Changes between Initial Version and Version 1 of TipAndDoc/Linux/OpenWRT/vlan


Ignore:
Timestamp:
Apr 30, 2013 3:25:50 AM (11 years ago)
Author:
mitty
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • TipAndDoc/Linux/OpenWRT/vlan

    v1 v1  
     1[[PageOutline]] 
     2 
     3 * [https://forum.openwrt.org/viewtopic.php?id=28716 Correctness of swconfig documentation (Page 1) — Howtos and Documentation — OpenWrt] 
     4 > the '*' is supported by broadcom kmod-switch style drivers only. It is used to set the default VLAN for untagged frames on a port. 
     5  * その他、VLANの設定オプションについて解説がある 
     6 
     7 * [https://dev.openwrt.org/ticket/12377 #12377 (VLAN tagging / bridge default configuration on WZR-HP-AG300H) – OpenWrt] 
     8 > To make it possible to use multiple VLANs, the fix is to change the lan interface to bind on eth0.1 and set port 0 to tagged: 
     9  * [https://forum.openwrt.org/viewtopic.php?pid=155341#p155341 wzr-hp-ag300h progress (Page 4) — General Discussion — OpenWrt] 
     10 
     11 = restrictions of vlan with OpenWRT on WZR-HP-AG300H = 
     12 * eth0側でH/W VLANを無効({{{config switch_vlan}}}を削除)にすると、eth0からの有線でのWZR-HP-AG300Hへのアクセスが不能になる 
     13 * H/Wに設定したVLAN ID以外のtagged VLAN packetをeth0に向けて送信しても、eth0まで届かない 
     14  * 単なるSwitching HUBとは異なる 
     15  * eth1側にはこのような制約はない 
     16   * mitty@AG300H:~$ sudo vconfig add eth1 2408 
     17   * mitty@AG300H:~$ sudo ifconfig eth1.2408 10.0.0.1 
     18   * これで、別のマシンから eth0.2408 などを通してpingが正しく届く 
     19    * mitty@AG300H:~$ sudo tcpdump -e -i eth1 
     20{{{ 
     2112:20:52.941468 00:1d:zy:xz:yx:dc (oui Unknown) > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 2408, p 0, ethertype ARP, Request who-has 10.0.0.1 tell 10.0.0.2, length 46 
     2212:20:52.941555 00:24:xx:yy:zz:76 (oui Unknown) > 00:1d:zy:xz:yx:dc (oui Unknown), ethertype 802.1Q (0x8100), length 46: vlan 2408, p 0, ethertype ARP, Reply 10.0.0.1 is-at 00:24:xx:yy:zz:76 (oui Unknown), length 28 
     2312:20:52.941675 00:1d:zy:xz:yx:dc (oui Unknown) > 00:24:xx:yy:zz:76 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 2408, p 0, ethertype IPv4, 10.0.0.2 > 10.0.0.1: ICMP echo request, id 2890, seq 1, length 64 
     2412:20:52.941855 00:24:xx:yy:zz:76 (oui Unknown) > 00:1d:zy:xz:yx:dc (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 2408, p 0, ethertype IPv4, 10.0.0.1 > 10.0.0.2: ICMP echo reply, id 2890, seq 1, length 64 
     2512:20:53.938338 00:1d:zy:xz:yx:dc (oui Unknown) > 00:24:xx:yy:zz:76 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 2408, p 0, ethertype IPv4, 10.0.0.2 > 10.0.0.1: ICMP echo request, id 2890, seq 2, length 64 
     2612:20:53.938458 00:24:xx:yy:zz:76 (oui Unknown) > 00:1d:zy:xz:yx:dc (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 2408, p 0, ethertype IPv4, 10.0.0.1 > 10.0.0.2: ICMP echo reply, id 2890, seq 2, length 64 
     27}}} 
     28 * untagged/taggedを同じネットワーク上で使う(multi vlan/trunking)場合、LAN側からuntagged packetをNAPTするには{{{eth0}}}ではなく{{{eth0.0}}}をGatewayにする必要がある 
     29 * VLAN IDは0～127のみ使用可能 
     30  * wrong setting 
     31{{{ 
     32config switch_vlan 
     33        option device 'eth0' 
     34        option vlan '0' 
     35        option ports '0 1 2 3 4' 
     36 
     37config switch_vlan 
     38        option device 'eth0' 
     39        option vlan '128' 
     40        option ports '0t 1t 2t 3t 4t' 
     41}}} 
     42   * mitty@AG300H:~$ swconfig dev eth0 show 
     43{{{ 
     44VLAN 0: 
     45        vid: 0 
     46        ports: 0 1 2 3 4 
     47}}} 
     48  * correct setting 
     49{{{ 
     50config switch_vlan 
     51        option device 'eth0' 
     52        option vlan '0' 
     53        option ports '0 1 2 3 4' 
     54 
     55config switch_vlan 
     56        option device 'eth0' 
     57        option vlan '127' 
     58        option ports '0t 1t 2t 3t 4t' 
     59}}} 
     60   * mitty@AG300H:~$ swconfig dev eth0 show 
     61{{{ 
     62VLAN 0: 
     63        vid: 0 
     64        ports: 0t 1t 2t 3t 4t 
     65VLAN 127: 
     66        vid: 127 
     67        ports: 0t 1t 2t 3t 4t 
     68}}} 
     69 
     70 = switch_vlan config with "option vlan '0'" = 
     71 * http://wiki.openwrt.org/doc/uci/network/switch#vlanswitch.config 
     72 > In the option ports line, a number indicates that the specified vlan includes the port with that number. If the number is followed by a "t" then packets transmitted out that port on this VLAN are tagged, and that packets received on that port may be received with this VLAN tag. 
