connecting two different (sub)networks

yivi · 04-12-2007, 08:13 AM

Hi there...

Probably something like this was asked/answered somewhere else in the forum, but I wasn't able to find it, so here I go.

I have the following situation:
Where I work we are about to surpass 255 computers/devices in the network, and we are about to be "out" of IPs in the very simple network that's in place.

I'd like to open a new network so new computer/devices are set up in a new range of addresses. I would also like not having to change existing configuration in the clients already set-up.

Set up is like this:
Ubuntu 6.04 server, serving as transparent proxy + firewall + intranet server for the organization, with two network adapters.
* eth0 (10.10.10.1, connected directly to the Internet)
* eth1 (172.16.1.200, connected to the local network, with an alias as 172.16.1.250, and another as 172.16.0.250)

The local network is set up as 172.16.1.0/24

I would like to set up new machines in 172.16.0.0/24, with them using 172.16.0.250 as gateway, and for these machines to be able to connect transparently to other machines/servers in the 172.16.1.x range, and viceversa. (New machines would be in the same physical network as the old)

I am thinking that adding a couple of iptables rules would solve my situation, but I am not very sure if that's would be the case at all, or how should I construct these rules if they really are the answer.

Hopefully the question is not hopelessly stupid, and someone can lend a hand.

Thanks in advance for any clues or advice.

Regards,

I.-

KenJackson · 04-13-2007, 11:36 PM

I think the best thing would be to change your network size from 24 bits to 23 bits (or 16 bits) so that 172.16.0.250 and 172.16.1.250 are on the same network.

Of course that requires updating all 200+ computers.

Alternately, you could add a second IP to some computers like this, using the ip command from the iproute2 package:

Code:

ip address add local ${IP}/24 broadcast + \
dev eth0  scope global  label eth0:${NAME}

Lastly you could have the firewall route packets between the two virtual networks even though they would be just receiving and retransmitting on the same network. This is the worst solution, but maybe the least work.

yivi · 04-16-2007, 06:11 AM

Thanks!

Can you tell me a little bit more about solution number 3 (the worst, albeit the one that requires less changes in the setup?

Regards!

I.-

KenJackson · 04-16-2007, 07:25 AM

If you haven't already, add the second local network to eth1 like this (eth1:second is just a label I picked--you can pick a more meaningful one). I have actually done this a couple times for a couple different reasons.

Code:

ip address add 172.16.0.0/24 dev eth1 broadcast + scope global label eth1:second

Then add a routing entry something like this (you may need to add gw GATEWAY):

Code:

route add -net 172.16.0.0/24 dev eth1:second

And of course you must have packet forwarding enabled in /etc/sysctl.conf, but I assume you already have that.

yivi · 04-16-2007, 07:51 AM

Ok, I'll post a bunch of configuration info, hopefully it is not considered in bad taste to flood the comments with all this data...

ifconfig reports...

Code:

eth0      Link encap:Ethernet  HWaddr 00:14:6C:86:37:5A
          inet addr:10.10.10.70  Bcast:10.10.10.255  Mask:255.255.255.0
          inet6 addr: fe80::214:6cff:fe86:375a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:7550111 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6032802 errors:47799 dropped:0 overruns:0 carrier:95598
          collisions:121446 txqueuelen:1000
          RX bytes:321578793 (306.6 MiB)  TX bytes:1210683121 (1.1 GiB)
          Interrupt:201 Base address:0xa000

eth1      Link encap:Ethernet  HWaddr 00:09:6B:B7:72:A7
          inet addr:172.16.1.200  Bcast:172.16.255.255  Mask:255.255.0.0
          inet6 addr: fe80::209:6bff:feb7:72a7/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:302177 errors:0 dropped:0 overruns:0 frame:0
          TX packets:394829 errors:5 dropped:0 overruns:0 carrier:0
          collisions:4453 txqueuelen:1000
          RX bytes:58533438 (55.8 MiB)  TX bytes:407244109 (388.3 MiB)
          Interrupt:185

eth1:1    Link encap:Ethernet  HWaddr 00:09:6B:B7:72:A7
          inet addr:172.16.1.250  Bcast:172.16.1.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:185

eth1:2    Link encap:Ethernet  HWaddr 00:09:6B:B7:72:A7
          inet addr:172.16.0.250  Bcast:172.16.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:185

route says...

Code:

Kernel IP routeing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.16.0.0      *               255.255.255.0   U     0      0        0 eth1
10.10.10.0      *               255.255.255.0   U     0      0        0 eth0
172.16.0.0      *               255.255.0.0     U     0      0        0 eth1
default         10.10.10.2      0.0.0.0         UG    0      0        0 eth0

and "cat /proc/sys/net/ipv4/ip_forward" says "1".

