IT Employment

Ask something
Discussion Locked

Windows 2000 Professional Multihomed Computer

0 helpful
10 replies

by kent2612

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Currently i have a Windows 2000 Professional computer with 2 network card assigned with ip addresses of 192.168.1.1 and 192.168.1.2. Each network card is attached to a different switch. Hosts on either side of the switch could not ping to each other.
How do i make the 2 network card talk to each other.
I am not allow to do a uplink to both switches or to upgrade the OS to Windows 2000 Server.
if i am to use the route add command, can anyone show the the steps
Any solution guys?

10 replies

by radiic

Here is the reg key you need to edit

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"IPEnableRouter"=dword:00000001

This will allow IP packets to be forwarded accross the 2 nics. But I have only done it with two totally different blocks of ip addresses. (10.10.10.1 & 192.168.171.1) It should work though I think in your case too.

Also it would help to know how you have these networks subnetted.

Thanks
Rad

by lordinfidel

The issue here is that he has 2 IP's from the same subnet assigned to the same system.

This violates the RFC's as it will confuse the system.

That is why when you enable IPforward on your box it is working, your on 2 different subnets. If he does the same on his, it will have mixed results due to the routing table.

by kent2612

Both are Class C subnet mask 255.255.255.0. Thanks for your suggestion i will give it a try.

by lordinfidel

Radicallis has the correct paramater, but the question is why are you tring to connect 2 different segments within the same netblock thru a "router".

All you need to do is connect the 2 switches together using a crossover cable. There is no need for a router when connecting hosts on the same subnetwork.

Now if you are connecting 2 differnet subnets, let's say:
subnet A: 192.168.1.0/24
subent B: 192.168.2.0/24

Then you need a router with 2 nics (btw- linux is better suited for this then winblows, although using NT4 srver is extremely easy to enable ip forwarding via the routing tab under tcp/ip properties of your network propterty sheet.

The real question though is, why would you route 2 internal subnets if you are not blocking what ports they can access? If it is because you have too many hosts for a /24, then use a /16.

If it is because you want to segment the network traffic then use switches (not hubs), which you already do. if you want to restrict traffic across the 2 subnets, then you need a firewall, which again, linux is perfect for.

by lordinfidel

If you go with the 2 different subnet route, you will need to make the default gateway of each client machine point to the interface of the router.

So if you assign 192.168.1.1 to eth0 and 192.168.2.1 to eth1 on the router. Then hosts on the 192.168.1.0 netwk needs to set their gw to 192.168.1.1 and same for the hosts on 192.168.2.0 netwk, set theirs to 192.168.2.1

This will have the side effect of not allowing them to get out to the net. Unless of course your router has a 3rd nic in it that is connected to either the net or a router that is. And that 3rd nic is the one with the default gw assigned to it.

If you need to have these networks contact the net also and cannot set their gateway address to the internal router for those 2 networks. Then you will have to go with static routes on each machine but that is a bulky and cloogey route to take.

by kent2612

Internet
|
Router
|
Switch----LAN2(with a WebServer)
|
Win2k Pro(run 3rd party Proxy Server/mail Server)
|
Switch
|
LAN1

Efforts to open ports to allow the WebServer to sit in LAN1 fails.
Currently the WebServer is on LAN2 which actually bypass the Proxy Server.
Using a cross over cable will defeat the purpose of having a Proxy Server.
Changing ip address on the either NIC on the Win2k Pro will be required reconfiguration of the router the all client computers on LAN1. Which i am not authorise to do that.

So is there any other means of allowing LAN1 to talk to LAN2.

by lordinfidel

Your design should actually look like this:

ISP
|
router
|
|-eth0 crossover/straight thru
| to internal interface of router
Firewall w/3 interfaces
|-eth1-->switch-->DMZ
|
|-eth2-->switch-->LAN Hosts

Firewall IP's
eth0= public IP connected to router
eth1= 192.168.1.1 to dmz 192.168.1.0/24
eth2= 192.168.2.1 to lan 192.168.2.0/24

IP's of hosts in DMZ 192.168.1.2-254
IP's of hosts in LAN 192.168.2.2-254

Next you use your Firewall rules to allow incoming web access to the web server from the hostile net.

allow mgmt access to the web server from the internal lan

but do not allow incoming traffic from the web server to the lan

Your firewall acts as your NAT device (I personally hate proxy's, access can be controlled via the firewall by grouping IP's or using subnets, a proxy is only good for outgoing authentication, other then that it breaks alot of web apps)

This can all be accomplished using Linux and 3 network cards. Using a win2k pro box to accomplish this is an extremely poor design choice not to mention just asking to be hacked to bits by someone like me.

If yo only have 1 public IP there is still a way to do this with port forwarding, but the design still remains the same.

by fluxit

Why the two networks? Is this a security issue? Are you violating security by bridging the networks or crossing over the networks? Are there different protocols?

I have done multi-homed machines in the past but only to alleviate the congestion or traffic problems or to facilitate internet connectivity.

Currently, I have a multi-homed system with three nics. One for Internet, local hard wired network, and a wireless network for mobile machines.

by kent2612

Changing the entire network design, your idea obviously will work, I will do that too if i can and without any constraint.
It is an existing network, not a school project in school.
Anyway thanks for your suggestions.

by lordinfidel

Then I strongly urge you to go the route that is the standard in securing networks.

It's not really my idea, I did not invent the methodology. It is a standard design practice used by others like me who do this for a living on a large scale.

Pick up "Building Internet Firewalls" published by O'reilly. There you will understand why I said the design is incorrect for what you are trying to accomplish.

This discussion is closed to new replies.