Utilising 8 Public IP's

[mrbronz61]

lleachii

Yes, it would be a step-by-step if I know how to make a VLAN bridge!!! but I don't!

So what are the steps to make a VLAN bridge?

Since you insist on using non-OpenWrt commands, methods and syntax with OpenWrt,

I'm not insisting any anything, these are just suggestions from forum users.
Besides, I wouldn't know a non-OpenWrt command, method and syntax from an official one.

Give me a break I'm trying to learn here...

[mrbronz61]

@lleachii

Add to new firewall zone

How do I do this ?

Change Switch by adding a 3rd like

Change Switch
I only have one switch with 5 ports so how can I change it?

• number it 3
  Why? can I use 1 or 2 that are already there?

• change the untagged ports on VLAN 1/LAN that you want on the new network VLAN 3

Can you translate this so that a noobi can understand it, please? I have read it several times... change them to what?

• turn them off on VLAN 1!
  What does this even mean?

[mrbronz61]

A step-by-step guide
Some one asked me how I set up my DSL connection in OpenWrt so I gave them a step-by-step guide as follows:

1. Goto Network>interfaces- then click on "Edit" or click on the "WAN" tab
2. In the "DSL" section enter the following settings
3. Annex: Annex A + L + M(all)
4. Tone: A43C + J43 + A43
5. Encapsulation mode:PTM/EFM(Packet Transfer mode)
6. DSL line mode: VDSL
7. Downstream SNR offset: 0.0 dB
8. Leave the rest as default and click on "Save and Apply"
9. click on "Edit" or click on the "WAN" tab again
10. Click on the "Physical settings tab"
11. From the drop-down scroll to the bottom of the drop-down and in custom enter
12. dsl0.101
13. Click on save and apply
14. click on "Edit" or click on the "WAN" tab again
15. Select PPPoE protocol from the drop-down...
16. at this point you may have click on switch protocols to initialise the new protocol
17. Enter your user-name and password
18. Click on save and apply
19. You should now be able to access the Internet via your router
20. You may also need to setup your wifi interface

That, is an easy to follow step-by-step guide for anyone!

[mrbronz61]

@ppmm

ip add add 56.52.53.2/29 dev <wan>
ip add add 56.52.53.3/29 dev <wan>
ip add add 56.52.53.4/29 dev <wan>
ip add add 56.52.53.5/29 dev <wan>
ip add add 56.52.53.6/29 dev <wan>
iptables -t nat -A zone_wan_prerouting -i <wan> -d 56.52.53.3 -p udp -m udp --dport 53 -j DNAT --to-destination <ns1.ip>:53
iptables -t nat -A zone_wan_prerouting -i <wan> -d 56.52.53.4 -p udp -m udp --dport 53 -j DNAT --to-destination <ns2.ip>:53

Can you please explain this I don't understand what it is your doing

[mrbronz61]

@ppmm

config redirect
	option	name		'NS1'
	option	src		    'wan'
	option	src_dip		'56.52.53.3'
	option	proto		'udp'
	option  src_dport   '53'
	option	target		'DNAT'
	option	dest		'lan'
	option  dest_ip     <ns1.ip>
config redirect
	option	name		'NS2'
	option	src		    'wan'
	option	src_dip		'56.52.53.4'
	option	proto		'udp'
	option  src_dport   '53'
	option	target		'DNAT'
	option	dest		'lan'
	option  dest_ip     <ns2.ip>

Is this a solution or a note??? what is PoC?

[mrbronz61]

@lleachii

Why are you still improperly assigning all IPs to the router...I thought I also read you're assigning IPs to the devices...this is incorrect as I already noted

If you take just my Web server as an example, it must be assigned a static IP, then a rout to the internet via one of my LAN ports need to be established.

I am doing incorrectly because I don't know what I'm doing, and trying to get information that will help me understand so I can do it correctly.

I am using the GUI!!!!

I'm confused why you asked for steps, then persist on undertaking other steps not suggested by anyone in the thread.

You're confused... Persist? I have taken all information from this thread and implemented them. However, if you would read the thread from the perspective of someone who doesn't have your knowledge you would see how confusing this is.

Can you please be a little more choice-full in your language, you are coming over as angry and impatient?

I really appreciate your input and its frustrating enough without having to explain my misunderstandings.

[iplaywithtoys]

@mrbronz61

Is this a solution or a note???

It's an example of a possible configuration which purports to apply DNAT to incoming DNS queries.

@mrbronz61

what is PoC?

Proof of concept. Or, in other words, a test, a trial, an experiment.

[mrbronz61]

@iplaywithtoys

It's an example of a possible configuration which purports to apply DNAT to incoming DNS queries.

Great how do i implement it?

[ppmm]

Yeah it takes time to learn.

In LuCI follow "Network > Firewall > Port Forwards > Add"
Follow this screenshot,

and change "Internal IP address" to your name server 1 ip. Then go to "Advance Settings" tab change "External IP address". After all "save".

Add a second rule for NS2.
Then "save & apply". This will take care of the two iptables rules.

And then you need to ssh into openwrt and enter the 5 "ip add add" commands. I don't know how to do this in GUI.

[mrbronz61]

That's great thank you

The problem is that you have assumed that the NS is sitting behind a NAT and unfortunately my Domain provider states the address has to be public... Or have I got that bit wrong?

[lleachii]

@mrbronz61

I only have one switch with 5 ports so how can I change it?

Ummmm...Just change a number of ports less than 5?

@mrbronz61

So what are the steps to make a VLAN bridge?

Again:

@lleachii

• I'd make a VLAN 3 (or eth0.3). Bridged if you need WiFi

Have you actually looked at the Add Interface page?

I'm not sure how I better describe checking a box.

@mrbronz61

I have read it several times... change them to what?

