Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to configure routing between two networks with the same address. They are connected through a router with 2 NICs (Linux machine).

Consider the figure above: How may I configure the routing so that a request from 192.168.1.10 on the right made to 192.168.1.100:4455 goes to 192.168.1.10:80 on the left?

enter image description here

Thank you all for your valuable input so far.

Maybe I can add another router to create a intermediate network like in the figure above. The question is if I can do that physical I can do it logical in one router?

enter image description here

share|improve this question

8 Answers 8

up vote 3 down vote accepted

In the first diagram you can connect each segment using proxy arp or bridging. In the second diagram you might be able to bridge the segments using GRE.

As everyone else emphatically states you should avoid this sort of thing if possible.

share|improve this answer
1  
But that doesn't help because both networks have a 192.168.1.10 address that he wants to send traffic between. –  rjmunro Jul 5 '11 at 11:04
    
You're absolutely correct. For identical addresses on each segment you'd have to resort to mangle the packets as you describe below. –  Gerald Combs Jul 6 '11 at 15:41

It won't work. There is no way to send a packet to another machine with the same address (192.168.1.10) The traffic will be routed directly to the loopback address and won't even leave the system. Your diagram shows an addressing conflict. Personally, I would change the address on the right to a different address.

You could use DNAT to make 192.168.1.0 on the left appear as a different address and route to it. This is done when bridging private networks from different organizations. The appropriate DNS overrides on the local DNS servers are required so that the servers can be reached by name.

EDIT: You need a router where you can configure DNAT individually by interface. Linux based routers should work, but I don't think dedicated routers have this capability. Typically, NAT is handled by firewall devices. Linux routers generally combine routing and firewall capabilities.

EDIT2: When you are configuring a network which is likely to be connected to others internal networks it is best to use less popular sub-nets of the 192.168.0.0/16 block, or a block in one of the alternate private networks, 10.0.0.0/8, or 172.16.0.0/12. Pick a random number between 4 and 255 for your sub-net (second octet for 10.0.0.0/8, third octet for the others). If you use the 172.16.0.0/12 range pick a random value between 17 and 31 for the second octet as well.

If you distribute addresses using DHCP, you should be able to change the sub-net relatively easily. You may want to route the old sub-net while the addresses are changing over.

share|improve this answer
    
"It won't work.", i fear that. The point is, the right is customers network and the left (router including) our equipment. As 192.168.1.0 is very popular i was trying to get a general solution to avoid network address clashes configurable from one point (router) ... –  PeterMmm Jul 4 '11 at 14:15
3  
it will link not work, because at least two computers in this scheme have ip-address 192.168.1.10! –  Cucumber Jul 4 '11 at 14:24
    
It is a full Linux distro with full toolbox: iptables, tunnel, etc –  PeterMmm Jul 4 '11 at 15:31
    
See the Shorewall article on Bridged Firewalls shorewall.net/bridge-Shorewall-perl.html for a start on your setup. –  BillThor Jul 5 '11 at 13:17

Your scheme and your question is absolutely uncorrectly. You're talking about two subnets with the same address 192.168.0.0. and you want to make routing between some subnets. Please, think of what and how you want to do and then Reframe the question.

share|improve this answer
3  
The question is perfectly fine, the OP knows this doesn't usually work, he was just asking if there is some way to make it work even if it shouldn't; and there actually are ways to do that, only they are extremely unusual and convoluted; but I know of at least one large production network where this was made necessary by a company merge. It's really ugly and difficult to manage, but it works. –  Massimo Jul 4 '11 at 14:43

This could work with some really heavy NATting and a lot of work, testing and (probably) errors; but it will be difficult to setup and a pain to manage in the long run.

I strongly suggest avoiding it, if you can.

share|improve this answer

Based on your comment to the answer from BillThor, I would suggest to renumber one of the networks ASAP. Whilst you may be able to get this working somehow, it is always going to be a perfect PITA and will haunt you. This is the exact reason why I NEVER configure any network on 192.168.1.0/24.

The renumbering is easiest to achieve if one of the networks is completely configured through DHCP. Change the DHCP configuration, change the fixed addresses of the DHCP server, then restart every single computer on the network, done. It's well worth the effort.

share|improve this answer

I'm posting this as a new answer because it's a completely different approach, but it could work and save your day.

If all addresses are on the same subnet but you can make sure there is no conflict (i.e. you can change one of those two 192.168.1.10), then bridging the two networks would be the easiest solution. You could use a PC with two network cards in a bridge configuration, or just connect the two networks with a simple switch (or even only a cable).

If you only have few conflicting addresses, you should be able to sort them out; of course, if both networks are 90% full, this is not a viable solution.

share|improve this answer

In your second scenario you could possibly NAT the entire second network to a 10.0.0.0/24, IE 10.119.0.10 would go out your natty router, be sent to their natty router, then NAT to 192.168.1.10 on their side.

If it even works it will be as much work as just changing the network enumeration on either end really.

share|improve this answer

Double NAT might be the answer, as described in this HOWTO:

http://www.netfilter.org/documentation/HOWTO//netfilter-double-nat-HOWTO.html#toc4

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.