     73 > So, '0 1 2 3 5t' would mean that packets on this VLAN are transmitted untagged when leaving ports 0, 1, 2 and 3, but tagged when leaving port 5 (generally the CPU internal port as described above). 
     74 * となっているが、untaggedなはずのportからも実際にはtagged packetが送出される 
     75 
     76 * この問題は、VLAN ID として0を指定すると解決する 
     77 
     78 == sample setting with problem == 
     79 * /etc/config/network 
     80{{{ 
     81config interface 'lan' 
     82        option ifname 'eth0.1' 
     83        option proto 'static' 
     84        option netmask '255.255.255.0' 
     85        option ipaddr '192.168.0.1' 
     86 
     87config interface 'vlan' 
     88        option ifname 'eth0.2' 
     89        option proto 'static' 
     90        option netmask '255.255.255.0' 
     91        option ipaddr '192.168.2.1' 
     92 
     93config switch 
     94        option name 'eth0' 
     95        option reset '1' 
     96        option enable_vlan '1' 
     97 
     98config switch_vlan 
     99        option device 'eth0' 
     100        option vlan '1' 
     101        option ports '0t 1 2 3 4' 
     102 
     103config switch_vlan 
     104        option device 'eth0' 
     105        option vlan '2' 
     106        option ports '0t 1t 2t 3t 4t' 
     107}}} 
     108  * VLAN1のポート1はuntaggedになっているが、実際にはVLAN IDは除去されない[[br]][[Image(option-vlan-1.png,33%)]] 
     109 * mitty@AG300H:~$ ifconfig |egrep 'Link|addr' 
     110{{{ 
     111eth0      Link encap:Ethernet  HWaddr 00:24:XX:YY:ZZ:74 
     112eth0.1    Link encap:Ethernet  HWaddr 00:24:XX:YY:ZZ:74 
     113          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0 
     114eth0.2    Link encap:Ethernet  HWaddr 00:24:XX:YY:ZZ:74 
     115          inet addr:192.168.2.1  Bcast:192.168.2.255  Mask:255.255.255.0 
     116}}} 
     117 
     118 == with Linux node == 
     119 * root@Microknoppix:~# ifconfig |egrep 'Link|addr' 
     120{{{ 
     121eth1      Link encap:Ethernet  HWaddr 00:1d:zy:xz:yx:dc 
     122          inet addr:192.168.0.60  Bcast:192.168.0.255  Mask:255.255.255.0 
     123eth1.1    Link encap:Ethernet  HWaddr 00:1d:zy:xz:yx:dc 
     124eth1.2    Link encap:Ethernet  HWaddr 00:1d:zy:xz:yx:dc 
     125          inet addr:192.168.2.60  Bcast:192.168.2.255  Mask:255.255.255.0 
     126}}} 
     127 * root@Microknoppix:~# ip route 
     128{{{ 
     129192.168.0.0/24 dev eth1  proto kernel  scope link  src 192.168.0.60 
     130192.168.2.0/24 dev eth1.2  proto kernel  scope link  src 192.168.2.60 
     131}}} 
     132 
     133 === untagged === 
     134 * root@Microknoppix:~# ping 192.168.0.1 -c 2 
     135{{{ 
     136PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data. 
