Windows Forum

Ask something
Discussion Locked

Route Statements

0 helpful
30 replies

by woody h

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I installed Windows NT 4.0 Server, SP6a on a server with 2 NICs. One NIC is on a 10 network and the other has a public IP address. For some reason during the install, the routes were not setup properly. The route for 255.255.255.255 has a gatewayof my 10 network NIC and not my public nic. Also, there is no route like the following: xxx.xxx.xxx.255 it is missing. When I go to add that route, I get the error: The route addition failed: 87 This is the sytax I am using:

route add -p 198.55.74.255 mask 255.255.255.255 198.55.74.150 metric 1

when I try to add the route for 255.255.255.255 I get the error: route: bad destination address 255.255.255.255 This is the syntax I am using

route add -p 255.255.255.255 mask 255.255.255.255198.55.74.150 metric 1

Right now, I can not access anything past my router with the statements as they currently stand. I have searched microsofts web site and tech net for help and have come up dry. Is there a way to fix this, if so, how? Also I have tried the change command with route and that failed also. Thank you for your help.

Woody

30 replies

by joshg

I think your route statements are wrong.

Your first route add statment needs to be 192.55.74.0 instead of .255 (.255 would be the broadcast address) also the 255.255.255.255 is wrong, i think it should read 255.255.255.0. You don't have to have the metric.

The second route is maybe for the gate of last resort or to route all triffic not in the internal to be routed outside? It should read:
route add -p 0.0.0.0 mask 0.0.0.0 192.55.74.150 but I think this is a default route. Make sure the Gateways on the NIC's are entered correctly. I think that only the external NIC should have a gateway entered. Also turn on IP forwarding for the internal NIC.

by woody h

The 10 address NIC has a gateway. It is actually connected to a VPN gate. It goes out of our network through a vpn session. That vpn that is created does not access the internet. For some reason, all my internet calls want to go down that pipe instead of out through my router. I have verified the default gateway on both NICs and also added the above statement and it did not work. It already had the 0.0.0.0 entry. Any other suggestions? It worked before, and I had to reinstall, and now it doesn't. I have a print out of the route statements from the last install that worked, and these are the lines missing:

198.55.74.255 255.255.255.255 198.55.74.150 198.55.74.150
255.255.255.255 255.255.255.255 198.55.74.150 198.55.74.150

Everything else is the same. Right now this line exits

255.255.255.255 255.255.255.255 10.2.9.2 10.2.9.2

Can I change this somehow or delete it and add the other. I keep getting errors when I try to delete, change, or add those statements. Thanks.

by woody h

Ok, I have temporarily solved the problem. There were 2 0.0.0.0 entries in the route statements. I removed the one pointing to the private nic and I can get out. However, when I rebooted the server, it readded the entry and I couldn't get out again. So I have now deleted it again. Does anyone know how to make sure it stays gone? Thanks. Woody

by christotg

We need to see your routing table. Please copy & paste it... Thanks!

I think you need something like the following:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 204.50.117.1204.50.117.153 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
204.50.117.0 255.255.255.0 204.50.117.153 204.50.117.153 1
204.50.117.153 255.255.255.255 127.0.0.1 127.0.0.1 1
204.50.117.255 255.255.255.255 204.50.117.153 204.50.117.153 1
224.0.0.0 224.0.0.0 204.50.117.153 204.50.117.153 1
255.255.255.255 255.255.255.255 204.50.117.153 204.50.117.153 1
Default Gateway: 204.50.117.1

by christotg

Hmm. That didn't paste as well as I'd hoped.

I have 0.0.0.0 -> 204.50.117.1 (the router) through 204.50.117.153 (my PC)

Since you have 2 NICs, I'd like to know the following:
1. Either you are routing traffic to the internet from the rest ofyour LAN, or you aren't. Do you have some NAT software or Proxy software on this server?
2. Are there multiple subnets inside the LAN?

If there are no internal subnets, you want the following:
Default Gateway on the WAN (public) NIC is enabled with the appropriate value for the ISP.
No default gateway on the LAN (private) NIC.

