# WAN with VLAN ID



## rendoe (Jan 19, 2018)

Hi,

Apologize if my question is not appropriate on this sub forum.
..
I have broadband connection with provided modem/router Huawei HG8245H (ONT) and I would need to change it from router mode to bridge mode because I want to use my own router Netgear FVS318G to do some VLANs to the network.

When I see in the modem's WAN setting, there's VLAN there (2416) and I've tried to change it to bridge mode but the Netgear router didn't resolve IP. Does this mean the Netgear router should be in the same VLAN? If so, in the WAN port don't have VLAN setting there.

Thanks beforehand for the help.


----------



## tristar (Aug 12, 2008)

So if your connection setup would be Huawei--Netgear--all connections..

Grab an IP from the Huawei scope assign it as static to the Netgear MAC address and exclude from scope (just in case), assign it as the incoming address for Netgear and make all configuration changes on Netgear.


----------



## rendoe (Jan 19, 2018)

Thanks for your reply tristar,

Yes, that would be my topology. I had setup as per your suggestion but that would be a double NAT which I want to avoid that as the network experiencing a slowdown. I've tested direct connect from Huawei I can get 300 mbps but behind Netgear I only get 60 mbps.



tristar said:


> So if your connection setup would be Huawei--Netgear--all connections..
> 
> Grab an IP from the Huawei scope assign it as static to the Netgear MAC address and exclude from scope (just in case), assign it as the incoming address for Netgear and make all configuration changes on Netgear.


----------



## tristar (Aug 12, 2008)

Any chance you have a QOS/Bandwidth allocation setup ?

Also, you can disable the DHCP server on the Huawei and it will act as an access point rather than doing any NAT.


----------



## rendoe (Jan 19, 2018)

Nope, QoS not enabled, I also open all firewalls. The NAT I'm referring to is from public IP from ISP to the LAN in Huawei and NAT from Huawei to Netgear (WAN) to Netgear (LAN). Thus the local PCs see it as double NAT.
It's because I have several server including NAS that gives me warning about double NAT and I need to do some VLANing for accessing the NAS as well as other server.



tristar said:


> Any chance you have a QOS/Bandwidth allocation setup ?
> 
> Also, you can disable the DHCP server on the Huawei and it will act as an access point rather than doing any NAT.


----------



## tristar (Aug 12, 2008)

If you disable Gateway mode on your router, should fall back to AP mode, in which case it only relays the connection.

Ok, you would want to setup Bridged mode in the WAN setup on your Huawei if you want to avoid the double NAT.

Also, to clarify, all NATs would be performed only from the NetGear, there would be no requirement for any device except the NetGear to connect to the Huawei ?


----------



## tristar (Aug 12, 2008)

Apologies, looks like you've tried setting it up in Bridged mode, but can't seem to get it to work ?

Are you connecting the router WAN input from the 1st LAN port of the Huawei ? Also, as a test to avoid conflicts, I'd disable the WLAN temporarily to test.


----------



## rendoe (Jan 19, 2018)

Yes, I've successfully change the Huawei router to bridge mode and my Netgear router already got the public IP address & isp dns. And already set dhcp per VLAN and client already got IP and their status is online (In Windows 10 no more exclamation). AD, NAS and all internal server is reachable by all clients. I've checked all VLAN members.

But the funny thing is that client can't browse to internet, although client can lookup to all well-known websites, and also can ping to known public dns such as 8.8.8.8. All servers also have difficulties to go online.

I have no proxy server implemented and all firewall open. I still don't get it where's the problem might be.

Does this problem relates to my ISP? They said everything's normal.



tristar said:


> Apologies, looks like you've tried setting it up in Bridged mode, but can't seem to get it to work ?
> 
> Are you connecting the router WAN input from the 1st LAN port of the Huawei ? Also, as a test to avoid conflicts, I'd disable the WLAN temporarily to test.


----------



## tristar (Aug 12, 2008)

DNS ip displayed in Netgear is the ISP DNS, per the first line of your comment, correct ?

From an endpoint, what is the DNS server that is listed per ipconfig /all ?

And are you able to ping the ISP DNS specified on the Huawei router from an edn point ?


----------



## rendoe (Jan 19, 2018)

Yes, correct.

DNS on endpoint is AD DNS (forward policy: Forward First to ISP DNS) DHCP server is on Netgear and I specify the AD DNS there.

I can ping ISP DNS from end point.



tristar said:


> DNS ip displayed in Netgear is the ISP DNS, per the first line of your comment, correct ?
> 
> From an endpoint, what is the DNS server that is listed per ipconfig /all ?
> 
> And are you able to ping the ISP DNS specified on the Huawei router from an edn point ?