     137From 192.168.0.60 icmp_seq=1 Destination Host Unreachable 
     138From 192.168.0.60 icmp_seq=2 Destination Host Unreachable 
     139 
     140--- 192.168.0.1 ping statistics --- 
     1412 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1008ms 
     142}}} 
     143 * mitty@AG300H:~$ sudo tcpdump -n -e -i eth0 icmp or arp 
     144{{{ 
     14500:07:48.165448 00:1d:zy:xz:yx:dc > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP, Request who-has 192.168.0.1 tell 192.168.0.60, length 46 
     14600:07:48.165493 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 46: vlan 1, p 0, ethertype ARP, Reply 192.168.0.1 is-at 00:24:xx:yy:zz:74, length 28 
     14700:07:49.168881 00:1d:zy:xz:yx:dc > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP, Request who-has 192.168.0.1 tell 192.168.0.60, length 46 
     14800:07:49.168925 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 46: vlan 1, p 0, ethertype ARP, Reply 192.168.0.1 is-at 00:24:xx:yy:zz:74, length 28 
     14900:07:50.172211 00:1d:zy:xz:yx:dc > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP, Request who-has 192.168.0.1 tell 192.168.0.60, length 46 
     15000:07:50.172255 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 46: vlan 1, p 0, ethertype ARP, Reply 192.168.0.1 is-at 00:24:xx:yy:zz:74, length 28 
     151}}} 
     152 * root@Microknoppix:~# sudo tcpdump -n -e -i eth1 icmp or arp 
     153{{{ 
     15400:07:49.739793 00:1d:zy:xz:yx:dc > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.0.1 tell 192.168.0.60, length 28 
     15500:07:49.739923 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 60: vlan 1, p 0, ethertype ARP, Reply 192.168.0.1 is-at 00:24:xx:yy:zz:74, length 42 
     15600:07:50.743222 00:1d:zy:xz:yx:dc > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.0.1 tell 192.168.0.60, length 28 
     15700:07:50.743361 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 60: vlan 1, p 0, ethertype ARP, Reply 192.168.0.1 is-at 00:24:xx:yy:zz:74, length 42 
     15800:07:51.746558 00:1d:zy:xz:yx:dc > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.0.1 tell 192.168.0.60, length 28 
     15900:07:51.746698 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 60: vlan 1, p 0, ethertype ARP, Reply 192.168.0.1 is-at 00:24:xx:yy:zz:74, length 42 
     160}}} 
     161 
     162 * Microknoppixからすると、送る時はuntaggedなのに返ってくる時にtaggedになっているため、疎通不能である 
     163 
     164 === VLAN ID 2 (eth0.2) === 
     165 * root@Microknoppix:~# ping 192.168.2.1 -c 2 
     166{{{ 
     167PING 192.168.2.1 (192.168.2.1) 56(84) bytes of data. 
     16864 bytes from 192.168.2.1: icmp_req=1 ttl=64 time=2.95 ms 
     16964 bytes from 192.168.2.1: icmp_req=2 ttl=64 time=0.268 ms 
     170 
     171--- 192.168.2.1 ping statistics --- 
     1722 packets transmitted, 2 received, 0% packet loss, time 1001ms 
     173rtt min/avg/max/mdev = 0.268/1.610/2.952/1.342 ms 
     174}}} 
     175 * mitty@AG300H:~$ sudo tcpdump -n -e -i eth0 icmp or arp 
     176{{{ 
     17700:09:52.211509 00:1d:zy:xz:yx:dc > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 2, p 0, ethertype ARP, Request who-has 192.168.2.1 tell 192.168.2.60, length 46 
     17800:09:52.211613 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 46: vlan 2, p 0, ethertype ARP, Reply 192.168.2.1 is-at 00:24:xx:yy:zz:74, length 28 
     17900:09:52.211741 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.2.60 > 192.168.2.1: ICMP echo request, id 3528, seq 1, length 64 
     18000:09:52.211927 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.2.1 > 192.168.2.60: ICMP echo reply, id 3528, seq 1, length 64 
     18100:09:53.210338 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.2.60 > 192.168.2.1: ICMP echo request, id 3528, seq 2, length 64 
     18200:09:53.210453 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.2.1 > 192.168.2.60: ICMP echo reply, id 3528, seq 2, length 64 
     183}}} 
     184 * root@Microknoppix:~# sudo tcpdump -n -e -i eth1 icmp or arp 
     185{{{ 
     18600:09:53.786560 00:1d:zy:xz:yx:dc > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 46: vlan 2, p 0, ethertype ARP, Request who-has 192.168.2.1 tell 192.168.2.60, length 28 
     18700:09:53.786782 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 60: vlan 2, p 0, ethertype ARP, Reply 192.168.2.1 is-at 00:24:xx:yy:zz:74, length 42 
     18800:09:53.786816 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.2.60 > 192.168.2.1: ICMP echo request, id 3528, seq 1, length 64 
     18900:09:53.787074 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.2.1 > 192.168.2.60: ICMP echo reply, id 3528, seq 1, length 64 
     19000:09:54.785397 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.2.60 > 192.168.2.1: ICMP echo request, id 3528, seq 2, length 64 
     19100:09:54.785632 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.2.1 > 192.168.2.60: ICMP echo reply, id 3528, seq 2, length 64 
     192}}} 
     193 
     194 * eth1.2 (VLAN ID 2)については問題ない 
     195 
     196 === VLAN ID 1 (eth1.1) === 
     197 * eth1.1で通信するように変更すると、疎通可能になる 
     198 
     199 * root@Microknoppix:~# ifconfig eth1 0.0.0.0 
     200 * root@Microknoppix:~# ifconfig eth1.1 192.168.0.60 
     201 
     202 * root@Microknoppix:~# ping 192.168.0.1 -c 2 
     203{{{ 
     204PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data. 
