Subject: Forwarding issue
To: None <netbsd-users@netbsd.org>
From: Peter Eisch <peter@boku.net>
List: netbsd-users
Date: 11/15/2007 12:55:20
3.1.x system, i386 if it matters, with six network interfaces (2 bge, 4 wm).
There are 60 vlan interfaces (across 1 bge & 3 wm) which fold down to 15
bridges with a tap for each bridge.  There's some ipnat, some ipfilter, some
altq and otherwise a typical router.  Everything works great, has for weeks,
except... 

I have an address on bge0 (ipf passes all in & out) and the router can talk
to everything on the LAN (let's call LAN-A) off bge0.  If I try to connect
to a system on LAN-A from any system on the other interfaces, the packets
never get forwarded out bge0.  For inbound traffic off LAN-A to any system
other than the router I see the packets when tracing bge0 but they never get
forwarded out any of the other interfaces.

It's as though ip-forward is off for that one interface.

The 'netstat -rn' looks right, there are no rules that prohibit any traffic
between the LANs, and all the masks and subnets check out.

      C-|
 B--|   |   |---A (bge0)
    |---R---|
        |
        |---Internet (wm2)

  B & C are off bridged vlans and can access the Internet just fine through
R.  R can talk to everything on the LAN common to A as well as everything
else internal and public.  Neither B nor C can connect to A and A can
connect to neither B nor C.  Traffic between B & C flows fine as well.

I even tried putting R's address on the LAN common with A into a bridge with
a vlan, but it still refused to forward.  The networks for each segment are
B = 10.1.100.0/24; C = 10.1.200.0/24; A = 10.0.101.0/24.  There are other
10's like B & C but they're no more special and everything except the
Internet uses a /24 mask.

bge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        capabilities=7<IP4CSUM,TCP4CSUM,UDP4CSUM>
        enabled=7<IP4CSUM,TCP4CSUM,UDP4CSUM>
        address: 00:06:5b:fd:a0:28
        media: Ethernet autoselect (1000baseT
full-duplex,flowcontrol,rxpause,txpause)
        status: active
        inet 10.0.101.60 netmask 0xffffff00 broadcast 10.0.101.255
        inet6 fe80::206:5bff:fefd:a028%bge0 prefixlen 64 scopeid 0x1

I'm open to any and all thoughts, ideas, ridicule or encouragement.

Thank you,

peter