An encounter with VLAN

2 days ago, I helped my friend setting up internet connection for his office's LAN. As he showed me the network diagram, I realised that there are 6 VLAN that I need to cover to make them connect to the internet.

6 VLANS-->CORE SWITCH-->ROUTER+PROXY+DNS-->GATEWAY-->INTERNET

The problem was to get the clients in each VLAN to communicate each other and to communicate with router. All clients should also be able to access dhcp server located in one of the VLANS. After struggling about two days, I managed to get all clients in different VLANS talking to each other and the router. The problem was that I didn't understand how each VLAN talk to each other. The solution was located on coe switch. The commands below did the job:

route add -net 172.20.10.0 netmask 255.255.255.0 gw 172.20.30.254 eth0
route add -net 172.20.20.0 netmask 255.255.255.0 gw 172.20.30.254 eth0
route add -net 172.20.30.0 netmask 255.255.255.0 gw 172.20.30.254 eth0
route add -net 172.20.40.0 netmask 255.255.255.0 gw 172.20.30.254 eth0
route add -net 172.20.50.0 netmask 255.255.255.0 gw 172.20.30.254 eth0
route add -net 172.20.60.0 netmask 255.255.255.0 gw 172.20.30.254 eth0

If you can see above, the gateway is the same to be able all VLANs talking to each other and .30.254 is the gateway of the router.

route add default gw xxx.xxx.xxx.xxx

xxx.xxx.xxx.xxx is the gateway public IP (usually a modem). Don't forget that the router should enable ip forwarding. change it in /etc/sysctl.conf and run sysctl -p to make it effective. NAT and forward table really depends on it.

iptables and squid

I setup squid for faster internet access and save internet bandwidth. For each VLAN, we have to make rules.

iptables -t nat -A PREROUTING -s 172.20.10.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -s 172.20.20.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -s 172.20.30.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -s 172.20.40.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -s 172.20.50.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -s 172.20.60.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128

Note that 3128 is the squid port.

That's it. Now the clients on every VLAN can access to the internet and communicate with each other.