     20564 bytes from 192.168.0.1: icmp_req=1 ttl=64 time=0.490 ms 
     20664 bytes from 192.168.0.1: icmp_req=2 ttl=64 time=0.268 ms 
     207 
     208--- 192.168.0.1 ping statistics --- 
     2092 packets transmitted, 2 received, 0% packet loss, time 999ms 
     210rtt min/avg/max/mdev = 0.268/0.379/0.490/0.111 ms 
     211}}} 
     212 * mitty@AG300H:~$ sudo tcpdump -n -e -i eth0 icmp or arp 
     213{{{ 
     21400:16:27.724498 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 102: vlan 1, p 0, ethertype IPv4, 192.168.0.60 > 192.168.0.1: ICMP echo request, id 3579, seq 1, length 64 
     21500:16:27.724738 00:24:xx:yy:zz:74 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 46: vlan 1, p 0, ethertype ARP, Request who-has 192.168.0.60 tell 192.168.0.1, length 28 
     21600:16:27.724841 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP, Reply 192.168.0.60 is-at 00:1d:zy:xz:yx:dc, length 46 
     21700:16:27.724863 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 102: vlan 1, p 0, ethertype IPv4, 192.168.0.1 > 192.168.0.60: ICMP echo reply, id 3579, seq 1, length 64 
     21800:16:28.723493 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 102: vlan 1, p 0, ethertype IPv4, 192.168.0.60 > 192.168.0.1: ICMP echo request, id 3579, seq 2, length 64 
     21900:16:28.723613 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 102: vlan 1, p 0, ethertype IPv4, 192.168.0.1 > 192.168.0.60: ICMP echo reply, id 3579, seq 2, length 64 
     220}}} 
     221 * root@Microknoppix:~# sudo tcpdump -n -e -i eth1 icmp or arp 
     222{{{ 
     22300:16:29.301169 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 102: vlan 1, p 0, ethertype IPv4, 192.168.0.60 > 192.168.0.1: ICMP echo request, id 3579, seq 1, length 64 
     22400:16:29.301509 00:24:xx:yy:zz:74 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 60: vlan 1, p 0, ethertype ARP, Request who-has 192.168.0.60 tell 192.168.0.1, length 42 
     22500:16:29.301538 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 46: vlan 1, p 0, ethertype ARP, Reply 192.168.0.60 is-at 00:1d:zy:xz:yx:dc, length 28 
     22600:16:29.301628 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 102: vlan 1, p 0, ethertype IPv4, 192.168.0.1 > 192.168.0.60: ICMP echo reply, id 3579, seq 1, length 64 
     22700:16:30.300170 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 102: vlan 1, p 0, ethertype IPv4, 192.168.0.60 > 192.168.0.1: ICMP echo request, id 3579, seq 2, length 64 
     22800:16:30.300407 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 102: vlan 1, p 0, ethertype IPv4, 192.168.0.1 > 192.168.0.60: ICMP echo reply, id 3579, seq 2, length 64 
     229}}} 
     230 
     231 == with Windows == 
     232 * Windowsは、NICのドライバが対応していないと、VLAN IDを解さないのでおかしなことになる 
     233 
     234 === untagged === 
     235 * Windows:NICのアドレス>192.168.0.102 
     236 
     237 * D:\tmp>ping 192.168.0.1 -n 2 
     238{{{ 
     239192.168.0.1 に ping を送信しています 32 バイトのデータ: 
     240192.168.0.1 からの応答: バイト数 =32 時間 <1ms TTL=64 
     241192.168.0.1 からの応答: バイト数 =32 時間 =1ms TTL=64 
     242 
     243192.168.0.1 の ping 統計: 
     244    パケット数: 送信 = 2、受信 = 2、損失 = 0 (0% の損失)、 
     245ラウンド トリップの概算時間 (ミリ秒): 
     246    最小 = 0ms、最大 = 1ms、平均 = 0ms 
     247}}} 
     248 * mitty@AG300H:~$ sudo tcpdump -n -e -i eth0 icmp or arp 
     249{{{ 
     25023:22:02.948026 1c:c1:zz:yy:xx:ww > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 78: vlan 1, p 0, ethertype IPv4, 192.168.0.102 > 192.168.0.1: ICMP echo request, id 1, seq 4079, length 40 
     25123:22:02.948193 00:24:xx:yy:zz:74 > 1c:c1:zz:yy:xx:ww, ethertype 802.1Q (0x8100), length 78: vlan 1, p 0, ethertype IPv4, 192.168.0.1 > 192.168.0.102: ICMP echo reply, id 1, seq 4079, length 40 
     25223:22:03.950631 1c:c1:zz:yy:xx:ww > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 78: vlan 1, p 0, ethertype IPv4, 192.168.0.102 > 192.168.0.1: ICMP echo request, id 1, seq 4080, length 40 
