3

network diagram

I'm trying to make it possible to access a webserver on another network (A) from my local network (C).

They have a router on our end which I cannot access directly to make any changes, If I connect the cable(B) from this router to a pc I'm able to access the webserver with proper IP configuration. But obviously I cannot connect the (B) to main switch as it needs IP configuration.

I want the whole local network to be able to access this webserver (B).

Access I mean as in through browser. Internal proxy is running fedora with squid which is connected to the internet, and only means of access to the external webserver is through (B).

I hope it's clear, with that super diagram and all.

EDIT: Let me know if it's possible by editing router configuration too, it's a juniper.

Thank you guys, great community!

1

6 Answers 6

1

Ok, so you can connect a single device to that "router", and it gets a single IP address on the remote network. Looks bad, maybe it's just acting as a bridge. Whatever.

You can use your own router, then; buy one (or get a PC with two network cards and your favourite OS) and give it that IP address on the remote network, then use it to let your own network talk to the remote one.

You'll need NAT, because you can't use plain routing here; computers in the remote network would never know how to reach yours. So you need to setup a NAT router (quite easy with both Windows RRAS or Linux IPTABLES) which has your own LAN as its internal/private network and a cross-link to the other router as its external/public one; configure it for NAT, and add a route to your main router stating that you can reach the remote network through this new router.

A little example (can't draw diagrams now):

---------  -----------  ---------------------------  ---------  ------------- 
|10.1.35|--|ROUTER(?)|--|10.1.35.235 | 10.1.36.42 |--|10.1.36|--|Main Router|->
---------  -----------  ---------------------------  ---------  -------------

The thing in the middle is your NAT device; it has two interfaces, and the NAT direction is towards the 10.1.35 network; so it gets 10.1.35.235 on its "public" interface; its "private" one is connected to your LAN. Then add a route to your main router (the default gateway for your network) stating "to reach 10.1.35, go through 10.1.36.42". Done.

1
  • Sounds like this will work, I'm going to try it since I have a few extra NICs and a router. So I'll try both ways
    – 0xdeadbeef
    Aug 26, 2009 at 3:58
1

You state in the diagram that the router has a 10.1.35.235 IP address; but a router should have TWO addresses, one for each network it's connected to.

Does the router have two network interfaces (I suppose so)?

What is its IP address on network A? Is this that 10.1.35.235 you mentioned?

What is its IP address on the other interface, the one you should connect to network C? Does it have one? Is it appropriate for network C?

If 10.1.35.235 is the router's address on network A, and it has (or you can give it) a proper address on network C, such as 10.1.36.42, then what you need is adding a route to machines on network C, in order to tell them they can talk to network A through that router; on Windows, the command would be

ROUTE ADD 10.1.35.0 MASK 255.255.255.0 10.1.36.42

You can also use ROUTE -p ADD [etc.] to make the setting permanent (i.e. surviving machine reboots).

Another (better) option would be adding the route to the main gateway for network C, which will thus be able to route packets directed to network A through the other router; this is a lot simpler to manage than adding the route to each and every machine on network A.

6
  • yea it does, and I don't really have access to that router, I just have a cable extended from that router which I use to access from a laptop, but I want that to happen for every computer in the network.
    – 0xdeadbeef
    Aug 18, 2009 at 13:46
  • Ok, when you connect a laptop to this router, how do you configure it (or how is it auto-configured, if that's the case)? Please post IP/subnet mask/gateway.
    – Massimo
    Aug 18, 2009 at 16:23
  • IP:10.1.35.235/255.255.0.0; Gateway:10.1.35.2; DNS;10.245.2.45; DNS2:10.245.2.45
    – 0xdeadbeef
    Aug 25, 2009 at 8:15
  • So, let me get this straight: the router has one interface connected to the 10.1.35 network, and when you connect a computer to the other interface, it gets an IP address on the same network? This doesn't look like routing at all to me, this looks a lot more like bridging.
    – Massimo
    Aug 25, 2009 at 11:00
  • That's the thing, I'm confused too. that's the best I could explain it. As I did mention I don't really have access to the router/bridge. I just have the end. If it's bridging is there anythin I can do to achieve what I mentioned
    – 0xdeadbeef
    Aug 25, 2009 at 19:17
0

If you are not able to change any configuration on the router and the port on cable B only allows/has one IP address, I would say you have to configure SNAT on a device between the router and the switch to be able to use this single IP by many client behind this SNAT device.

