I have the following network layout:

Network1 ----VPN1-----Network2----VPN2----Network3

I can administer everything in Network1 only and my goal is to get to a box on Network3. I've been told by the admins of Network2 that it's not possible for them to route traffic from Network1 to Network3. I've finally been authorised to host a box in Network2 and I'm hoping with this I can set something up to resolve the issue.

My question is should I set this up as a Windows or a Linux box. My initial thought was to use iptables to reroute requests but with my lack of experience with Windows Server (used for something or other in Network2) I'm not sure if this will work. My head's full of questions like: - can I get an ip without logging in to a windows domain? - if I do get an ip, do Windows Servers manage routing through the VPN? - can I make a linux box authenticate with Windows Server to log on to the domain? - would it just be easier to set up a windows box? - is it possible to configure a windows box to do routing from Network1 to Network3?

Has anyone done anything like this before? Had experience managing Windows Server? Authenticated (or not as the case may be) to a Windows domain? I'd really appreciate your advice.

It might be worth mentioning that the overall objective is to establish a telnet connection from a box on Network1 to a box on Network3.

  • Have you considered getting a router? Like box? Mikrotik has routers that are REALLY cheap and handle pretty much everything using their own OS basedo na linux kernel - a lot easier to maintai. I have a similar setup using a couple of Mikrotik routers the cheapest one costing around 50 USD. – TomTom Nov 30 '11 at 5:45

The answer probably depends on the traffic you are trying to get over to Network3. If you need to administer only windows machines probably a windows server. But if you need to administer a mixed environment probably a Linux server since you can rdesktop into windows servers and pass along SSH traffic to linux and OSX servers.

It seems like the real solution is to make "hair pinning" possible within Network2 (but your Net Engineers already said no to this) or create another tunnel between Network's 1 and 3 creating more of a mesh network. Is there a reason you can't setup a link between 1 and 3?

I'm no help with using iptables to route the traffic but I know you can use a mix of krb5 settings and winbind to get linux authenticating off of a Windows 2008 Server and probably use SMB to auth off of older servers.

  • Thanks for your response. I've just updated question - I'm not actually administering any boxes, I just need to be able to telnet from N1 to N3. I'll have a read about krb5 and winbind, I think they're running 2008; i'm just worried I'll spend ages trying to make it work only to find it's unreliable. I don't understand why "hair pinning" isn't possible, it's worked for me before but N2 is hosted by our customer - just have to take no for an answer I think. – James Nov 30 '11 at 1:38

windows domains operate on a different OSI layer than TCP/IP; as long as your box on network 2 has the route to network1 and network3 (and, you know, isn't firewalled), it can pass packets and should be able to get an IP. (if you had to be on a windows domain first in order to pull a DHCP lease, for instance, you...would never be able to connect, because there'd be no route for the domain auth packets to travel).

i suggest linux for your network2 box, only because i (admittedly possibly in a biased manner) believe that it's easier to do routing with. if you vpn into network2 and push routes to the client for network3 to go through the vpn (and have the proper src/dst routes set up on network2's vpn box), you should be golden.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.