     25323:22:03.950753 00:24:xx:yy:zz:74 > 1c:c1:zz:yy:xx:ww, ethertype 802.1Q (0x8100), length 78: vlan 1, p 0, ethertype IPv4, 192.168.0.1 > 192.168.0.102: ICMP echo reply, id 1, seq 4080, length 40 
     254}}} 
     255 * D:\tmp>windump -i 3 -e -n icmp or arp 
     256{{{ 
     25723:22:02.869718 1c:c1:zz:yy:xx:ww > 00:24:xx:yy:zz:74, ethertype IPv4 (0x0800), length 74: 192.168.0.102 > 192.168.0.1: ICMP echo request, id 1, seq 4079, length 40 
     25823:22:02.869962 00:24:xx:yy:zz:74 > 1c:c1:zz:yy:xx:ww, ethertype IPv4 (0x0800), length 74: 192.168.0.1 > 192.168.0.102: ICMP echo reply, id 1, seq 4079, length 40 
     25923:22:03.872305 1c:c1:zz:yy:xx:ww > 00:24:xx:yy:zz:74, ethertype IPv4 (0x0800), length 74: 192.168.0.102 > 192.168.0.1: ICMP echo request, id 1, seq 4080, length 40 
     26023:22:03.872450 00:24:xx:yy:zz:74 > 1c:c1:zz:yy:xx:ww, ethertype IPv4 (0x0800), length 74: 192.168.0.1 > 192.168.0.102: ICMP echo reply, id 1, seq 4080, length 40 
     261}}} 
     262 
     263 * WZR-HP-AG300Hからすると、VLAN IDを付与して返信しているが、WindowsがVLAN IDを解さないので通信出来てしまう 
     264 
     265 === VLAN ID 2 === 
     266 * Windows:NICのアドレスを手動設定 -> 192.168.2.102 
     267 
     268 * Windowns -> WZR-HP-AG300H 
     269  * D:\tmp>ping 192.168.2.1 -n 2 
     270{{{ 
     271192.168.2.1 に ping を送信しています 32 バイトのデータ: 
     272192.168.2.102 からの応答: 宛先ホストに到達できません。 
     273192.168.2.102 からの応答: 宛先ホストに到達できません。 
     274 
     275192.168.2.1 の ping 統計: 
     276    パケット数: 送信 = 2、受信 = 2、損失 = 0 (0% の損失)、 
     277}}} 
     278  * mitty@AG300H:~$ sudo tcpdump -n -e -i eth0 icmp or arp 
     279{{{ 
     28023:32:20.640132 1c:c1:zz:yy:xx:ww > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP, Request who-has 192.168.2.1 tell 192.168.2.102, length 46 
     28123:32:21.257157 1c:c1:zz:yy:xx:ww > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP, Request who-has 192.168.2.1 tell 192.168.2.102, length 46 
     28223:32:22.257232 1c:c1:zz:yy:xx:ww > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP, Request who-has 192.168.2.1 tell 192.168.2.102, length 46 
     28323:32:23.260331 1c:c1:zz:yy:xx:ww > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP, Request who-has 192.168.2.1 tell 192.168.2.102, length 46 
     28423:32:24.257369 1c:c1:zz:yy:xx:ww > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP, Request who-has 192.168.2.1 tell 192.168.2.102, length 46 
     28523:32:25.257364 1c:c1:zz:yy:xx:ww > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP, Request who-has 192.168.2.1 tell 192.168.2.102, length 46 
     286}}} 
     287  * D:\tmp>windump -i 3 -e -n icmp or arp 
     288{{{ 
     28923:32:20.592232 1c:c1:zz:yy:xx:ww > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: arp who-has 192.168.2.1 tell 192.168.2.102 
     29023:32:21.209364 1c:c1:zz:yy:xx:ww > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: arp who-has 192.168.2.1 tell 192.168.2.102 
     29123:32:22.209380 1c:c1:zz:yy:xx:ww > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: arp who-has 192.168.2.1 tell 192.168.2.102 
     29223:32:23.212432 1c:c1:zz:yy:xx:ww > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: arp who-has 192.168.2.1 tell 192.168.2.102 
     29323:32:24.209411 1c:c1:zz:yy:xx:ww > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: arp who-has 192.168.2.1 tell 192.168.2.102 
     29423:32:25.209295 1c:c1:zz:yy:xx:ww > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: arp who-has 192.168.2.1 tell 192.168.2.102 
     295}}} 
     296  * Windowsから送出されるパケットにはVLAN IDが付与されないため、自動的にVLAN ID 1が付与される 
     297 
     298 * WZR-HP-AG300H -> Windows 
     299  * mitty@AG300H:~$ sudo ping 192.168.2.102 
     300{{{ 
     301PING 192.168.2.102 (192.168.2.102): 56 data bytes 
     302^C 
     303--- 192.168.2.102 ping statistics --- 
     30473 packets transmitted, 0 packets received, 100% packet loss 
     305}}} 
     306  * mitty@AG300H:~$ sudo tcpdump -n -e -i eth0 icmp or arp 
     307{{{ 
