1

I have a problem what I believe is a routing issue but I cannot solve it. Current setup on my company is like this schema

In current setup,

  • every client can access to internet using CLIENT => MAIN => MODEM
  • every client can access to WEB using CLIENT => MAIN => MODEM => WEB
  • WEB cannot access behind MAIN

now, for one specific case, our WEB server needs to access one of the clients, say CLIENT 1. I could not manage to create such route. could someone please explain me how to accomplish such task and describe me how.

I tried to create a route on WEB like this

route add 10.0.0.0 mask 255.0.0.0 192.168.2.200

and tried to create another rule on MAIN using RRAS. It did not work and I deleted it and all clients are disconnected from internet. only a reboot recovered. problem is I don't remember the route added.

servers are Windows 2008 R2, clients are Windows 7

any help is appreciated

UPDATE 1: Added route tables

route tables

5
  • Does MAIN perform NAT on the 10.0.0.0 subnet?
    – Radius
    Feb 1, 2013 at 18:29
  • It seems NAT is enabled on RRAS on internet interface
    – edokan
    Feb 4, 2013 at 9:39
  • Please share the routing tables on the involved systems and which systems do NAT.
    – fuero
    Feb 4, 2013 at 11:40
  • Is it a specific service Web need to access at client? Is that requirement fixed or keep changing?
    – John Siu
    Feb 7, 2013 at 3:14
  • at the moment only one service is required (MS DTC), but it may change in the future.
    – edokan
    Feb 7, 2013 at 8:49

2 Answers 2

1

If WEB has the modem as default gateway, you have to add on the modem a route pointing subnet 10.0.0.0 to MAIN. From MAIN, since the clients are direct connected, you don't need any additional route.

Otherwise, if WEB has MAIN as default gateway, you may have a firewall problem, and not a routing issue.

8
  • I added a route to WEB to route traffic to 10.0.0.0 over 192.168.2.200. Then I pinged 10.0.0.2 and ping fails on 192.168.2.200
    – edokan
    Feb 4, 2013 at 11:19
  • Have you tried tracert? Do you have netmonitor or wireshark installed on MAIN? Feb 4, 2013 at 12:06
  • tracert shows timeout error after 192.168.2.200. that's after I created the route. no, neither netmonitor, not wireshark is installed, but I can install if it will not disconnect anyone.
    – edokan
    Feb 4, 2013 at 12:28
  • it will disconnect everyone. But, you already know that your routing is working fine. Now it's just a matter of firewall rules on your windows server. Feb 4, 2013 at 14:45
  • 1
    You don't need the route to 10.0.0.101 to be added to MAIN. And if you have the route added to your modem, you don't need it on WEB Feb 4, 2013 at 15:42
0

You need to disable NAT on the RRAS then, I have never used it but assuming it's semi competent you should be able to selectively NAT based on destination, try to tweak NAT so it doesn't nat traffic destined to 192.168.2.0/24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .