4

I'm hoping a network guru can help me out here. I have a network installation project at a client site and I've mentally mapped out how I plan to set it up.

They already have a Verizon router set up and it must stay configured as the first device in the chain. They want "guest" users (i.e. those that connect to a WAP) to have no access to the computers on the Windows domain.

Here is the config. I'd like to know if anyone sees any problem with this and can point me in the right direction on a few questions below.

Chain of connectivity: Internet -> Verizon router -> Netgear router -> Switch -> Patch panel (server & workstations)

  • Note: WAP devices would hang off Verizon router

Verizon Router

  • WAN port connects to internet
  • Internal IP: 192.168.1.1
  • DHCP on, range 192.168.1.2 – 100
  • LAN port connects to Netgear WAN port

Netgear Router

  • WAN IP: 192.168.1.250
  • DHCP off
  • LAN port connects to Netgear switch
  • LAN IP: 192.168.2.1

Netgear Switch

  • LAN port connects to server and patch panel (workstations)

Server

  • IP: 192.168.2.2
  • DHCP on, range 192.168.2.2 – 200

Workstations

  • IP: auto-assigned
  • DNS server: 192.168.2.2 or auto-assigned?
  • Gateway: 192.168.2.1

Questions:

  1. Do there appear to be any major problems with the above configuration that will make it not work?
  2. The item in bold above, what should the IP's be?
  3. In this configuration, will computers connected to the Verizon router be able to see/access computers behind the Netgear router, since they are on different subnets? (I don't want them to be able to).
  4. Vice versa, will computers behind the Netgear router be able to see/access computers connected to the Verizon router?
  5. Computers connected to the Verizon router (192.168.1.x) will need to pull an IP from the DHCP server behind the Netgear router (192.168.2.x), and computers behind the Netgear router will need to send/receive internet traffic through the Verizon router. Should this "just work" with the above config or do either of the routers need any special configuration (DHCP relay, static routes, etc) in order to be able to pass traffic in and out?
  6. If I wanted to add a WAP to the Verizon router (192.168.1.x), would I just hardwire it to a LAN port on the Verizon router and set it to get an IP automatically from the Verizon router, then disable DHCP on the WAP and set client computers to auto?
1
  • 3
    This question is better asked on Serverfault.com
    – Alan
    Aug 21, 2009 at 16:00

5 Answers 5

4
  1. Not really

  2. DNS right? If 192.168.2.2 is your internal DHCP(Windows AD DC, I'm assuming), then you'll configure that to push out whatever DNS server you want, the same pc, 192.168.2.2 if you're running DNS on it also.

  3. No. The stuff on the verizon router is "on the internet" as far as the stuff behind the netgear is concerned. The only incoming traffic allow will be what you define in the Netgear, ie. Portforwarding.

  4. Yes

  5. PC's behind the Netgear will "just work". I'm a little confused, You want wireless clients to connect to the Verizon router, and you want don't want them to have access to the LAN, right? Don't you want them to just get an address from the VZ router, and not from an internal DHCP server?

  6. Yes. If it's actually a WAP, it probably doesn't have a DHCP server, it's just like a switch but without the...wires. You can use a consumer wireless, turn off the DHCP server, and don't even bother with the WAN port.

The main thing is 5 about DHCP. You'd have to set up portfowarding to get DHCP to assign through the Netgear, but I don't think you want to do that. You just want them to get DHCP from the VZ router right?

I hope this makes sense

1
  • you can't port forward dhcp, at least alone, you'd need a relay agent on the VZ side (DHCP is Broadcast) Aug 21, 2009 at 17:15
4

This is a relatively common pattern. Let me try to answer your questions in order.

  1. At a high level your design makes sense. No big gotchas here as long as the wan port and cpu on the netgear router is fast enough to handle your traffic and the Verizon device supports static routing. I would setup the Netgear to do routing not NAT though.
  2. I would have DNS information fed by the DHCP server.
  3. For most firewall/router products out there the answer is no. You should be able to configure your Netgear device to allow or deny whatever traffic you want.
  4. By default Yes. This depends on your configuration. Most firewall/routers allow you to configure exactly what outbound traffic to allow as well as what to allow.
  5. You really want DHCP info for the guest net to come from the Verizon device or the Access Points not the internal network. The other way can be done but most small network firewall solutions do not relay DHCP from the internal net to the outside. I would set things up as follows:

    • Verizon router - Static route for 192.168.2.0:255.255.255.255.0 pointing to 192.168.1.250
    • Verizon router - DHCP on, DNS points to a public DNS server.
    • WAP devices - DHCP off - GOTCHA - some access points do not handle dhcp relay properly. In that case you need to turn DHCP on with the gateway pointing at 192.168.1.1 and dns pointing at a public server or the verizon firewall.
    • Netgear router - DHCP off, NAT off, additional rules as needed.
    • Netgear router - Default gateway 192.168.1.1.
    • LAN nothing special here.
    • Server handles DNS and DHCP for LAN. Setup dns forwarding to use a public DNS server for internet sites.
    • Workstations get network setup information (address, gateway, netmask, DNS, time, etc) from DHCP.
  6. Normally the answer is yes but some Access Points do not handle DHCP relay very well. Always test your new access points with multiple simultanious connections before putting into service.

The other common pattern is a 3 armed network where one firewall connects to both the guest and the internal network.

