Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

network diagram

I'm trying to make it possible to access a webserver on another network (A) from my local network (C).

They have a router on our end which I cannot access directly to make any changes, If I connect the cable(B) from this router to a pc I'm able to access the webserver with proper IP configuration. But obviously I cannot connect the (B) to main switch as it needs IP configuration.

I want the whole local network to be able to access this webserver (B).

Access I mean as in through browser. Internal proxy is running fedora with squid which is connected to the internet, and only means of access to the external webserver is through (B).

I hope it's clear, with that super diagram and all.

EDIT: Let me know if it's possible by editing router configuration too, it's a juniper.

Thank you guys, great community!

share|improve this question
    
+1 for including a diagram. :) –  Murali Suriar Jul 27 '09 at 12:02
    
OO Drawing with this lautman.net/mark/coo/index.html :) –  saint Jul 27 '09 at 13:39
add comment

6 Answers

up vote 1 down vote accepted

Ok, so you can connect a single device to that "router", and it gets a single IP address on the remote network. Looks bad, maybe it's just acting as a bridge. Whatever.

You can use your own router, then; buy one (or get a PC with two network cards and your favourite OS) and give it that IP address on the remote network, then use it to let your own network talk to the remote one.

You'll need NAT, because you can't use plain routing here; computers in the remote network would never know how to reach yours. So you need to setup a NAT router (quite easy with both Windows RRAS or Linux IPTABLES) which has your own LAN as its internal/private network and a cross-link to the other router as its external/public one; configure it for NAT, and add a route to your main router stating that you can reach the remote network through this new router.

A little example (can't draw diagrams now):

---------  -----------  ---------------------------  ---------  ------------- 
|10.1.35|--|ROUTER(?)|--|10.1.35.235 | 10.1.36.42 |--|10.1.36|--|Main Router|->
---------  -----------  ---------------------------  ---------  -------------

The thing in the middle is your NAT device; it has two interfaces, and the NAT direction is towards the 10.1.35 network; so it gets 10.1.35.235 on its "public" interface; its "private" one is connected to your LAN. Then add a route to your main router (the default gateway for your network) stating "to reach 10.1.35, go through 10.1.36.42". Done.

share|improve this answer
    
Sounds like this will work, I'm going to try it since I have a few extra NICs and a router. So I'll try both ways –  saint Aug 26 '09 at 3:58
add comment

You state in the diagram that the router has a 10.1.35.235 IP address; but a router should have TWO addresses, one for each network it's connected to.

Does the router have two network interfaces (I suppose so)?

What is its IP address on network A? Is this that 10.1.35.235 you mentioned?

What is its IP address on the other interface, the one you should connect to network C? Does it have one? Is it appropriate for network C?

If 10.1.35.235 is the router's address on network A, and it has (or you can give it) a proper address on network C, such as 10.1.36.42, then what you need is adding a route to machines on network C, in order to tell them they can talk to network A through that router; on Windows, the command would be

ROUTE ADD 10.1.35.0 MASK 255.255.255.0 10.1.36.42

You can also use ROUTE -p ADD [etc.] to make the setting permanent (i.e. surviving machine reboots).

Another (better) option would be adding the route to the main gateway for network C, which will thus be able to route packets directed to network A through the other router; this is a lot simpler to manage than adding the route to each and every machine on network A.

share|improve this answer
    
yea it does, and I don't really have access to that router, I just have a cable extended from that router which I use to access from a laptop, but I want that to happen for every computer in the network. –  saint Aug 18 '09 at 13:46
    
Ok, when you connect a laptop to this router, how do you configure it (or how is it auto-configured, if that's the case)? Please post IP/subnet mask/gateway. –  Massimo Aug 18 '09 at 16:23
    
IP:10.1.35.235/255.255.0.0; Gateway:10.1.35.2; DNS;10.245.2.45; DNS2:10.245.2.45 –  saint Aug 25 '09 at 8:15
    
So, let me get this straight: the router has one interface connected to the 10.1.35 network, and when you connect a computer to the other interface, it gets an IP address on the same network? This doesn't look like routing at all to me, this looks a lot more like bridging. –  Massimo Aug 25 '09 at 11:00
    
