interface and the WAN interface is connected directly to the ADSL router on 10.1.100.254/16.
I set all of this up without LAN/vr1 plugged in - and I had full internet access and could see the router's web interface, but I couldn't access the m0n0wall webUI on 10.1.100.252.
Here's where it gets strange:
I plugged a cable from the LAN top-level switch into the LAN/vr1 socket. This gives me LAN/vr1 plugged into a gigabit unmanaged switch (no reason, there was a spare socket) which connects directly to a 10/100Mb unmanaged switch which connects to OPT1/vr2.
Now I can see the web UI of the m0n0wall on 10.1.100.252, but can't even ping 10.1.100.253 from my LAN!
Stranger, all my LAN hosts are detected as living on the LAN/vr1 port, but using the m0n0wall diagnostic tools I'm unable to ping any of them through this port. If I try to ping any LAN hosts via the WAN/vr0 port, however, this succeeds.
This means that none of my internal services are currently available externally, because incoming packets are de-NAT'd by the ADSL router and sent to the m0n0wall, which presumably then transmits them via the LAN interface where they get lost.
During this entire testing period I was pinging 10.1.100.254, 10.1.100.253, and 10.1.100.252 - whilst .254 and .252 always worked, I noticed as I finished that .253 did respond to about 20 pings in sequence during the 30-minute or so test. I've no idea why this didn't work all the time, or what might have caused it to suddenly respond for a short period.
My questions are:
- Is bridging intended to be used in this fashion?
- Why is the UI only accessible when LAN/vr1 is plugged in, but then only via OPT1/vr2?
- Why can't the m0n0wall see any hosts via LAN/vr1, when this is directly plugged into the same top-level switch as all other (gigabit) LAN hosts, which have no networking issues?
- Can I workaround this problem by setting a static route for 10.1/16 via WAN/vr0 (which is bridged with OPT1/vr2) without breaking anything?
These tests were performed with the Traffic Shaper enabled with the default P2P shaping configuration produced by the Wizard, and the only Firewall rules were a rule on each interface passing all traffic.
Any help greatly appreciated...