     30823:59:17.651760 00:24:xx:yy:zz:74 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 46: vlan 2, p 0, ethertype ARP, Request who-has 192.168.2.102 tell 192.168.2.1, length 28 
     30923:59:17.652365 1c:c1:zz:yy:xx:ww > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP, Reply 192.168.2.102 is-at 1c:c1:zz:yy:xx:ww, length 46 
     31023:59:18.651759 00:24:xx:yy:zz:74 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 46: vlan 2, p 0, ethertype ARP, Request who-has 192.168.2.102 tell 192.168.2.1, length 28 
     31123:59:18.652148 1c:c1:zz:yy:xx:ww > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP, Reply 192.168.2.102 is-at 1c:c1:zz:yy:xx:ww, length 46 
     312}}} 
     313  * D:\tmp>windump -i 3 -e -n icmp or arp 
     314{{{ 
     31523:59:17.646191 00:24:xx:yy:zz:74 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 56: arp who-has 192.168.2.102 tell 192.168.2.1 
     31623:59:17.646786 1c:c1:zz:yy:xx:ww > 00:24:xx:yy:zz:74, ethertype ARP (0x0806), length 42: arp reply 192.168.2.102 is-at 1c:c1:zz:yy:xx:ww 
     31723:59:18.645996 00:24:xx:yy:zz:74 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 56: arp who-has 192.168.2.102 tell 192.168.2.1 
     31823:59:18.646292 1c:c1:zz:yy:xx:ww > 00:24:xx:yy:zz:74, ethertype ARP (0x0806), length 42: arp reply 192.168.2.102 is-at 1c:c1:zz:yy:xx:ww 
     319}}} 
     320  * VLAN IDが抜け落ちるため、arpを受信出来てしまいreplyしているが、WZR-HP-AG300H側としてはVLAN ID 1のパケットとして届くので疎通出来ない 
     321 
     322 == how to solve == 
     323 * 先に述べたように、VLAN IDとして0を設定すればよい 
     324  * このとき、忘れずに{{{config interface 'lan'}}}を{{{option ifname 'eth0.0'}}}に変更する 
     325  * lan->wanで正常にNAPTされなくなる 
     326 * ただし、WebUIからはセット出来ないため、/etc/config/networkをvimなどで直接編集する必要がある[[br]][[Image(option-vlan-cant_be_0.png,33%)]] 
     327 
     328 * /etc/config/network 
     329{{{ 
     330config interface 'lan' 
     331        option ifname 'eth0.0' 
     332        option proto 'static' 
     333        option netmask '255.255.255.0' 
     334        option ipaddr '192.168.0.1' 
     335 
     336config interface 'vlan' 
     337        option ifname 'eth0.2' 
     338        option proto 'static' 
     339        option netmask '255.255.255.0' 
     340        option ipaddr '192.168.2.1' 
     341 
     342config switch 
     343        option name 'eth0' 
     344        option reset '1' 
     345        option enable_vlan '1' 
     346 
     347config switch_vlan 
     348        option device 'eth0' 
     349        option vlan '0' 
     350        option ports '0t 1 2 3 4' 
     351 
     352config switch_vlan 
     353        option device 'eth0' 
     354        option vlan '2' 
     355        option ports '0t 1t 2t 3t 4t' 
     356}}} 
     357  * 設定ファイルを直接編集することにより、VLAN IDを0にすることが可能(実際にはタグ無しパケットになる)[[br]][[Image(option-vlan-0.png,33%)]] 
     358  * ただし、WebUIからはそれ以降設定変更がが不能になる[[br]][[Image(option-vlan-0-_cant_be_saved.png,33%)]] 
     359  * (追記)vlan 0は{{{option ports '0 1 2 3 4'}}}でも良い[[br]][[Image(option-vlan-0-untagged.png,33%)]] 
     360 * mitty@AG300H:~$ ifconfig |egrep 'Link|addr' 
     361{{{ 
     362eth0      Link encap:Ethernet  HWaddr 00:24:XX:YY:ZZ:74 
     363          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0 
     364eth0.2    Link encap:Ethernet  HWaddr 00:24:XX:YY:ZZ:74 
     365          inet addr:192.168.2.1  Bcast:192.168.2.255  Mask:255.255.255.0 
     366}}} 
     367 
     368 === check connection with Linux node === 
     369 * root@Microknoppix:~# ifconfig |egrep 'Link|addr' 
     370{{{ 
     371eth1      Link encap:Ethernet  HWaddr 00:1d:zy:xz:yx:dc 
     372          inet addr:192.168.0.60  Bcast:192.168.0.255  Mask:255.255.255.0 
     373eth1.1    Link encap:Ethernet  HWaddr 00:1d:zy:xz:yx:dc 
     374eth1.2    Link encap:Ethernet  HWaddr 00:1d:zy:xz:yx:dc 
     375          inet addr:192.168.2.60  Bcast:192.168.2.255  Mask:255.255.255.0 
     376}}} 
     377 
     378 ==== untagged ==== 
     379 * root@Microknoppix:~# ping 192.168.0.1 -c 2 
     380{{{ 
     381PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data. 