From 1 to 3...lol. This I can provide a picture for.

Example, all LAN ports moved to new network.

@mrbronz61

I am using the GUI!!!!

I know.

[sampson]

I recommend you to use the DNAT method to setup your network.

We have many experts to help you here.

[lleachii]

@sampson

I recommend you to use the DNAT method to setup your network.

*SNAT, correct?

(The OP needs the SRC IP to be for the proper machine )

And BTW, an SNATs are added under the NAT Rules firewall tab.

Yes, if the OP got his router working, DNATs (Port Forwards in) and SNATs out will also solve the need to use all IPs.

[mrbronz61]

@lleachii

Have you actually looked at the Add Interface page?

Yes I have looked at it,

So am I to assume this brides all the interfaces or specified bridges. what would be the other interface I need to complete the bridge?

[lleachii]

@mrbronz61

So am I to assume this brides all the interfaces or specified bridges. what would be the other interface I need to complete the bridge?

I don't understand the question...as I literally showed you a picture on exactly what to do.

• Are you seeking the steps before (like when I noted ADD above)?

• ADD Inteeface
  • Name it (e.g. net2)
  • Make static
  • Give .1 IP
  • make eth0.3 bridge
  • make new firewall zone (i.e. net2)
  • Allow forwarding from net2 to WAN

@mrbronz61

Yes I have looked at it

Then:

• Please explain what the pictures don't elaborate upon
• Perhaps, can you show a picture of your issue???

Lastly, don't forget the switch:

@lleachii

Example, all LAN ports moved to new network.

[mrbronz61]

Thank you I have followed what you have suggested, still am not sure what the settings of a new Firewall zone need to be.

This is what I am trying to acheave

Each of the servers has its own firewall
I need to configure 3 of the physical ports, located on the back of my Router, to connect to the internet so that traffic going to, and from, the assigned static IP addresses can freely access the internet.

Hope this makes it a little clearer.

[lleachii]

@mrbronz61

still am not sure what the settings of a new Firewall zone need to be.

@lleachii

• Allow forwarding from net2 to WAN

@lleachii

• Set new firewall zone from network3 to WAN

Please review what's provided in this thread...this is going quite beyond step-by-step, into hand-holding...

I cannot guess port forwards, as I donno your services.

See (and yes, you can use GUI):

Firewall configuration /etc/config/firewall

@mrbronz61

I need to configure 3 of the physical ports, located on the back of my Router

@lleachii

Lastly, don't forget the switch:

Again, it may help if you have a specific issue (and perhaps picture or describe it) before making a new post.

@mrbronz61

Hope this makes it a little clearer.

You've been 100% clear...except regarding understanding the GUI setup.

(I'm confused as to how "just make your GUI look like my picture" is difficult for you - perhaps @sampson 's idea is easier???)

Are you asking me to make a picture for exactly 3 ports instead of 4 (as in the example)???

[mrbronz61]

Dear lleachii

If this is the extent of expert help and advice I am quite sure that OpenWrt is not for me!

I am not an expert and really don't want to be an expert, I just like to understand.

I just want a solution from someone who is not being condescended or poking fun, and who is patient with those asking for help.

As I have pointed out in an example of a step by step procedure, it's not handholding, its simple instructions for someone who has no idea of the software.

If your intention was to piss me off congratulations well done you won...Yey..., maybe this site can issue you with your first "Pissed them off badge"

You as a "Former IT Educator. in HE" should have knowledge of how to be patient and how to treat those asking for help.

My advice to you would be "Stop trying to help others, you're no good at it".

[lleachii]

@mrbronz61

If your intention was to piss me off congratulations well done you won...Yey..., maybe this site can issue you with your first "Pissed them off badge"

Quite confused...

• and still donno WHAT issue you're having with a firewalls
• you didn't show a picture
• nor did you describe the problem

But I provided the default rule to get your traffic to the Internet.

So again, I cannot guess. Sorry OpenWrt isn't for you. I'm not poking fun...I literally asked you:

@mrbronz61

I need to configure 3 of the physical ports, located on the back of my Router

@lleachii

Are you asking me to make a picture for exactly 3 ports instead of 4 (as in the example)???

Again no answer. Apologies I wasn't able to guess what you want.

@mrbronz61

My advice to you would be "Stop trying to help others, you're no good at it".

~ https://forum.openwrt.org/u/lleachii/activity/solved

@mrbronz61

I just like to understand.

What do you wish to understand?

• The pictures?
• Why I'm saying check the boxes??

@mrbronz61

You as a "Former IT Educator. in HE" should have knowledge of how to be patient and how to treat those asking for help.

I do in a classroom, not for advanced router software which assumes a basic understanding in networking (or Wiki reading) itself. Your questions (if any) seem more like "why are you saying do this"...but you failed to actually ask me that...others complain I'm "dumbing down for them". You can never win online.

Also, I'm not sure why you edited the quote as-written in my profile to insert the word "in" - in academic circles, that's a red flag "[academic] dishonesty" may follow...this is especially true in an instance such as this, where the edit clearly makes the proceeding sentence nonsensical; and limits the context of the one actually quoted.

[ppmm]

Overall I see three different approaches.
a) Layer3 DNAT: Add all public IPs available to user to OpenWrt WAN interface then use DNAT to provide access to internal servers. My posts #57 and #59 detailed how to do this. Read them again word by word carefully and it should be clear. Read the reference links as well. SSH access to router is required as I don't know how to use uci or /etc/config/network to implement those 'ip add add' commands.
b) Layer2 Vlan: configure one public IP to each name server and put ISP, OpenWrt and name servers in the same vlan(vlan2 in this case).
c) proxy arp + Layer3 routing: Similar to b) but the public IP will be configured as sort of loopback on name server. I won't go into detail here.