I have two routers connected to a Comcast cable modem. Each router has its own rotatable IP. Connected to, lets say router 1, is an NT domain which consists of a AD/DHCP server for the LAN. On router 2 (LAN: I have one machine acting as an OPENFIRE server. I want to setup the OPENFIRE server to use Active Directory and want to connect it to the DC on router 1. I have tried creating some static routes but they have not worked and I'm not to sure where to create them: on the routers or on the servers. How would i create this route? Here is on over view of the topology:

ROUTER 1 WAN Public IP: 173.164.x.x mas: Gtw: 173.164.x.x

LAN (dhcp disabled) server 2008 DC AD, DHCP server

ROUTER 2 WAN Public IP: 173.164.x.x mas: Gtw: 173.164.x.x

LAN openfire server address:

  • Please use appropriate tags, as the solution is OS dependent. – John Gardeniers May 15 '12 at 1:58

If I understand the question aright, you want to mutually route two RFC1918 (ie, private) networks, separated by public routable internet, using only routing tables.

If this is right, then it can't be done.

The whole point of RFC1918 networks is that they aren't globally routable; router 1 simply won't know how to get to, behind router 2, and it can't easily be told how to do that. Similarly, router 2 won't know how to get to behind router 1.

You have options. You can investigate a VPN, which is a sort of protected tunnel between routers 1 and 2, allowing them to tunnel the RFC1918 traffic across the public internet. You can investigate loose source routing, but this doesn't work well on the modern internet. Or you can get public address space assigned by your ISPs for both networks, and route that. None of these options is likely to work well when both ends' public addresses are dynamic, but some of them can be forced to work.

But you can't do it without one of those - admittedly complex - options.


You'd need to route between the two LAN subnets directly. Routing traffic back to the WAN interface on both units for the two subnets adds traffic unecessarily to the routing interfaces. And as MadHatter stated, it can't be done with RFC1918 networks. If your routers have another routable interface, that would probably be one workaround. Using it as a go between for the two internal networks to communicate. Another workaround would be to multihome the openfire box onto the other subnet hosting your Active Directory box. Or multihome your Active Directory box to the openfire subnet. Your security and setup would probably dictate which of those would be more appropriate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.