<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#ffffff" text="#000000">
<font face="sans-serif">Hey folks,<br>
<br>
Although I've set up many routers at small businesses and
residentially for friends, when I've had more than one router at
one site, I've always just turned on NAT instead of doing (what I
gather is) the more advanced "proper" way to do it, with
sub-netting. I.e. what I normally do is, if the first router
(with external IP on its WAN) is giving LAN addresses
192.168.99.x, I'll hook the second router's WAN port to that .99.x
LAN, and set the second router to, say, use LAN addresses
192.168.88.x. The second router uses NAT when its clients send
traffic to the first LAN (or internet), and the first router also
uses NAT when its clients send traffic to the internet. This
works fine when basically all I need is just a bunch of machines
to have internet access (and if there are any in-house servers,
file shares, printers, etc, they are only on the first LAN).
There is no manually added routing rule on the first router to
allow hosts on the first LAN to reach hosts on the second LAN.<br>
<br>
I think I have a good handle on what a netmask of different
lengths means and now I'm trying to put the theory to practice.
Actually this is eventually for a VPN set-up but I'm trying with a
LAN first to make sure I understand that.<br>
<br>
Picture three routers and two computers...<br>
<br>
</font><font face="sans-serif">"middle router" has (for now) nothing
connected to WAN, just LAN<br>
</font><font face="sans-serif">"left router" has its WAN jack
connected to a LAN jack of middle router<br>
</font><font face="sans-serif">"right router" has its WAN jack
connected to a LAN jack of middle router<br>
</font><font face="sans-serif">"left computer" is connected to LAN
jack of left router<br>
"right computer" is connected to LAN jack of right router<br>
<br>
I'm trying to stick to whatever "normal" routing rules are added
in a vanilla consumer router when you set up its LAN and WAN
ports. I.e. how do I do this with only setting addresses,
netmasks, and gateways, no custom added routes?</font><br>
<font face="sans-serif"><br>
My understanding thus far (taking the 192.168.x.x private address
space for example) is that the whole network could be
192.168.x.x/16, and the left sub-net could be 192.168.1.x/24, and
the right sub-net could be 192.168.2.x/24.<br>
<br>
left computer: 192.168.1.10/24 (say, via DHCP from left router)<br>
<br>
left router LAN: 192.168.1.1/24<br>
left router WAN: 192.168.1.2/16<br>
<br>
middle router LAN: 192.168.0.1/16<br>
middle router WAN: (un-used in this experiment, could naturally be
external IP later, with normal vanilla NAT)<br>
<br>
right router LAN: 192.168.2.1/24<br>
right router WAN: 192.168.2.2/16<br>
<br>
right computer: 192.168.2.10/24 (say, via DHCP from right router)<br>
<br>
<br>
I guess the main thing I'm doubtful about is the left router (and
same issue for right, but just take left for now)... Does it make
sense or it is valid for it to have LAN .1.1/24, and WAN .1.2/16?
i.e. do these final digits .1 and .2 need to be different?<br>
<br>
or could it validly have LAN .1.1/24 and WAN .1.1/16 and these
are different enough because one is actually [network 192.168.1,
host .1], and the other is actually [network 192.168, host .1.1] ?<br>
<br>
Now after phrasing the question, I'm thinking this is not possible
without manually added routes</font><font face="sans-serif">
(two?)</font><font face="sans-serif">, at the very least on the
middle router. Even though its full network (192.168.x.x/16) is
"in-house" and "under" its LAN, it only knows for sure the
addresses of the left and right router, not the left and right
computer under those. So then if I'm right about that, what would
the rule on the middle router be? and could the left and right
router still just be set up with vanilla address/netmask/gateway
and no further NAT or routing settings?<br>
<br>
On the third hand, I'm also thinking now that the left and right
routers' WAN addresses should be in a different block of the big
sub-net, not in blocks also covered by their sub-net LANs. Like
192.168.0.10, and .0.11.<br>
<br>
Thanks in advance for any insights you can share (including
starting from scratch with totally different blocks of numbers; in
fact that might be clearer than suggesting many changes to the
above).<br>
<br>
Martin<br>
<br>
<br>
</font>
</body>
</html>