     38264 bytes from 192.168.0.1: icmp_req=1 ttl=64 time=0.460 ms 
     38364 bytes from 192.168.0.1: icmp_req=2 ttl=64 time=0.289 ms 
     384 
     385--- 192.168.0.1 ping statistics --- 
     3862 packets transmitted, 2 received, 0% packet loss, time 999ms 
     387rtt min/avg/max/mdev = 0.289/0.374/0.460/0.087 ms 
     388}}} 
     389 * mitty@AG300H:~$ sudo tcpdump -n -e -i eth0 icmp or arp 
     390{{{ 
     39100:52:59.314253 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype IPv4 (0x0800), length 98: 192.168.0.60 > 192.168.0.1: ICMP echo request, id 3644, seq 1, length 64 
     39200:52:59.314476 00:24:xx:yy:zz:74 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.0.60 tell 192.168.0.1, length 28 
     39300:52:59.314579 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype ARP (0x0806), length 60: Reply 192.168.0.60 is-at 00:1d:zy:xz:yx:dc, length 46 
     39400:52:59.314600 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype IPv4 (0x0800), length 98: 192.168.0.1 > 192.168.0.60: ICMP echo reply, id 3644, seq 1, length 64 
     39500:53:00.313226 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype IPv4 (0x0800), length 98: 192.168.0.60 > 192.168.0.1: ICMP echo request, id 3644, seq 2, length 64 
     39600:53:00.313323 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype IPv4 (0x0800), length 98: 192.168.0.1 > 192.168.0.60: ICMP echo reply, id 3644, seq 2, length 64 
     39700:53:00.376869 00:24:xx:yy:zz:74 > 1c:c1:zz:yy:xx:ww, ethertype IPv4 (0x0800), length 148: 192.168.0.1 > 192.168.0.102: ICMP net 192.168.83.228 unreachable, 
     398}}} 
     399 
     400 ==== VLAN ID 2 ==== 
     401 * root@Microknoppix:~# ping 192.168.2.1 -c 2 
     402{{{ 
     403PING 192.168.2.1 (192.168.2.1) 56(84) bytes of data. 
     40464 bytes from 192.168.2.1: icmp_req=1 ttl=64 time=0.461 ms 
     40564 bytes from 192.168.2.1: icmp_req=2 ttl=64 time=0.357 ms 
     406 
     407--- 192.168.2.1 ping statistics --- 
     4082 packets transmitted, 2 received, 0% packet loss, time 999ms 
     409rtt min/avg/max/mdev = 0.357/0.409/0.461/0.052 ms 
     410}}} 
     411 * mitty@AG300H:~$ sudo tcpdump -n -e -i eth0 icmp or arp 
     412{{{ 
     41300:53:34.735856 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.2.60 > 192.168.2.1: ICMP echo request, id 3645, seq 1, length 64 
     41400:53:34.736074 00:24:xx:yy:zz:74 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 46: vlan 2, p 0, ethertype ARP, Request who-has 192.168.2.60 tell 192.168.2.1, length 28 
     41500:53:34.736175 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 64: vlan 2, p 0, ethertype ARP, Reply 192.168.2.60 is-at 00:1d:zy:xz:yx:dc, length 46 
     41600:53:34.736197 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.2.1 > 192.168.2.60: ICMP echo reply, id 3645, seq 1, length 64 
     41700:53:35.735528 00:1d:zy:xz:yx:dc > 00:24:xx:yy:zz:74, ethertype 802.1Q (0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.2.60 > 192.168.2.1: ICMP echo request, id 3645, seq 2, length 64 
     41800:53:35.735663 00:24:xx:yy:zz:74 > 00:1d:zy:xz:yx:dc, ethertype 802.1Q (0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.2.1 > 192.168.2.60: ICMP echo reply, id 3645, seq 2, length 64 
     419}}} 
     420 
     421 === check connection with Windows node === 
     422 * D:\tmp>ping 192.168.0.1 -n 2 
     423{{{ 