If there are internal subnets, then something like this:
dest 10.1.0.0 - mask 255.255.0.0 - gateway (internal router)
dest 10.2.0.0 - mask 255.255.0.0 - gateway (internal router)
dest 10.3.0.0 - mask 255.255.0.0 - gateway (internal NIC IP)

dest 0.0.0.0 - mask 0.0.0.0 - gateway (ISP default gateway)

by woody h

I have it accessing the internet now. Your info above is correct. My specific problem is that I had 2 0.0.0.0 statements. This is due to the fact that I have 2 nics. After I read up alittle more on the routing tables, I did a "route delete 0.0.0.0" and then did a "route add -p 0.0.0.0 mask 0.0.0.0 198.55.74.129". This fixed it. However, after I reboot the server it readds the other statement. So now I have:

0.0.0.0 0.0.0.0 10.2.9.1 10.2.9.2 1
0.0.0.0 0.0.0.0 198.55.74.129 198.55.74.150 1

With it that way, I can't get out of my router again. So I did another delete and readd of just the 2nd line above and once again I can get out. So, with all that said, is there a way permently delete the line that has the private information on it, so that after a reboot I don't have to always delete and readd the route.

The rest of the routing statement works just fine. I appreciate all help.

by curlergirl

Your problem is much more basic than you think. With a multi-homed server, having a default gateway in both NICs is going to cause routing issues. You can only have one default gateway - and it must be on the external NIC. Remember, the function of the default gateway is to provide a route for any address that is not in the local routing table. Hope this helps!

by curlergirl

P.S. - to clarify, with only one default gateway, you would add the line as you've described to your routing table. Then, your routing table would see this route a local and route it through the correct NIC, and it would see all other requests outside your local network as external and route them through the default gateway on the external NIC.

by shanghai sam

I understand the concept of one default gateway, but it is necessary for the private NIC to have a default gateway in the settings. This allows it to go down the VPN Gate that is installed and transmit data securely out of our network to other corporate servers. The route you recommended was recommended above and I tried it. I had no problems adding it, however, it did not solve my problem. The only thing that solved my issue was removing the following route statement:

0.0.0.0 0.0.0.0 10.2.9.1 10.2.9.2

10.2.9.1 is the ip on the vpn gate, hence the need for it to be entered as the default gateway of the private nic. The only problem now is that when I reboot the server, that entry gets re-added to the routing tables. I would like to find out how to make the delete a permenant one.

by jayanth

From your problem description and from the answers given to it, I persume that your NT box is a multihomed host, i.e it has 2 NIC's and both of them act as a default gateway for 2 different networks, or for 2 different routes, right?
If this is thecase, then you will have routing issues, as NT cannot handle 2 default routes at the same time unlike a router. You will need to have only one default route.

If for your 10.x.x.x network, which you say needs to access VPN but not the Internet, then you will be better off with another box as the VPN gateway and your existing machine as the Internet gateway. But if you want to have both of them on the same machine, then you could do it easily on a Linux box. The latest Linux Kernel (2.4.16+) support a feature called 'ipTables' which can do routing based on Source Addresses too. I am not sure if such a things can be done on NT. If you are interested in pursuing this option, pls let me know and I will be glad to help you.

Also if you would like to know more about IP Addressing basics, then visit this link
'http://www.3com.com/other/pdfs/infra/corpinfo/en_US/501302.pdf',
which is one the best I have ever come across.

by shanghai sam

Please read the comments from answer 3. I don't have a choice of OSs on this server box. I have to have Windows NT installed for support of the applications installed on that server. It would be nice to install Linux. The VPN gate is connected directly to the private nic. A secure connection with the corporate server is necessary. If you could help me with how to make the delete permanent I would really appreciate it. Thank you.

by jayanth

Hi Woody,
Read your comments to my response and i understand your concern. Well if you can send me a n/w diagram of your network and the ways it is connected to the Internet and the VPN, maybe I'll ponder over it and try to come up an alternate solution. If you are interested then pls mail me at 'vasishtj@netscape.net'.

by shanghai sam

Ok, I guess I misunderstood and thought the 198.x.x.x address was your VPN. The reason the 0.0.0.0 with the 10.1.x.x keeps reappearing is because you have that second default gateway. What you need to do is get rid of the second default gateway and add it as another static route instead. I think this may resolve your problem. Hope this helps!

by woody h

This sounds like a great idea. I was just discussing your comment with the people in my office and we are unsure of how to do this. If I pull the default gateway out of the ip configuration on the nic in the tcp/ip configuration, doesn't that mean that that nic will no longer know how to get "out"? Or does that static route you mentioned take care of that? If you could give me an example, that would be wonderful. Here is my configuration:
Private NIC:
IP: 10.2.9.2
Default Gateway: 10.2.9.1
The VPN Gateway device has an IP address of: 10.2.9.1
There is a cat 5 cable going directly from the NIC to the VPN device. The VPN device creates a secure session from itself to our corporate headquarters in another state, data is then transfered through this secure session. There is a program running on our server that uses this connection to go out and transmit data. Thank you for all your assistance.

by woody h

Point value changed by question poster.
I am increasing the point value. I appreciate all the help that everyone is providing.

