-2

I've 3 devices where for some reasons I cannot change their default gateway and neither their ip and netmask.

All the devices has the following ip: 169.254.11.22 and netmask 255.255.255.0

I want to put a router for each client to "change" their visible ip address and then forward the port 80 of the router to port 80 of the internal client.

Actually that solution doesn't work because I cannot set the client gateway.

Does exists a device or some software to install on ddwrt routers that allow me to force the gateway of the traffic generated by the clients?

The only solution I've found by now is to estabilish an ssh tunnel and the forward the ports but that cannot be a solution to be used in a production environment..

Improve this question
2
  • "I cannot their default gateway and neither their ip and netmask" what exactly you can't? You can't change their ip settings or what?
    – ALex_hha
    Mar 17, 2016 at 17:21
  • yes, I've edited my question
    – Andrea Cattaneo
    Mar 17, 2016 at 17:36

2 Answers 2

Reset to default
0

169.254.0.0/16 is the address range that is used for link-local networking. The reason you are on this network is because you do not have a DHCP server allocating IP addresses.

Get yourself a DHCP server onto that network, reset those device's network connections, and you should have yourself a working network.

It is not valid to route the 169.254.0.0/16 network, so you need to get off that network.

Improve this answer
4
  • Unfortunately that ip address was assigned by the manufacturer of the client by default. I cannot change it.It is a manual ip address and it works as expected if I'm on the same subnet.
    – Andrea Cattaneo
    Mar 17, 2016 at 17:38
  • @AndreaCattaneo What devices are these? Your manufacturer is wrong to do this. You need to go back to them, because there is no way to do what you are asking otherwise.
    – Mark Henderson
    Mar 17, 2016 at 17:39
  • They're Siemens Simotion PLC. The only way to change the ip is by changing their software, but I cannot do it because they're in a production environment. Anyway I have the same problem also if I had another ip without gateway. Someone told me that a "reverse proxy" should do the job but I don't know what is it
    – Andrea Cattaneo
    Mar 17, 2016 at 17:41
  • @AndreaCattaneo Ok, I understand now. A PLC has no business being on a large network or exposed to the internet in any way. They often have very little security and keeping them air gapped is one security measure employed to try and keep them safe (with limited success). Now I have to really reinforce that you need to talk to your manufacturer (or supplier or whoever) in order to do what you want to do. There really is nothing you can do about it in its current state (especially in production).
    – Mark Henderson
    Mar 17, 2016 at 17:44
0

If you control the target IP-addresses of the clients, then you can implement Destination Network Address Translation (DNAT) with iptables on the routers in front of the PLC.

Then you can build a table with net-local addresses translated to the target addresses. (eg. 169.254.11.23 -> 192.168.0.2 or 169.254.11.24 -> 8.8.8.8)

Otherwise the clients don't even try to sent any packet, because they have no route. Maybe you are able to set a fixed host route to any target (but that seems to be unlikely since then you are mostly also able to set the standard gateway).

But as others said, this boxes are not intended for such things.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .