Ubnt USG. Route mellan LAN1 och VLAN 5 på LAN2 parent.

Ubnt USG. Route mellan LAN1 och VLAN 5 på LAN2 parent. Labbat med statiska rutter, fw regler, no luck,

Är det möjligt, isf hur?

Så här ser det ut..
http://prntscr.com/ihouaq
http://prntscr.com/ihov79

Jag kan pinga interfacet/gatewayen, men inget PÅ det nätet. Behöver jag öppna upp något i FW?

LAN kan inte pinga VLAN:en.

Testat att göra statiska routes, utan resultat.

@vongen:

http://prntscr.com/ihpiwg

Ska prova mera när jag har access till mitt hemnät..

Ifrån mitt LAN kan jag pinga alla VLAN gateways, men inga maskiner på själva VLAN:et.

@moron: Jo, Local är ju interfacen eller routern i sig.. Du menar att jag ska addera någon regel för det ska fungera?

Har inga FW regler förutom de som är deafult.

Såhär ser konfigen ut:

admin@fcecda049ab2:~$ show configuration
firewall {
all-ping enable
broadcast-ping disable
group {
address-group authorized_guests {
description "authorized guests MAC addresses"
}
address-group guest_allow_addresses {
description "allow addresses for guests"
}
address-group guest_allow_dns_servers {
description "allow dns servers for guests"
}
address-group guest_portal_address {
description "guest portal address"
}
address-group guest_restricted_addresses {
address 192.168.0.0/16
address 172.16.0.0/12
address 10.0.0.0/8
description "restricted addresses for guests"
}
address-group unifi_controller_addresses {
address 192.168.1.7
}
network-group captive_portal_subnets {
description "captive portal subnets"
}
network-group corporate_network {
description "corporate subnets"
network 192.168.1.0/24
network 192.168.5.0/24
network 192.168.6.0/24
}
network-group guest_allow_subnets {
description "allow subnets for guests"
}
network-group guest_network {
description "guest subnets"
}
network-group guest_restricted_subnets {
description "restricted subnets for guests"
}
network-group remote_client_vpn_network {
description "remote client VPN subnets"
}
network-group remote_site_vpn_network {
description "remote site VPN subnets"
}
network-group remote_user_vpn_network {
description "remote user vpn subnets"
}
port-group guest_portal_ports {
description "guest portal ports"
}
port-group guest_portal_redirector_ports {
description "guest portal redirector ports"
port 39080
port 39443
}
port-group unifi_controller_ports-tcp {
description "unifi tcp ports"
port 8080
}
port-group unifi_controller_ports-udp {
description "unifi udp ports"
port 3478
}
}
name AUTHORIZED_GUESTS {
default-action drop
description "authorization check packets from guest network"
}
name GUEST_IN {
default-action accept
description "packets from guest network"
rule 3001 {
action accept
description "allow DNS packets to external name servers"
destination {
port 53
}
protocol udp
}
rule 3002 {
action accept
description "allow packets to captive portal"
destination {
group {
network-group captive_portal_subnets
}
port 443
}
protocol tcp
}
rule 3003 {
action accept
description "allow packets to allow subnets"
destination {
group {
address-group guest_allow_addresses
}
}
}
rule 3004 {
action drop
description "drop packets to restricted subnets"
destination {
group {
address-group guest_restricted_addresses
}
}
}
rule 3005 {
action drop
description "drop packets to intranet"
destination {
group {
network-group corporate_network
}
}
}
rule 3006 {
action drop
description "drop packets to remote user"
destination {
group {
network-group remote_user_vpn_network
}
}
}
rule 3007 {
action drop
description "authorized guests white list"
destination {
group {
address-group authorized_guests
}
}
}
}
name GUEST_LOCAL {
default-action drop
description "packets from guest network to gateway"
rule 3001 {
action accept
description "allow DNS"
destination {
port 53
}
protocol udp
}
rule 3002 {
action accept
description "allow ICMP"
protocol icmp
}
}
name GUEST_OUT {
default-action accept
description "packets forward to guest network"
}
name LAN_IN {
default-action accept
description "packets from intranet"
rule 6001 {
action accept
description "accounting defined network 192.168.1.0/24"
source {
address 192.168.1.0/24
}
}
rule 6002 {
action accept
description "accounting defined network 192.168.5.0/24"
source {
address 192.168.5.0/24
}
}
rule 6003 {
action accept
description "accounting defined network 192.168.6.0/24"
source {
address 192.168.6.0/24
}
}
}
name LAN_LOCAL {
default-action accept
description "packets from intranet to gateway"
}
name LAN_OUT {
default-action accept
description "packets forward to intranet"