by curlergirl

Well - I just found out who "User Deleted" is - that's me on the previous answer, somehow my correct TechRepublic ID didn't get saved with the answer. So, please ignore it. Anyway, as I said I guess I misunderstood and thought the 198.x.x.x address was your VPN. The reason the 0.0.0.0 with the 10.2.9.x keeps reappearing is because you have that set as your default gateway on the internal NIC. What you need to do is get rid of it as a default gateway and add it as another static route instead (i.e., route add 10.2.9.0 255.255.255.0 10.2.9.1). I think this will resolve your problem. Hope this helps!

by woody h

I appreciate all the help that you have provided. I still haven't gotten the total problem fixed. My last comment mentions what the problem is now. If you have any idea of what the solution could be, please email me at howerw@psajax.navy.mil . Thank you for your time.

by jayanth

Hello Again Woddy,
Well I have gone through your comments on Ansewer 6 and this is what i have understood. Pls correct me if I am wrong somewhere.

1. You have a NT box, which has 2 NIC's. NIC1 is connected to your LAN and assigned the IP 10.2.9.2. NIC2 is connected to your Public IP and this is your gateway to Internet.

2. There are some hosts on your LAN which need to access the Internet, through the NIC2 of your NT box.
Then, there are some other hosts on your LAN, which access yourother office through the VPN device, which has an IP 10.2.9.1 and these hosts do not have the need to access Internet.

3. Now the default g/w for NIC1 is 10.2.9.1.
Default g/w for NIC2 is your first hop to your ISP

Am I right so far in these three points mentioned.

Contd...in 'comments'

by jayanth

This is what you can do.

1. On NIC1, remove the default gateway to 10.2.9.1. Leave the field for default g/w blank.

2. On NIC2, give the default gateway as required.

3. Now, as your other office connected through the VPN device, assign a static route to the other office.
If I assume that the network of the other office has an IP range like 172.16.1.0 and the device at the other office which you are trying to access through the VPN connection has an IP of 172.16.1.10, then on your NT box add a static route as follows
"route add 172.16.1.0 MASK 255.255.255.0 10.2.9.1"

"Read this as, To reach the network 172.16.1.0 with a subnet mask of 255.255.255.0, go through the hop 10.2.9.1."

I hope this will help solve your problem. In my answer I assume that you are already running some Proxy on your NT box for Internet access, and hence I have suggested that you leave the gateway field for NIC1, blank.

by woody h

I am not rating the above answers on purpose. It worked as far as taking off the default gateway, adding the route. I can still get down the private network which is wonderful. Now for the problem that has arose because of that. :) OnceI remove the 0.0.0.0 route for my private nic, no one can get into my server on the private side. I run an oracle database on here, and sometimes tech support must sequel in to fix some tables and the such. When that line is removed, when they do a TNSPing, they get no response. Once I readd the line, it works great. So, is there a way to fix this? I will be uping the point value of this question since it has become so involved. I appreciate everyone's help.

by christotg

keep the 0.0.0.0 off the internal NIC.
type the following

route add 10.0.0.0 mask 255.0.0.0 10.x.y.z

where 10.x.y.z is the internal router to your LAN.

If it works - make it permanent with -p

by woody h

I should have done this sooner. Here is my routing table. All have metric of 1. I appreciate all your help.

0.0.0.0 0.0.0.0 10.2.9.1 10.2.9.2
0.0.0.0 0.0.0.0 198.55.74.129 198.55.74.150
10.0.0.0 255.0.0.0 10.2.9.1 10.2.9.2
10.2.9.0 255.255.255.0 10.2.9.2 10.2.9.2
10.2.9.0 255.255.255.0 10.2.9.1 10.2.9.2
10.2.9.2 255.255.255.255 127.0.0.1 127.0.0.1
10.255.255.255 255.255.255.255 10.2.9.2 10.2.9.2
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1
198.55.74.128 255.255.255.128 198.55.74.150 198.55.74.150
198.55.74.150 255.255.255.255 127.0.0.1 127.0.0.1
205.68.76.32 255.255.255.224 10.2.9.1 10.2.9.2
205.68.76.64 255.255.255.224 10.2.9.1 10.2.9.2
205.68.76.96 255.255.255.224 10.2.9.1 10.2.9.2
205.68.76.128 255.255.255.224 10.2.9.1 10.2.9.2
224.0.0.0 224.0.0.0 10.2.9.2 10.2.9.2
224.0.0.0 224.0.0.0 198.55.74.150 198.55.74.150
255.255.255.255 255.255.255.255 10.2.9.2 10.2.9.2

This discussion is closed to new replies.