Firewall is disabled for most tests, and enabled again when I verify that it is still not working as desired.

Then, WXP machine has: 172.16.1.66/24 gw 172.16.1.250
And, W2k machine has: 172.16.0.195/24 gw 172.16.0.250

As it stands, I am unable to see machine WXP from W2k and viceversa.

Still lost. Any other ideas?
Sorry if I am being particularly dense, just learning as I go here.

Thanks again, regards,

I.-

yivi · 04-16-2007, 08:02 AM

Obviously, UbuServer is able to see both computers/networks.

Regards,

I.-

yivi · 04-16-2007, 08:20 AM

Sorry!

The problems seems to be the firewall now.
I thought it was disabled, but it was actually enabled.

Disabling it, it seems that every machine can see each other.

I'll post my conclusions when I'm done.

Thanks again! Feeling very happy over here.

Regards,

I.-

yivi · 04-16-2007, 09:27 AM

Everything works as it should.
Thanks a lot for your help!

A bonus question, rather silly but that could help a little:
Windows networking works through Ubuntu routing, but I can't specify a computer by name (e.g. '\\winserver1'), I have to use the IP (e.g. '\\172.16.0.100').

Is there any way of hardcoding a few names to addresses in the router machine, so the clients know that winserver1 points to 172.16.0.100 (without changing configuration in the clients, as DNS servers).

Maybe I should open a new thread for this question, being slightly unrelated...

Anyway, thanks for your help!

Regards,

I.-

KenJackson · 04-16-2007, 06:49 PM

I suspect the name problem has to do with broadcasts. Windows has more than one mechanism for name resolution, but the oldest and default (I think) is for every host to broadcast it's name and address every few minutes. But there are two problems with that.

If different machines have different network masks, they will be listening to different broadcast addresses so they won't hear the other host's broadcasts.
If I remember right, broadcasts aren't forwarded.

Your server's routing table has two entries for 172.16.0.0, with mask 255.255.255.0 and 255.255.0.0. You should delete one entry. All nodes on the network should use the same network mask if broadcasts are to work properly.

I still recommend that you pick one 16-bit network and setup every machine to use it. It looks like you are most of the way there already. If you just change the network masks to 255.255.0.0 on each machine it should work. You don't even have to change any IP addresses.

The nice part is, you don't have to change them all at once, because it's already working except for broadcasts.

You can also set all the gateways to the same address and delete the aliases.

yivi · 04-19-2007, 08:55 AM

Thanks for all your help.

Eventually I'll try your suggestion.

Right now is impossible (there are some sort of weird problem in the W2k machine if the netmask is setup at 16, intermittent connection and so on). Since my "real" job here is programming, right now I am happy to have this fixed for the time being.

And I learnt a little bit about networking (which was more useful than it transpired about in this thread), and a little bit more about Linux in the process.

Our network is bigger than just the little setup here (there is an interlan connecting more than 50 points in spain through ADSL connections to our network and its servers), and like it or not I'll have to spend a bit more time learning the ugly bits of networking.

Thanks again!

Regards,

I.-

sajina · 03-25-2009, 11:49 PM

Quote:

Originally Posted by yivi

Hi there...

Probably something like this was asked/answered somewhere else in the forum, but I wasn't able to find it, so here I go.

I have the following situation:
Where I work we are about to surpass 255 computers/devices in the network, and we are about to be "out" of IPs in the very simple network that's in place.

I'd like to open a new network so new computer/devices are set up in a new range of addresses. I would also like not having to change existing configuration in the clients already set-up.

Set up is like this:
Ubuntu 6.04 server, serving as transparent proxy + firewall + intranet server for the organization, with two network adapters.
* eth0 (10.10.10.1, connected directly to the Internet)
* eth1 (172.16.1.200, connected to the local network, with an alias as 172.16.1.250, and another as 172.16.0.250)

The local network is set up as 172.16.1.0/24

I would like to set up new machines in 172.16.0.0/24, with them using 172.16.0.250 as gateway, and for these machines to be able to connect transparently to other machines/servers in the 172.16.1.x range, and viceversa. (New machines would be in the same physical network as the old)

I am thinking that adding a couple of iptables rules would solve my situation, but I am not very sure if that's would be the case at all, or how should I construct these rules if they really are the answer.

Hopefully the question is not hopelessly stupid, and someone can lend a hand.

Thanks in advance for any clues or advice.

Regards,

I.-

Hai....

I think 192.168.0.250 is considered as virtual interface, and i also have the same problem and i cant add iptables rules for virtual interface.So i think you can better u add a new network card and assign this IP .