----------



## tristar (Aug 12, 2008)

This must be dumb coming in at this point, but is the default Gateway of the end point set to the NetGear IP ?

If you force the ISP DNS on an end point (Obtain DNS set to ISP DNS static), are you able to browse the internet ?


----------



## rendoe (Jan 19, 2018)

Yes, getaway points to Netgear per VLAN gateway.

I've tried that but still can go to internet. But I've tried using my laptop behind Netgear and seems all services such as google drive file stream says online and can sync files. Does this mean my ISP blocking http port due ti bridge mode? I've cloned MAC address of Huawei in WAN profile to Netgear, thus I've able to get the public IP.



tristar said:


> This must be dumb coming in at this point, but is the default Gateway of the end point set to the NetGear IP ?
> 
> If you force the ISP DNS on an end point (Obtain DNS set to ISP DNS static), are you able to browse the internet ?


----------



## tristar (Aug 12, 2008)

Nope, afaik, this is an internal DNS issue, if you connect any endpoint directly to the Huawei and you're able to access the Internet, it's not an ISP issue.

Do you have DCs configured ?


----------



## rendoe (Jan 19, 2018)

I'll try using my pc direct to Huawei, see if I can replicate the problem, otherwise have to look internal DNS problem as you pointed out.



tristar said:


> Nope, afaik, this is an internal DNS issue, if you connect any endpoint directly to the Huawei and you're able to access the Internet, it's not an ISP issue.


----------



## tristar (Aug 12, 2008)

Do you have Domain controllers ? and DNS servers in the environment ? since you have AD setup.


----------



## rendoe (Jan 19, 2018)

Yes, DC and DNS.



tristar said:


> Do you have Domain controllers ? and DNS servers in the environment ? since you have AD setup.


----------



## rendoe (Jan 19, 2018)

On second thought, I don't think there's local problem, since if I use double NAT, everything's ok, but internet throughput is bad, like I said earlier.


----------



## tristar (Aug 12, 2008)

DNS server automatically grabs your DNS server IP ?

What happens if you force google DNS on any end point ?


----------



## rendoe (Jan 19, 2018)

No, I manually specified in DNS server with forward policy to ISP DNS. Tried to change to google dns as well. Because client have to have AD DNS otherwise can't join domain right.

Like I said, I've tried using google dns on random machines, nothing happens, although they can ping it.



tristar said:


> DNS server automatically grabs your DNS server IP ?
> 
> What happens if you force google DNS on any end point ?


----------



## tristar (Aug 12, 2008)

Test this, set the DNS IP to be your DC IP and see what happens ?


----------



## rendoe (Jan 19, 2018)

Yes already, DNS IP = DC IP.



tristar said:


> Test this, set the DNS IP to be your DC IP and see what happens ?


----------



## tristar (Aug 12, 2008)

Sorry, had to rush out the door yesterday and couldn't respond, I was trying to find out if the DNS is configured on the DC, so that answers it.

Is reverse lookup also configured ?


----------



## rendoe (Jan 19, 2018)

No worries, I thank you for your time.
Yes reverse lookup also already configured.
Today I want to try it again, this time I’ve called ISP tech to visit and they can see it themselves. Will post the result here.



tristar said:


> Sorry, had to rush out the door yesterday and couldn't respond, I was trying to find out if the DNS is configured on the DC, so that answers it.
> 
> Is reverse lookup also configured ?


----------



## tristar (Aug 12, 2008)

The ISP tech might be able to fix stuff, but I still think it's internal to the setup, he would connect an endpoint to the Huawei and if it works, his scope pretty much ends there.

What are the results of nslookup -ls does it provide the correct info ?


----------



## rendoe (Jan 19, 2018)

Hi,

Just give ya update that I'm still unable to make the modem as bridge mode, currently I'm still using the double nat scenario plus tweaking here and there I got decent throughput from 60mb/s to now about 200-250mb/s to internet. Dunno if it's related or not, I've installed dnscypt points to opendns.

I guess I have to live this way for now. As for webservers and vpns, I placed another NIC to the AD pointed to directly to the Huawei instead to Netgear to overcome the resolving issues of port-forwarding.

The ISP tech came and he said the bridge mode should work, but he also witnessed that it didn't. But the tech said also that recently there's an internal change of their dns routing.


----------



## masch1na (Feb 28, 2018)

Hello rendoe, 

I've been working on similar issue at a friends house and ISP is the one to change your modem from route to bridge mode. I had to put in the request over the phone and it took couple of days to have it in affect. 

What ISP do you have?


----------

