Felix Bolte wrote:
now, my main problem ... probably i have to set up 10 or up to 100 VLANs ... i don't want add them all manually to the config, especially the iptables rules will be blown up ... so there is a method to match all VLANs with one line: vlan eth0.+ detect but now the VLANs are handled as one zone(interface) ... so there is my problem ... whithout the routeback option, i can only ping the VLAN internal IPs ... i.e. from 172.16.10.2 to 172.16.10.3 or from 172.16.10.10 to 172.16.10.11, but nowhere else, because there is only one big vlan zone/interface ... so i have to put in the routeback option, which cause having access to all IPs ... the 172.16.10.2 can ping the 172.16.10.10 (in the other VLAN), but i only want to use the external IPs to get access between different VLANs is there any way to set up such an environment without having 100 zones and interfaces if i have 100 VLANs ?
I don't know what you are trying to accomplish with this amazing setup but, whatever it is, surely there must be a better way.
Nevertheless, you should be able to do what you want by:
/etc/shorewall/interfaces
vlan eth0.+ ...
/etc/shorewall/policy
vlan vlan REJECT
/etc/shorewall/rules:
ACCEPT vlan vlan - - - 192.168.10.0/24
-Tom
--
Tom Eastep \ Nothing is foolproof to a sufficiently talented fool
Shoreline, \ http://shorewall.net
Washington USA \ [EMAIL PROTECTED]
PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
