SDMark wrote:
Under Basic Settings for the System, I have the System Gateway set to the .2.1, the LAN side of R1. There's one static router to R1's LAN port, and 3 "connected" routes. I setup DHCP rules for each subnet, LAN, DMZ and WAP. There are WAN_IN and WAN_LOCAL Firewall/NAT rulesets, each with two rules, although I'm not clear on who does what to whom, or exactly what "local" means. I think it's whatever's on switch0? Am I missing a WAN_OUT?
The "_IN" chain is for packets entering a given interface, and then destined for another interface (e.g. from eth0 / WAN to eth1 / LAN1)
The "_LOCAL" chain is for packets destined for the router itself.
The "_OUT" chain is for packets leaving a given interface.
Any "missing" chain defaults to allow -- so your setup right now allows all packets to enter any of the "LAN" ports and exit the WAN (or the LAN can talk to the router, or anything can exit to the WAN).
SDMark wrote:Using the EdgeMAX / private NIC only, Windows tells me I don't have Internet connectivity. I can't ping eth0 as 192.168.2.101. I get "PING: transmit failed. General failure.". So of course, I can't ping the router's LAN port at 2.1 or get out into the big bad world.
You should be able to ping the router at 192.168.1.1 from your Win box.
Can the ER ping its gateway (192.168.2.1)?
Also, you don't need to statically set the gateway (under system) because the router will be getting all of that info from DHCP on eth0.