Host Red nic = Astaro eth0 > External (WAN) (DHCP - Cable Moden)
Host Green nic = Astaro eth1 > Internal (192.168.100.20)
Host Purple nic = Astaro eth2 > Wireless router NIC (192.168.1.20)
The purpose of this set up is to isolate the house's wireless network from our wired home domain network.
The problem is the Internal network (eth1) and Wireless Router NIC (eth2) can connect to each other. From 192.168.100.x you can successfully ping devices on 192.168.1.x (and vice versa).
It's not just pings that get through. From a stand alone pc on the Internal network (eth1) at 192.168.100.x, you can connect to the webGUI configuration page of a wireless router on the Wireless Router network (eth2) at 192.168.1.x.
The astaro is configured to allow pings to and through it.
This seems to be an astaro problem and not a hyper-v issue. If the astaro guest is shut down, you can not longer ping from network to network. Once the astaro is started, you can ping from network to network.
Set up is:
NAT masquerading:
Internal (Network) > External (WAN)
Wireless router NIC (Network) > External (WAN)
Firewall rules:
Internal (Network) > DNS > any [ALLOW]
Internal (Network) > web surfing > any [ALLOW]
Wireless router NIC (Network) > DNS > any [ALLOW]
Wireless router NIC (Network) > web surfing > any [ALLOW]
DNS (should not matter since pings connect)
Allowed networks:
Internal (network)
Wireless router NIC (Network)
Forwarders:
208.67.222.222 (OpenDNS)
208.67.220.220 (OpenDNS2)
DHCP:
Wireless router NIC [Range 192.168.1.179 through 192.168.1.199]
Internal [Range 192.168.100.171 through 192.168.100.199]
To try to isolate Wireless router NIC network (eth2) from the Internal network (eth1) I tried two seperate things (one at a time and not together)
Firewall rules:
Wireless router NIC (Network) > DNS > External (Network)
Wireless router NIC (Network) > web surfing > External (Network)
This stopped internet connectivity from the Wireless router NIC.
Another change tried was to add a Firewall rule before the Wireelss router NIC (network rules). It was:
Wireless router NIC (Network) > any > Internal (Network) [DROP]
Wireless router NIC (Network) > DNS > any [ALLOW]
Wireless router NIC (Network) > web surfing > any [ALLOW]
That firewall rule mostly, but did not completely block pings from Wireless router NIC (eth2) to Internal (eth1).
Logging was enabled for the DROP rule and Live Log was opened. Each time the ping came back as no response the log showed the rule being enforced and the connection attempt dropped. However, occasionally the ping would result in a live connection. When that happened, there was no drop rule showing up.
Any help in isolating these two networks would be appreciated. I feel like I'm just not getting something very basic. Thank you.
Bob
This thread was automatically locked due to age.