2
  • you mean by installing another network interface on internal proxy server?
    – 0xdeadbeef
    Jul 27, 2009 at 7:17
  • Yes, this would be a solution. You can alos use a L3 switch, a router or any gateway device. Jul 27, 2009 at 7:38
0

create a new vlan on your switch with the matching ip range of the router then enable ip routing. this will only work if your switch is layer 3.

so the end will be you will have 2 vlans on your switch, the first will be your original network and the second will be on a single port connected to this 3rd party router.

In essence your switch will act like a router between the 2 networks.

Stuart

1
  • That's not possible with current hardware :(.
    – 0xdeadbeef
    Jul 27, 2009 at 7:36
0

If your internal proxy server has multiple network interfaces, you could dual-home it to both your internal network and the provider hand-off. You could then configure the routing table on the proxy as follows:

10.1.35.0/24 -> 10.1.35.235

10.1.36.0/24 -> <your internal default gateway>

Alternatively, if your proxy only has a single interface, you could install another router facing off to the provider router. It's a little difficult to specify a configuration without knowing the rest of your network topology. For example, does the proxy you mention also need to provide internet connectivity to your workstations? Or is it only used for proxying internal connections?

4
  • right now it's only used for internet
    – 0xdeadbeef
    Jul 27, 2009 at 12:45
  • It right now has two NICs, which is connected to internet and the other to main switch, squid and iptables are being used atm. So it is possible?. I couldn't really understand what you said there. thanks though
    – 0xdeadbeef
    Jul 27, 2009 at 13:33
  • Do you have a router between your proxy and your ISP connection? Or do you plug the proxy directly into the ISP handoff? Jul 27, 2009 at 14:24
  • yep directly..no router nothing
    – 0xdeadbeef
    Jul 27, 2009 at 16:14
0

I guess I'm confused as to what the problem is...you've got hosts on 10.1.36/24 that you want to access a webserver on 10.1.35/24? Does traffic normally flow this direction? Where is your internet connection? Is 10.1.35/24 directly attached to the router or is it located across the internet connection (if that's the case, a VPN will likely be necessary)?

Is 10.1.35.235 your only assigned address and you need help NAT'ing outbound requests? Or is it the inside address on the router (default gateway?) Is the proxy server also on 10.1.36/24?

Probably superfluous information, but it's not necessarily true that you can't connect the outbound connection directly to the switch. As a matter of standard process, I attach my routers and firewalls to matching VLANs on a switch so that I can move them around if the need arises. Example:

  • router-A attaches to port 1 in VLAN 4;
  • firewall-A and firewall-B are a failover bundle of PIX 515s and their "outside" interfaces attach to switch ports 2 & 3, also in VLAN 4;
  • the firewalls "inside" interfaces then attach to ports 4 & 5 in VLAN 5.
2
  • It goes something like this, 10.1.36/24 is connected to internet from another NIC in the same server, it goes to a 202.x.x.x. Problem is there is another network that we need to access, not through the internet(10.1.35.34), we have a cable to access this network, and it is accessible if you directly connect the cable with proper IP configuration. What I want is for others to access it same way...boy..that's confusing
    – 0xdeadbeef
    Aug 18, 2009 at 13:41
  • so the other NIC you use for internet access is a third connection on the 10.1.36 side? sorry m8, but I'm still having trouble reconciling your description with your diagram. However, it may or may not be necessary for me to grok it to help a little. This really sounds like you're simply missing a route. I think Massimo is on the right track. Some more questions to help clarify tho: 1. what kind of router (model/make) are we dealing with? Is this an actual "router", or is it a DSL/cable modem? 2. what are the default gateways of your 10.1.36/24 and 10.1.35/24 subnets? Aug 19, 2009 at 3:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .