Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite
3

Our campus has NAT setup at each hostel, and the gateways of all hostels are connected via a Layer 3 Switch.

The ip configuration of clients of hostel 1 is 130.130.1.2, gateway 130.130.1.1 and that of hostel 2 is 140.140.1.2, gateway 130.130.1.1 (these are given by a dhcp server running on gateway servers).

The gateways of hostels have dual NIC. Gateway of server 1 has ip configuration:

  • NIC 1 (for internal network): ip: 130.130.1.1
  • NIC 2: (for central network/internet) ip:192.168.201.200, gateway 192.168.201.254

Gateway of server 2 has ip configuration:

  • NIC 1 (for internal network): ip: 140.140.1.1
  • NIC 2: (for central network/internet) ip: 192.168.206.200, gateway 192.168.206.254

The 192.168 lines of all gateways are connected via optical fiber line to a central switch (it provides a trunk line)

Now as it must be clear that a client of hostel 1 can't connect to client of hostel 2 because of NAT. Is there anything i can do on gateways/clients etc. anywhere so that this is possible. I have tried various approaches like ipsec etc. I know a central vpn server can do this but i dont have a server or LAn that can handle such a drastic load ( total capacity of all hostels is 7000). Can anyone suggest the best way of doing this. I have complete access to gateways and clients but not on the central switch.

P.S.: I am student at this institute given the responsibilty to perform the above task but i cant distort the current structure completely. I can run something atop it that doesnt interfere with the current address and their routing.

This is an image of the network structure i have (just an e.g.) http://i26.tinypic.com/10hw1oh.jpg

share|improve this question

3 Answers

up vote 1 down vote

I'm at a bit of a loss... and have a big red-flag to wave at you... if your school does not OWN the 140.140 block and the 130.130 block... you can end up with some pretty hefty fines & lawsuits if attached to the public internet. There are only 3 blocks reserved for private allocation, the 192.168.0.0 - 192.168.255.255, 10.0.0.0 - 10.255.255.255, and 172.16.0.0 - 172.31.255.255.

140.140.x.x(754th Electronic Systems Group - US Military) and 130.130.x.x(University of Wollongong - Austrailia) both are owned by people on the public internet.

...that being said. Here's what I'm at a loss about. What addresses are issued to the actual endpoints? are they getting 140.140.x.x addresses? and if-so... why are you NAT'ing internally? The two networks should be able to route directly between each other. Each hostel should have a router of its own directing traffic between each other, or 1 large central router where they all meet. You should only need to NAT if you have insufficient public IP addresses for endpoints to connect to the public internet.

share|improve this answer
We have only about three/four public internet address, all these are internal address not directly connected to the internet. Also i have given the addresses as a example of the network structure. the reasons for havng such a network are because we have limited public addresses that have to be shared by the 5000 campus students. Also the authorities wanted to keep the NAT networks of all hostels seperate so there are seperate gateways in each hostel. connected via the central switch while the central switch is connected to the internet. – Harshil Mathur Apr 12 '11 at 18:20
Splitting up a 10./8 network 3000 ways will still provide more private address space than you will ever make use of. Even if all 5000 students were in 1 building at the same time and ALL decided to connect to the internet at the same time. You can still NAT the networks based on the subnet of addresses coming from each hostel. You really should not NAT until you hit the Edge of your network. It makes things VERY difficult to troubleshoot and fix. – TheCompWiz Apr 12 '11 at 18:26
1  
If you are trying to isolate a "Teacher" network from a "Student" network in the same building, then employ VLANs. NAT'ing is still not the best solution. – TheCompWiz Apr 12 '11 at 18:28
Well, I know that NAT isnt that good solution for this but the people who setup this network werent that techinically sound, they did what they understood. Being only a student at this institute I cant dissassemble the complete network structure, I just have enough permissions from authorities to make changes on the gateways and clients tht permit the above to happen without distorting the current network structure. – Harshil Mathur Apr 12 '11 at 18:33
up vote 0 down vote

From what I understand, the only thing you need is to allow routing between two different subnets (192.168.206.0 and both 140.140.1.0 and 130.130.0.0).

So both these servers would have to allow packets to be forwarded between their own interfaces.

share|improve this answer
I want to allow routing between 130.130.1.0 and 140.140.1.0 via the 192.168 line, i tried using the route command in windows too but failed.. – Harshil Mathur Apr 12 '11 at 18:10
I'm far from a windows expert...but I believe what you want to do is bridge the two interface. But again, I'm not a windows expert so do double check before you do that! – Alex Apr 12 '11 at 18:19
Briding is not possible beacause i cant disturb the current network structure ( alot of things are running atop it and bridging will change the complete structure of ip addresses i guess. I want to know if i can run something on top of this like ipsec or vpn or forwarding that can do this. – Harshil Mathur Apr 12 '11 at 18:23
up vote 0 down vote

I'm guessing that saying the gateway for hostel 2 on the 140 network is 130.130.1.1 is a typo and it is really 140.140.1.1

Are the hostel gateways hosts rather than real routers? Is it not possible to set up them up so that they do the NAT for their respective hostels thus making the 130 & 140 addresses appear as a 192.168 addresses to the central switch? Even if they are hosts then it should be possible to do the NAT on them, there is no need to get complicated with internal VPNs, I think, as has already been mentioned, that your network is in enough of a mess already!

Using that hostel gateway NAT method no changes need be made to individual hosts.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.