1
  • We have 4 x business broadband connections and 1 static IP address.
  • We have several servers which need to access one another and the internet and some need to be accessible remotely from the internet.

The main issue I need to resolve are how to distribute the data via the relevant connection depending on it's source/destination. At the moment, each router has it's own address range 10.0.2.0/24, 192.168.0.0/24, 192.168.1.0/24 etc. 3 of the routers are connected to a network switch with only one providing DHCP/Wi-Fi. Servers on the main DHCP network have static IP addresses as well as virtual NICS that enable them to connect to the other IP ranges.

The 4th router is currently providing a completely separate spare Wi-Fi office network and separate DHCP server.

So, what would be the best way to handle this setup?

It's get's messy having so many separate subnets and configuring virtual NIC's. It's also messy writing separate IP route commands for each server. Some of the servers have critical data that must be sent in time (streaming). Other servers have less critical data that simply needs uploading in a reasonable time to the internet. There is also a web server accessible from the external static IP address/domain name.

None of the routers (BT/Virgin) currently allow custom DNS, which makes it more difficult to handle access to the web server domain name internally (it should be accessible at LAN speeds).

So I could put all the routers in the same subnet, but there is the possibility of users using gateways that they shouldn't.

I could also buy a router just to handle all the traffic and route it accordingly (and also one that allows custom DNS).

Any thoughts/suggestions appreciated!

thanks James

3
  • Having multiple routers in your situation is not sustainable. Get a single router that can handle multi-wan/multi-Lan. Then you'll have a single place to go to when needing to change config, troubleshoot, monitor, etc.
    – EEAA
    Feb 29, 2016 at 13:26
  • So would I operate the existing routers in modem only mode? Because the Virgin routers have a specific co-axial connection and I think the BT Home Hub is RJ11..
    – James
    Feb 29, 2016 at 14:28
  • Yep, that's the idea.
    – EEAA
    Feb 29, 2016 at 14:29

1 Answer 1

3

There is so much going on here, so I'm going to try and address these one by one (out of order, probably)

Servers on the main DHCP network have static IP addresses as well as virtual NICS that enable them to connect to the other IP ranges.

What? You have a network with a DHCP server, but then you have static IP addresses? And Virtual NICs? What kind of machines are these? Virtual machines have vNICs, but desktop machines don't. They can have virtual NICs that represent different VLANs but it's quite unclear what you're actually saying is going on here.

None of the routers (BT/Virgin) currently allow custom DNS, which makes it more difficult to handle access to the web server domain name internally

I could also buy a router just to handle all the traffic and route it accordingly (and also one that allows custom DNS).

Again I'm only guessing what you're getting at here, but routers don't have much to do with DNS. DHCP can (by issuing a list of DNS servers for the clients to use), but I think what you're getting at here is that your DNS returns your public IP address for your website, but your website is actually hosted inside your network and thus it doesn't work?

The solutions here are to get an internal DNS server and do split-horizon DNS, and point your network clients to use this instead of your ISP or router's DNS. Or, you can consolidate your networks (more on that later) and set up NAT hairpinning. Or you can move your website off your network and to a commercial host.

So I could put all the routers in the same subnet, but there is the possibility of users using gateways that they shouldn't.

But you said that your machines are all connected to all the networks simultaneously right now anyway, so what's stopping that right now? Also you probably give too much credit to your users.

We have 4 x business broadband connections and 1 static IP address.

Uuh, one static IP address per connection or just in total?

It's get's messy having so many separate subnets and configuring virtual NIC's

Yeah, no shit.

Here's what you do. You buy a proper router. Something like a Cisco 887 or along those lines would probably do you well, but they are pretty easy to screw up and can require a fair amount of know-how. I'm also a fan of the Mikrotik routers, something like the RB2011UiAS-RM (this is the one I use personally at home). But again, it can require a fair bit of knowledge to actually get working the way you would want - but if you put in the time and effort it can do all you need and more. Something like the Meraki mx64w might also fit the bill.

I have no idea what kind of connections you have there, but if it's cable then you'll want to put the devices into "modem only". If it's ADSL2+ or any of the *DSLs then you'll want to use rfc1483 bridging (or whatever your equivalent is). If it's an ethernet fiber drop, then you can probably just plug it straight in (if you have fiber ports on your device, or use a media converter if you don't).

Then you want to get all of your internet connections coming into the same physical hardware, and you want to get rid of all of your seperate networks. You want one, central, unified network for everything (with exception to perhaps multiple wireless networks, like a guest network or something, or where it makes sense to separate them, but it doesn't sound like you have that requirement).

Once you have all your internet connections coming into the same router, and you have just a single network, now you can start getting things sorted out.

Put in routing (or let's be honest here, masquerading) rules to sort out which IP addresses are going to use which internet connections for outbound traffic. Get your inbound port forwardings sorted out. Hopefully your router is going to be smart enough to send traffic out of the same interface it came in on, otherwise you will probably end up with a stateful firewall dropping traffic.

What you've got here is fairly unsustainable in the long term though, for anything more than really basic segregation. Getting all your connections into the same router is a hugely important place to start though, so at least you have one place where everything is aware of all of your connections, and you have a central place to manage things from.

2
  • Yes sorry, it is messy! Bits of kit have been added over time until we've arrived at this situation. My only concern with the single router option is that if that fails, it takes down everything with it! What kind of backup options exist in that scenario?
    – James
    Feb 29, 2016 at 15:01
  • @James you don't have many options here. Most (all) routers in that range will allow you to back up your config and you can then just restore it to a standby router (and physically swap the cabling). Or high end routers will support HSRP, but that requires a compatible physical setup, or BGP, but that requires involvement from your upstream ISPs and your own IP space, which is very complex. Feb 29, 2016 at 18:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .