Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to set up a VLAN on my Netgear switch (GS105E). I want to create two separate networks and I want both of them have internet access.

My setup is 

    modem
    connected to
    router  WRT54G (with dd-wrt)
    connected to
    Netgear switch  

I have configured port 1 and port 5 as vlan1 and port 2 to port 4 as vlan2. I plugged a cable from the router to port 5, and the computer on port 1 has internet access. However, the computers on port 2 to port 4 have no internet access. Have I done something wrong?

p.s.: I had tried to create VLANs with the router but had no luck, so I decided to use a switch to do the job.

share|improve this question

migrated from serverfault.com Feb 24 '12 at 4:54

This question came from our site for professional system and network administrators.

add comment

3 Answers

up vote 1 down vote accepted

In a comment on another Answer to this Question, you said, "Also, when I tried to setup vlan in my router, everything worked great except vlan2 computer could only open certain websites."

This is a tipoff that your router may have been doing VLANs in software instead of hardware.

Ethernet hardware that doesn't know about VLANs (before 802.3ac and 802.1Q) expects the maximum frame size to be 1518 bytes (1500 byte payload, plus 14 bytes of header and 4 bytes of CRC checksum trailer). But the VLAN header is 4 bytes, so to keep the same 1500 byte max payload most higher-layer protocols expect Ethernets to be capable of, the maximum Ethernet frame size was extended to 1522 bytes in 802.3ac (now part of 802.3-2008). But many OSes realized you could do VLANs in software on the host even if you don't have VLAN-aware hardware, but you had to shrink the payload size (the IP MTU) to 1496 instead of 1500 to make room for 4-byte VLAN header when using old hardware that could only handle 1518-byte frames.

So! A workaround to the problem that drove you crazy for two days might have been to adjust the MTUs on all of your machines on VLAN 2 (including your router) to use 1496 instead of 1500, since it sounds like your router was doing VLANs in software.

What would have been happening when loading some websites is that either the web browser or the web server tried to send a max-Ethernet-payload-sized 1500-byte IP datagram, but that would have needed to become a 1522-byte Ethernet frame, which your router's hardware couldn't handle, so it got dropped. Sites that could be loaded without requiring any 1500+ -byte IP datagrams to be sent or received (including sites that use lower MTUs or sites where Path MTU Discovery was working well) would still load fine.

share|improve this answer
    
Thanks for the reply. I did adjust my MTU from 1500 all the way to 1462 and still no luck. VERY SAD :( –  Rouge Feb 24 '12 at 13:57
    
@Rouge If you tried my MTU suggestion and it didn't work, I think maybe you shouldn't have accepted my answer as correct. –  Spiff Feb 27 '12 at 22:20
add comment

Sounds right to me. YOu've got ports 2 and 4 on their own vLAN, so yeah, they'll act like their connected to a separate switch (one that isn't connected to any of the other ports, that's what vLANs do).

If you want everything to have Internet access then they'll all have to be connected to the router. This should make sense. So you need both vLANs connected to the router. You can do this two ways:

  1. Two physical connections from the router, one to each vLAN.
  2. Use a single port that has both vLANs connected in Tagged configuration instead of untagged (which is what you use for "normal" ports, but a port can have at most one "untagged" vlan). If you do this, the router would have to be programmed to understand the tagged vLAN packets it's receiving, they're not long "normal" packets.

Also, you mention that you tried something to separate the LANs already but failed. I'm guessing you did something to separate them, but the router wasn't programmed with any sort of access control to prevent the two networks from talking to each other. If you do the above and the router still doesn't have any access control then you'll probably end up in the same situation.

Also, you need to use two different IP subnets, one for each of the vLANs. You can not use the same subnet on both. For instance you could use 192.168.1.0/24 on one, and 192.168.2.0/24 on the other.

share|improve this answer
    
thanks for the quick reply Chris. I did try to plug 2 physical cables from the router to port 5 and port 4 so vlan1 and vlan2 both have internet access. However, there is no separated networks anymore. port 1 computer can access port 2 computer. I know I need to have 2 subnets for vlans but I didn't know how to set them up. The switch utility can only allow 1 subnet and router can only allow 1 subnet too (and they have to be the same or switch utility will tell me that the router and the switch are not in the same subnet) –  Rouge Feb 24 '12 at 3:32
    
Also, when I tried to setup vlan in my router, everything worked great except vlan2 computer could only open certain websites. I have spend two days trying to fix it but no luck. These things really drive me crazy. –  Rouge Feb 24 '12 at 3:34
    
Switches don't care about subnets. There wasn't any question in there, you must have separate subnets for this sort of setup (barring really exotic configurations). If you've spent two whole days on this you're spending too much, time to hire someone who can setup your network. If this isn't for a business, then Server Fault is the wrong Stack Exchange site, this should be migrated to Super User. –  Chris S Feb 24 '12 at 3:37
    
Thank you Chris. I assume I have to setup 2 subnets in the router? Would you please migrate this post to super user for me. My brain is not working now. thanks. –  Rouge Feb 24 '12 at 3:46
add comment

You need to start DHCP and DNS on vlan2, and obviously allow forwarding and NAT for that vlan2.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.