     424192.168.0.1 に ping を送信しています 32 バイトのデータ: 
     425192.168.0.1 からの応答: バイト数 =32 時間 <1ms TTL=64 
     426192.168.0.1 からの応答: バイト数 =32 時間 =1ms TTL=64 
     427 
     428192.168.0.1 の ping 統計: 
     429    パケット数: 送信 = 2、受信 = 2、損失 = 0 (0% の損失)、 
     430ラウンド トリップの概算時間 (ミリ秒): 
     431    最小 = 0ms、最大 = 1ms、平均 = 0ms 
     432}}} 
     433 * mitty@AG300H:~$ sudo tcpdump -n -e -i eth0 icmp or arp 
     434{{{ 
     43500:55:12.487241 1c:c1:zz:yy:xx:ww > 00:24:xx:yy:zz:74, ethertype IPv4 (0x0800), length 74: 192.168.0.102 > 192.168.0.1: ICMP echo request, id 1, seq 4106, length 40 
     43600:55:12.487393 00:24:xx:yy:zz:74 > 1c:c1:zz:yy:xx:ww, ethertype IPv4 (0x0800), length 74: 192.168.0.1 > 192.168.0.102: ICMP echo reply, id 1, seq 4106, length 40 
     43700:55:13.490727 1c:c1:zz:yy:xx:ww > 00:24:xx:yy:zz:74, ethertype IPv4 (0x0800), length 74: 192.168.0.102 > 192.168.0.1: ICMP echo request, id 1, seq 4107, length 40 
     43800:55:13.490841 00:24:xx:yy:zz:74 > 1c:c1:zz:yy:xx:ww, ethertype IPv4 (0x0800), length 74: 192.168.0.1 > 192.168.0.102: ICMP echo reply, id 1, seq 4107, length 40 
     439}}} 
     440 
     441 
     442 = Briding LAN to NTT-NGN with tagged VLAN = 
     443 * 目的 
     444  * eth1側のONU(NGN網)へ、eth0側のLAN配下のノードからL2で繋ぎたい 
     445  * 単純にeth0 <-> eth1でブリッジすると、LAN側のパケットがフィルタ無しでNGN網に飛ぶので推奨されない 
     446 * 方法 
     447  1. eth0 <-> eth1でブリッジして、br deviceをpppoeのifnameに書くのが一番楽 
     448   * PPPoEは{{{option ifname}}}をbr deviceのものに書き換えることで正常に動作するようになる 
     449  2. LAN <-> PPPoEとは別に、VLANデバイスを作成してそれをeth1とブリッジする 
     450   * 設定が煩雑 
     451 * firewall(iptables/ufw)の設定を失念していていると、疎通出来ずに混乱するので注意 
     452 
     453 * (元々の)構成 -> http://wiki.openwrt.org/toh/buffalo/wzr-hp-ag300h#network.port.assignments 
     454  * OpenWrt Attitude Adjustment 12.09 
     455  * eth0 -> LAN 
     456  * eth1 -> WAN(ONU) 
     457  * pppoe -> via eth1 
     458 
     459 == Bridging eth0 <-> eth1 directly == 
     460 * LAN側のパケットがフィルタ無しでONU側(NGN網)に飛ぶことに注意 
     461 
     462 * eth0 <- br -> eth1をブリッジした上で、pppdをbrデバイス上で動かす場合 
     463 * webUIからはpppoeの対象としてbrデバイスを選択出来ないため、設定ファイルを直接編集する必要がある 
     464 
     465 * AG300H:/etc/config/network 
     466{{{ 
     467config interface 'lan' 
     468       option ifname 'eth0 eth1' 
     469       option type 'bridge' 
     470       option proto 'static' 
     471       option netmask '255.255.255.0' 
     472       option ipaddr '192.168.0.1' 
     473 
     474config interface 'wan' 
     475       option ifname 'br-lan' 
     476       option proto 'pppoe' 
     477}}} 
     478 * mitty@AG300H:~$ ifconfig -a| grep addr 
     479{{{ 
     480br-lan    Link encap:Ethernet  HWaddr 00:24:XX:YY:ZZ:74 
     481          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0 
     482eth0      Link encap:Ethernet  HWaddr 00:24:XX:YY:ZZ:74 
     483eth1      Link encap:Ethernet  HWaddr 00:24:XX:YY:ZZ:76 
     484lo        Link encap:Local Loopback 
     485          inet addr:127.0.0.1  Mask:255.0.0.0 
     486pppoe-wan Link encap:Point-to-Point Protocol 
     487          inet addr:114.159.70.188  P-t-P:118.23.8.36  Mask:255.255.255.255 
     488}}} 
     489 * mitty@AG300H:~$ brctl show 
     490{{{ 
     491bridge name     bridge id               STP enabled     interfaces 
     492br-lan          8000.0024xxyyzz74       no              eth0 
     493                                                        eth1 
     494}}}