Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a scenario where I need responses on a certain range of addresses to go out through one default route and another to go out through another but don't know how to setup the route add commands to configure each range. Here is the scenario:

  • Default gateway is 192.168.1.250
  • 192.168.1.0-99 default route is 192.168.1.251
  • 192.168.1.100-199 default route is 192.168.1.252

In basic terms I don't know how you define a range within a subnet using the subnet mask etc?

EDIT: To clarify purpose...

My implementation scenario is that basically traffic comes in from one of two firewalls to the same device, the traffic from firewall A goes to the lower range, and the traffic from firewall B goes to the upper range but the response needs to go back to the corresponding firewall through which the traffic was received. I have been told the way to achieve this is through route commands.

Firewall devices are Cisco, the servers where the route commands will be set are Windows 2003.

share|improve this question
    
You get 1 default route. You cannot route within a subnet. Assuming you want to route 192.168.1.0-199 to hosts other than 192.168.1.250 you need to subnet more. –  Mark Wagner Feb 7 '12 at 8:26
    
Are you looking at source-based routing or just a normal routing based on several ranges of destination IPs? –  Khaled Feb 7 '12 at 8:29
    
Thanks, sorry I am not particularly well versed in routing! Does this mean I would have to have one default route for say 192.168.1.x and create another subnet at 192.168.2.x and give that a default route and that it is impossible to add routes within a given subnet? –  Chris Feb 7 '12 at 8:31
    
What routing hardware/OS? You can do some pretty weied/obscure things with Linux if you really dig in deep. –  Zoredache Feb 7 '12 at 8:37
    
Added clarification on purpose/tech - it's Windows servers on this one –  Chris Feb 7 '12 at 8:46

2 Answers 2

up vote 1 down vote accepted

You can't split your subnet at the ip address boundary you've listed in your question but you can try to split it at the subnet mask bit boundary in the routing table of each server by creating the following routes on each server:

  1. route add 192.168.1.0 mask 255.255.255.128 "ip address of lower range firewall"

  2. route add 192.168.1.128 mask 255.255.255.128 "ip address of upper range firewall"

This means that the "lower range" firewall will need to have an ip address between 192.168.1.1 and 192.168.1.126 (.0 and .127 being unusable) and the "upper range" firewall will need to have an ip address between 192.168.1.129 and 192.168.1.254 (192.168.1.128 and 192.168.1.255 being unusable). Because each of these routes is more specific than the route to the default gateway on each server (0.0.0.0), these routes will have a lower metric and should thus be preferred over the default gateway route on each server. This should force each server to use these routes for traffic destined to the appropriate "range" of addresses.

From the perspective of the routing table, there are two subnets: 192.168.1.0/25 and 192.168.1.128/25.

I've just tried this on my Windows 7 computer and it seems to work, although I"ve never done this in a real scenario.

share|improve this answer
    
This worked, thanks –  Chris Feb 7 '12 at 13:37
    
Glad to help... –  joeqwerty Feb 7 '12 at 13:55

You could add a router to your network and make it the default gateway for all equipment. That router could then use policy routing to send traffic from the lower hosts to one firewall and the upper hosts to another firewall.
Let me know if you would like more info on policy routing.

A second, less elegant solution would be to manually add a persistent default route on each upper host (or lower - whichever has fewer devices). These would get the default gateway from DHCP but would have a manual route to the other firewall with a lower metric and thus would send traffic that way. The command is route add /p 0.0.0.0 mask 0.0.0.0 "IPofFirewall2" metric 1

However, you might want to consider breaking this subnet in half (and starting the "upper hosts" at 129 of course) as it may simplify other tasks for you in the future.

share|improve this answer
    
Thanks, a router is an interesting idea which I'll def look at –  Chris Feb 7 '12 at 13:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.