That's the thing, I'm confused too. that's the best I could explain it. As I did mention I don't really have access to the router/bridge. I just have the end. If it's bridging is there anythin I can do to achieve what I mentioned –  saint Aug 25 '09 at 19:17
show 1 more comment

If you are not able to change any configuration on the router and the port on cable B only allows/has one IP address, I would say you have to configure SNAT on a device between the router and the switch to be able to use this single IP by many client behind this SNAT device.

share|improve this answer
    
you mean by installing another network interface on internal proxy server? –  saint Jul 27 '09 at 7:17
    
Yes, this would be a solution. You can alos use a L3 switch, a router or any gateway device. –  Manuel Faux Jul 27 '09 at 7:38
add comment

create a new vlan on your switch with the matching ip range of the router then enable ip routing. this will only work if your switch is layer 3.

so the end will be you will have 2 vlans on your switch, the first will be your original network and the second will be on a single port connected to this 3rd party router.

In essence your switch will act like a router between the 2 networks.

Stuart

share|improve this answer
    
That's not possible with current hardware :(. –  saint Jul 27 '09 at 7:36
add comment

If your internal proxy server has multiple network interfaces, you could dual-home it to both your internal network and the provider hand-off. You could then configure the routing table on the proxy as follows:

10.1.35.0/24 -> 10.1.35.235

10.1.36.0/24 -> <your internal default gateway>

Alternatively, if your proxy only has a single interface, you could install another router facing off to the provider router. It's a little difficult to specify a configuration without knowing the rest of your network topology. For example, does the proxy you mention also need to provide internet connectivity to your workstations? Or is it only used for proxying internal connections?

share|improve this answer
    
right now it's only used for internet –  saint Jul 27 '09 at 12:45
    
It right now has two NICs, which is connected to internet and the other to main switch, squid and iptables are being used atm. So it is possible?. I couldn't really understand what you said there. thanks though –  saint Jul 27 '09 at 13:33
    
Do you have a router between your proxy and your ISP connection? Or do you plug the proxy directly into the ISP handoff? –  Murali Suriar Jul 27 '09 at 14:24
    
yep directly..no router nothing –  saint Jul 27 '09 at 16:14
add comment

I guess I'm confused as to what the problem is...you've got hosts on 10.1.36/24 that you want to access a webserver on 10.1.35/24? Does traffic normally flow this direction? Where is your internet connection? Is 10.1.35/24 directly attached to the router or is it located across the internet connection (if that's the case, a VPN will likely be necessary)?

Is 10.1.35.235 your only assigned address and you need help NAT'ing outbound requests? Or is it the inside address on the router (default gateway?) Is the proxy server also on 10.1.36/24?

Probably superfluous information, but it's not necessarily true that you can't connect the outbound connection directly to the switch. As a matter of standard process, I attach my routers and firewalls to matching VLANs on a switch so that I can move them around if the need arises. Example:

  • router-A attaches to port 1 in VLAN 4;
  • firewall-A and firewall-B are a failover bundle of PIX 515s and their "outside" interfaces attach to switch ports 2 & 3, also in VLAN 4;
  • the firewalls "inside" interfaces then attach to ports 4 & 5 in VLAN 5.
share|improve this answer
    
It goes something like this, 10.1.36/24 is connected to internet from another NIC in the same server, it goes to a 202.x.x.x. Problem is there is another network that we need to access, not through the internet(10.1.35.34), we have a cable to access this network, and it is accessible if you directly connect the cable with proper IP configuration. What I want is for others to access it same way...boy..that's confusing –  saint Aug 18 '09 at 13:41
    
so the other NIC you use for internet access is a third connection on the 10.1.36 side? sorry m8, but I'm still having trouble reconciling your description with your diagram. However, it may or may not be necessary for me to grok it to help a little. This really sounds like you're simply missing a route. I think Massimo is on the right track. Some more questions to help clarify tho: 1. what kind of router (model/make) are we dealing with? Is this an actual "router", or is it a DSL/cable modem? 2. what are the default gateways of your 10.1.36/24 and 10.1.35/24 subnets? –  Greeblesnort Aug 19 '09 at 3:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.