Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 2 Linksys WRT54GL routers flashed with DD-WRT. On each I have a different ISP, and thus a different private network. I would like to be able to talk to either network regardless of what network I am on.

Example:

ISP1 -> Router1 -> Client

ISP2 -> Router2 -> Client

What I would like to do is something like:

ISP1 -> Router1 -> Client
             ^
             |
             v
ISP2 -> Router2 -> Client

This would be ideally because then I don't need to introduce another device in the mix, unless I have to.

But I guess the first question is - is this even possible?

Edit: Both routers are in the same office right next to each other.

share|improve this question
2  
To clarify, is there some reason why you can't place both routers' private interfaces on the same private network? If you assign private IP addresses to both routers with the same subnet mask and prefix (e.g., 192.168.1.1 and 192.168.1.2), you can just plug their private Ethernet ports into each other or a common switch. Other hosts on the same subnet can set their default gateways to either router's private IP. (You'll have to disable the DHCP server on one of the routers, too, BTW.) –  Ryan B. Lynch May 7 '10 at 0:57
1  
Also to clarify: Do you want the hosts on your private network(s) to be able to use both ISPs, at the same time? If so, you'll need to look into policy based routing, also known as "multiple ISP" support. OpenWRT supports this, as does the Shorewall IPTables manager, so I suspect DD-WRT does, too. –  Ryan B. Lynch May 7 '10 at 1:01
    
Please clarify your question. Are you wanting to implement a redundant WAN interface or are you connecting two offices together. –  Matt May 7 '10 at 1:45
    
@Ryan B. Lynch: I would like each network to be as it is, but able to communicate. ie Router1 is 192.168.1.x and router2 is 192.168.2.x, from 192.168.1.10 I want to ping 192.168.2.1. @Matt: I guess you could say I am connecting 2 offices together, but they are in the same location. (2 ISPs at the same location). –  Nathan Adams May 7 '10 at 2:34
add comment

3 Answers

up vote 1 down vote accepted

If you cannot combine the two subnets, you'll need to route between them, somehow. Matt's VPN suggestion is one possibility, but I don't think it's the easiest or most efficient way route traffic between the two networks. You must have some sort of routed connection between the two networks, though there are several possible alternatives.

My first suggestion is to connect both of the existing networks together across a 3rd router. This new router could be any Windows or Linux machine with an extra NIC, or another LAN router like the WRT54G (with NAT and firewall "deny" rules disabled). Then, on each of your existing DD-WRT routers, you would configure a static route to the opposite network via the 3rd router. This seems easiest, to me, because you don't have to mess around with VPNs or any complex IP configurations on your existing routers. The downside is that you'd have to set up that 3rd router, but that's really easy.

My second suggestion is to route via your existing routers interfaces. It's more more complex, but it will save you from having to deploy a new router. It won't work if either router configures its public IP address using DHCP (from your ISP's equipment, or otherwise), and it requires an extra Ethernet switch.

  • Reconnect the Ethernet interfaces of both of your ISPs' equipment, and both of your existing DD-WRT routers (the EXTERNAL, PUBLIC side), into the new switch. You should still have normal Internet connectivity from each DD-WRT up through its respective ISP connection.
  • Pick a new, private IP subnet with at least two usable addresses, that doesn't conflict with either of your existing private networks. If your existing networks use 192.168.1.0/255.255.255.0 and 192.168.2.0/255.255.255.0, you could just use 192.168.3.0/255.255.255.0 for the new subnet.
  • On each router's external interface, add (alias) a unique IP from that new subnet. If you went along with my suggested numbering, you could use 192.168.3.1 for one router, and 192.168.3.2 for the other. (These new IPs are in addition to the existing external addresses.)
  • Add a static route to each router, pointing to the opposite router's original private network, via the opposite router's new external-but-privately-numbered IP address.
  • Adjust the firewall rules and NAT settings on your DD-WRT routers as needed to allow traffic to/from the original private networks to leave via the public interfaces.

There is one more little downside to this second suggestion: If somebody compromised your ISP's equipment attached to that new Ethernet switch, they might be able to sniff the traffic between the two networks. It's not a very likely threat, but it's something to understand if you go this direction. A more secure variation would be to employ the same technique on your routers' internal interfaces. But this won't work if you need DHCP services on both private networks.

Now, personally, I don't think either of these two suggestions is particularly elegant. But I think they're both relatively simple to understand and configure. So depending on your technical comfort level, they might work for you. But there are some other techniques that could apply:

  • A VLAN: If your DD-WRT routers support 802.1q VLANs, and you have a managed Ethernet switch that does, too, then you can create an extra virtual interface on each router. This would be pretty clean, but I didn't get the impression that you'd be technically comfortable with understanding and configuring VLANs.
  • A VPN: Re-iterating what another poster said, you can create a virtual interface between the two networks with (e.g.) OpenVPN, and router through VPN interface. Again, I got the feeling that the VPN configuration stuff might be a bit heavy. But if you're up to trying it, it's a pretty sound way of dealing with issues like this.

BUT... Realize that all of these routed setups (these two, plus Matt's VPN suggestion) are more complex, harder to set up, and less efficient than just bridging the two networks. I understand that re-configuring IP addresses, DNS hostnames, etc. on a network can be a pain, and that there are potential security/privacy issues, but I would really push for that option.

I'm sorry if my reiterating that last part offends, BTW. I believe that you probably have a perfectly valid reason for why you can't bridge the existing networks. But since all of the routed options are more complex, the issue is whether you're going to be technically comfortable with them.

How do you feel about the relative technical challenges, here, anyway?

share|improve this answer
add comment
  • Choose a common subnet for your internal network and set it up on both routers.
    • Assign one of the routers n.n.n.1
    • Assign the other router n.n.n.2
  • Connect a LAN port of the two routers together.
  • Disable DHCP on one or both routers
  • Set the default gateway of the clients based on which ISP you wish to use.
share|improve this answer
add comment

Sounds like you want a VPN tunnel.

Here is the wiki page on how to set this up. http://www.dd-wrt.com/wiki/index.php/OpenVPN_-_Site-to-Site_routed_VPN_between_two_routers

You'll want to make sure that when looking at the network at the other location, it forwards through the tunnel. But when browsing internet traffic, it doesn't pass through the tunnel (uses locally connected ISP).

EDIT: Alternatively, if you're saying that both routers are on the same network segment in the same office then follow this guide. http://www.roadrunnerguide.com/dualwan.html

share|improve this answer
    
Sorry I think you need to update your question. Are you saying you have two routers housed in the same office or two office connected to two different ISP's? I don't understand why I was voted down here. –  Matt May 7 '10 at 1:42
    
Both routers are in the same office. And I don't know why you were voted down. –  Nathan Adams May 7 '10 at 2:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.