2
  • Thanks for the reply. So if the Netgear is set up for NAT, you believe it will not work? Doesn't something on the internal network need to do NAT though, or how will it know which PC to route the data to? Regarding the static routes on the VZ router, that was my mistake. The wireless clients should pull DHCP from the VZ router, not the Netgear. So your response about congifuring the static routes would only be if I wanted to pull DHCP for wireless clients from the Netgear, right? If I just wanted to pull it from the VZ router, no custom routes would be needed?
    – tinghino
    Aug 21, 2009 at 17:31
  • There is no need to setup routes for the WAN side of the Netgear as it sees itself as directly connected. I forgot the line about a static route for the default gateway on the Netgear router. I've since added it. The network should work with NAT enabled on both devices for most protocols but it uses additional CPU that isn't needed for this setup and some protocols are NAT unfriendly and maintain address information in the data section of their packets. Those protocols may break when going through multiple NAT transitions. Usually these are VPN or voice protocols of some sort over UDP. Aug 24, 2009 at 22:40
2

prestomation, thanks so much for the reply. I'm glad you think it should work with this setup. To answer your questions:

2.DNS right? If 192.168.2.2 is your internal DHCP(Windows AD DC, I'm assuming), then you'll configure that to push out whatever DNS server you want, the same pc, 192.168.2.2 if you're running DNS on it also.

Yes 192.168.2.2 would be the windows SBS 2008 running DHCP and DNS. So on the LAN workstations, I'd just set them up to get IP and DNS servers automatically and they should be able to find the DHCP on the SBS server and pull the info without a problem? Or do I need to set the DNS server on the LAN computers with the SBS server IP?

3.No. The stuff on the verizon router is "on the internet" as far as the stuff behind the netgear is concerned. The only incoming traffic allow will be what you define in the Netgear, ie. Portforwarding.

OK. So speaking of port forwarding, with this setup would I need to specify each rule on both routers? i.e. to open http to the server, I'd need to forward port 80 from the VZ router to the Netgear router (192.168.1.250) and then on the Netgear router forward port 80 to the server (192.168.2.2)?

5.PC's behind the Netgear will "just work". I'm a little confused, You want wireless clients to connect to the Verizon router, and you want don't want them to have access to the LAN, right? Don't you want them to just get an address from the VZ router, and not from an internal DHCP server?

My mistake, you're right. The wireless clients should pull IP info from the VZ router, not from the SBS server on the LAN. So it would be the same setup on the wireless computers....just automatic IP and DNS, and it will pull it from the Verizon DHCP since that's the only one it sees?

6.Yes. If it's actually a WAP, it probably doesn't have a DHCP server, it's just like a switch but without the...wires. You can use a consumer wireless, turn off the DHCP server, and don't even bother with the WAN port.

The WAP is a Netgear WG302, it actually does have a DHCP. So if I just disable that DHCP, then wireless clients with auto IP assignment should pass right through and pull an IP from the VZ router any relay or static routes or any of that mess?

5
  • 1
    You should have commented on my answer. Your internal DNS/DHCP should work just fine if your DC is on the same subnet as your LAN. Yes, you'd have to set up port forwarding on both routers to expose internal services to the outside world. Right, wireless clients should get DHCP and thus DNS correctly from the VZ router as your have described. They know nothing of your internal network. WAP: Disable DHCP. Just use the switch on the WAP(connect a WAP switch port to a VZ router switch port) and not the WAN port and you should be good with wireless. I hope that helps Aug 21, 2009 at 17:04
  • Oh, and you can associate your SO and SF accounts in your settings so the question becomes yours and you can accept an answer. At least, I think that's how it works And now I realize you can't comment because you have 1 rep, sorry. Aug 21, 2009 at 17:05
  • Sorry this was my first time posting here, didn't know how it worked. I linked up the acct, thanks for the tip. So from what you're saying, no static routes or anything should be needed on either router? Also the WAP only has one ethernet port I believe. So that goes straight into a VZ port and it's good to go?
    – tinghino
    Aug 21, 2009 at 17:25
  • Right, if nothing attached to the VZ router is supposed to go back through the Netgear without NAT port forwarding, then just plug it all in, you should be fine. Aug 21, 2009 at 20:22
  • Just wanted to let you know it all worked like a charm thanks to your answers and the others who replied. Really appreciate it!
    – tinghino
    Aug 24, 2009 at 1:22
1

Generally, you're fine. "prestomation" has provided most answers. Conceptually your WAP devices need to be on a separate network, which has to have it's own DHCP or other means of assigning IP addresses and relevant network settings. So the sticky point is question 5.

We have essentially the same at our company. The easiest way out here is a small router with DHCP and firewall. There is a NetGear box that will do the trick and also one from LinkSys. Trying to get DHCP traffic from your server onto the other network is tricky at best. And eve if you get it to work, it'll probably cost you more in time than an additional small router (about GBP30).

Your Verizon router probably doesn't offer 192.168.x.y. addresses, it should offer public Internet IP addresses. You will need a connection with more than public IP for this to work. The NetGear router for your main network will utilise one of these addresses, and the one for the WAP network will need another (otherwise the Verizon box is going to get very confused). Well, at least, that's the way it works for us, and we also have a verizon connection.

0

I have two Access Points A and B installed at my workplace. I have given two config in TCP/IP Protocol i.e. First one is DHCP Settings and other one is static IP address in my PC. I want my Access Point A to use DHCP and B to use static IP address settings which is connected to my Windows 2003 server using static IP address setting as well another remoted network connected to my server through Point to Point Connectivity which is using DHCP settings.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .