Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have our office LAN. In this LAN a small amount of computers has a separate lan that can comunicate with the main one but not vice versa.

Big lan is like 10.0.0.x and the small separated one is 192.168.1.x

This result has been achieved using 2 routers 3com... The previous sysadmin lost routers' passwords and we have to change dns and gateway so probably I'll be forced to hard reset the routers. Which kind of solution can be used to obtain the result to separate the networks again after the reset?

I thought: the 192.168.1.x router should have as a gateway the 10.0.0.x one but... Is this enough to let the 192.168.1.x reach the 10.0.0.x computers and not vice versa?

Thanks a lot for your time :)

share|improve this question

5 Answers 5

up vote 0 down vote accepted

One possibility to consider: Is your small 192.x network being NAT-ed onto the 10.x network? To ask the same question in another way: When clients on the 192.x network access hosts on the 10.x network, do the 10.x hosts see connections coming from a 192.x address, or from a 10.x address? If the former, then you are not doing NAT; if the latter, you are.

I ask this question because what you describe is consistent with plugging the WAN port of a typical consumer/SOHO-grade NAT/firewall router appliance into your existing 10.x network; the LAN ports of that appliance would then be your 192.x network.

Anyway, you need to further investigate your LAN topology and routing. Since you don't have access to the routers themselves, have a look at the networking config and routing tables of some typical hosts on each network. Those should give you a lot of useful information (e.g. network mask, default gateway, DNS servers).

share|improve this answer

It really depends on what you mean by "not communicate". If you are asking what I think you are (that is "how can I have routing between two LANs, A and B, so computers in A can initiate sessions to computers in B, but computers in B are unable to initiate sessions to computers in A"), you'll need a router with some sort of access-list capability, to disallow computers from "the big LAN" to initiate sessions to computers "in the small LAN".

On Cisco kit, this is usually done by allowing "established"-state packets from B to A, and (optionally) deny packets from B to A (the allow rule MUST come before the deny).

Normally, you're wanting packets both ways, to allow responses to be sent back, not having routing from B to A would (to some extent) mean "no traffic from B to A", but it would not allow any TCP-based communication and be truly one-way, in that packets could leave A but not come back.

share|improve this answer

Instead of resetting the routers why not reset the passwords? Do your model 3COM routers have a password reset function that won't wipe out the config? My suggestion would be to pursue that line before wiping out the routers and starting from scratch.

share|improve this answer

You can add static routes to both routers. So, each router will know about the other subnets. If you can give us your network map (how the routers are connected with each other and with their subnets), we can help you more.

share|improve this answer

In a word - VLAN's.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.