inter vlan routing

hi,

sorry for disturbing you. I got a problem with linux and vlans. Would be
great if you could give me some hints so that I can solve my problem.

I want to secure my internal network with linux firewalling using
content filtering. This works - of course - great if i stay in the world
"of layer 3". But if i want to rape my linux box so that the box acts
like a switch it does not work. it is possible for me to configure some
kind of "inter vlan routing" but what i need is "inter vlan switching".

an example:
i got two cisco switches in every location offering lots of vlan (w-lan
for voice over ip, w-lan for data, printer stuff, citrix stuff ...).
these switches are communicating with a big cisco catalyst in the main
data center (we got two of them). I want to secure the traffic between
the two switches using linux + content filtering + iptables ... but i am
too stupid to make the switches communicate through the linux box. i can
communicate trough vlans with the linux box. but i can not communicate
with the switch at the other side. i guess this is because the box does
not send the packets for certain vlans to all physical interfaces having
configured the sender (same) vlan (only two one ... maybe the box wants
to route ?)...

would be great if you´d got some ressources for me to solve my problem
--> learn how to build a linux switch.

thx i advance

joe

joe wrote:

> I want to secure the traffic between
> the two switches using linux + content filtering + iptables

I don't quite understand this. Are you trying to move packets from a port
in VLAN 1 on switch A to a port on VLAN 1 on switch B? Why not just have a
trunk between the two switches? A VLAN should be a security domain, so
"filtering" wouldn't play a part in its communication.

If you want to filter traffic between two ports, they should be on separate
VLANs. This means "routing", which gives you a point at which you can
insert your Linux box and its ability to filter.


How many ethernet ports do you have on your Linux machine? Are they
configured as trucks? If so, then I'm not sure how you can convince the
Linux machine to retransmit a packet from VLAN 1 to VLAN 1. That would
seem to be a Bad Thing, in fact, in that you could cause packet loops.

- Andrew