rule 6001 {
action accept
description "accounting defined network 192.168.1.0/24"
destination {
address 192.168.1.0/24
}
}
rule 6002 {
action accept
description "accounting defined network 192.168.5.0/24"
destination {
address 192.168.5.0/24
}
}
rule 6003 {
action accept
description "accounting defined network 192.168.6.0/24"
destination {
address 192.168.6.0/24
}
}
}
name WAN_IN {
default-action drop
description "packets from internet to intranet"
rule 3001 {
action accept
description "allow established/related sessions"
state {
established enable
invalid disable
new disable
related enable
}
}
rule 3002 {
action drop
description "drop invalid state"
state {
established disable
invalid enable
new disable
related disable
}
}
}
name WAN_LOCAL {
default-action drop
description "packets from internet to gateway"
rule 3001 {
action accept
description "allow established/related sessions"
state {
established enable
invalid disable
new disable
related enable
}
}
rule 3002 {
action drop
description "drop invalid state"
state {
established disable
invalid enable
new disable
related disable
}
}
}
name WAN_OUT {
default-action accept
description "packets to internet"
}
options {
mss-clamp {
interface-type pppoe
interface-type pptp
interface-type vti
mss 1452
}
}
receive-redirects disable
send-redirects enable
syn-cookies enable
}
interfaces {
ethernet eth0 {
address dhcp
dhcp-options {
client-option "retry 60;"
default-route-distance 1
}
firewall {
in {
name WAN_IN
}
local {
name WAN_LOCAL
}
out {
name WAN_OUT
}
}
}
ethernet eth1 {
address 192.168.1.1/24
firewall {
in {
name LAN_IN
}
local {
name LAN_LOCAL
}
out {
name LAN_OUT
}
}
}
ethernet eth2 {
firewall {
in {
name LAN_IN
}
local {
name LAN_LOCAL
}
out {
name LAN_OUT
}
}
vif 5 {
address 192.168.5.1/24
firewall {
in {
name LAN_IN
}
local {
name LAN_LOCAL
}
out {
name LAN_OUT
}
}
}
vif 6 {
address 192.168.6.1/24
firewall {
in {
name LAN_IN
}
local {
name LAN_LOCAL
}
out {
name LAN_OUT
}
}
}
}
loopback lo {
}
}
port-forward {
auto-firewall disable
hairpin-nat enable
lan-interface eth1
lan-interface eth2.5
lan-interface eth2.6
wan-interface eth0
}
service {
dhcp-server {
disabled false
hostfile-update enable
shared-network-name net_5_192.168.5.0-24 {
authoritative enable
description vlan5
subnet 192.168.5.0/24 {
default-router 192.168.5.1
dns-server 192.168.5.1
lease 86400
start 192.168.5.6 {
stop 192.168.5.254
}
}
}
shared-network-name net_6_192.168.6.0-24 {
authoritative enable
description vlan6
subnet 192.168.6.0/24 {
default-router 192.168.6.1
dns-server 192.168.6.1
lease 86400
start 192.168.6.6 {
stop 192.168.6.254
}
}
}
shared-network-name net_LAN_192.168.1.0-24 {
authoritative enable
description vlan1
subnet 192.168.1.0/24 {
default-router 192.168.1.1
dns-server 192.168.1.1
domain-name localdomain
lease 86400
start 192.168.1.6 {
stop 192.168.1.254
}
}
}
}
dns {
forwarding {
cache-size 10000
except-interface eth0
options ptr-record=1.1.168.192.in-addr.arpa,fcecda049ab2
options host-record=unifi,192.168.1.7
}
}
gui {
https-port 443
}
lldp {
interface eth0 {
disable
}
}
nat {
rule 6001 {
description "MASQ corporate_network to WAN"
log disable
outbound-interface eth0
protocol all
source {
group {
network-group corporate_network
}
}
type masquerade
}
rule 6002 {
description "MASQ remote_user_vpn_network to WAN"
log disable
outbound-interface eth0
protocol all
source {
group {
network-group remote_user_vpn_network
}
}
type masquerade
}
rule 6003 {
description "MASQ guest_network to WAN"
log disable
outbound-interface eth0
protocol all
source {
group {
network-group guest_network
}
}
type masquerade
}
}
ssh {
port 22
protocol-version v2
}
}
system {
conntrack {
modules {
sip {
disable
}
}
timeout {
icmp 30
other 600
tcp {
close 10
close-wait 60
established 7440
fin-wait 120
last-ack 30
syn-recv 60
syn-sent 120
time-wait 120
}
udp {
other 30
stream 180
}
}
}
domain-name localdomain
host-name fcecda049ab2
ip {
override-hostname-ip 192.168.1.1
}
login {
user admin {
authentication {
encrypted-password ****************
}
level admin
}
}
ntp {
server 0.ubnt.pool.ntp.org {
}
server 1.ubnt.pool.ntp.org {
}
server 2.ubnt.pool.ntp.org {
}
server 3.ubnt.pool.ntp.org {
}
}
offload {
ipsec enable
ipv4 {
forwarding enable
pppoe enable
vlan enable
}
ipv6 {
forwarding enable
vlan enable
}
}
static-host-mapping {
host-name setup.ubnt.com {
alias setup
inet 192.168.1.1
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone Europe/Amsterdam
traffic-analysis {
dpi enable
}
}
unifi {
mgmt {
cfgversion e22af9d4a5a27702
}
}