Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a problem what I believe is a routing issue but I cannot solve it. Current setup on my company is like this schema

In current setup,

  • every client can access to internet using CLIENT => MAIN => MODEM
  • every client can access to WEB using CLIENT => MAIN => MODEM => WEB
  • WEB cannot access behind MAIN

now, for one specific case, our WEB server needs to access one of the clients, say CLIENT 1. I could not manage to create such route. could someone please explain me how to accomplish such task and describe me how.

I tried to create a route on WEB like this

route add 10.0.0.0 mask 255.0.0.0 192.168.2.200

and tried to create another rule on MAIN using RRAS. It did not work and I deleted it and all clients are disconnected from internet. only a reboot recovered. problem is I don't remember the route added.

servers are Windows 2008 R2, clients are Windows 7

any help is appreciated

UPDATE 1: Added route tables

route tables

share|improve this question
    
Does MAIN perform NAT on the 10.0.0.0 subnet? –  AndresSM Feb 1 '13 at 18:29
    
It seems NAT is enabled on RRAS on internet interface –  edokan Feb 4 '13 at 9:39
    
Please share the routing tables on the involved systems and which systems do NAT. –  fuero Feb 4 '13 at 11:40
    
added route tables. hope that will help. thanks. –  edokan Feb 4 '13 at 12:58
    
Is it a specific service Web need to access at client? Is that requirement fixed or keep changing? –  John Siu Feb 7 '13 at 3:14

2 Answers 2

If WEB has the modem as default gateway, you have to add on the modem a route pointing subnet 10.0.0.0 to MAIN. From MAIN, since the clients are direct connected, you don't need any additional route.

Otherwise, if WEB has MAIN as default gateway, you may have a firewall problem, and not a routing issue.

share|improve this answer
    
I added a route to WEB to route traffic to 10.0.0.0 over 192.168.2.200. Then I pinged 10.0.0.2 and ping fails on 192.168.2.200 –  edokan Feb 4 '13 at 11:19
    
Have you tried tracert? Do you have netmonitor or wireshark installed on MAIN? –  fboaventura Feb 4 '13 at 12:06
    
tracert shows timeout error after 192.168.2.200. that's after I created the route. no, neither netmonitor, not wireshark is installed, but I can install if it will not disconnect anyone. –  edokan Feb 4 '13 at 12:28
    
it will disconnect everyone. But, you already know that your routing is working fine. Now it's just a matter of firewall rules on your windows server. –  fboaventura Feb 4 '13 at 14:45
1  
You don't need the route to 10.0.0.101 to be added to MAIN. And if you have the route added to your modem, you don't need it on WEB –  fboaventura Feb 4 '13 at 15:42

You need to disable NAT on the RRAS then, I have never used it but assuming it's semi competent you should be able to selectively NAT based on destination, try to tweak NAT so it doesn't nat traffic destined to 192.168.2.0/24

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.