Net Infrasturcture all wrong...

[WillShakespeare]

Hi all,

We have just upgraded our DC in Spain to W2K along with the rest of the servers over here. They have an ADSL router with an internal IP of 192.168.0.1... this goes to one NIC in the server as 193.xxx.xxx.159 (an external address). There is a second NIC connected to the hub which goes to the internal machines. This 2nd NIC is 192.168.0.3, and the internals machines use DHCP. At the moment, they access the internet by going through the hub and straight into the ADSL router. These internal machines can see the server, and the internet, but cannot see our network over here.
Also, we can see their server, but not the internal machines. The server over there can see both us and the internal network there... obviously we need to set up some sort of NAT or Bridging between the two NICs. Can anyone help with that? When we tried to turn on Internet Connection Sharing for the main NIC, it comes up with a warning saying that the NIC will default to 192.168.0.1, which is a problem because the ADSL router uses this IP staticly...

Anyone?

WIll

PS - Before anyone starts explaining how this is an unsecure setup, I know this already! We are planning to utilise one NIC in the server, and then a hub that internal machines and a firewall attach to. The external firewall connection goes to the ADSL which has 192.168.0.1. If anyone knows how we can do this, as well, we'd also appreciate input. Can the External IP on the firewall have an external address if it connects to an internal address on the router?

 

[MattWray]

How are the remote machines connecting to the Network? VPN , RAS? We have a setup with 2 VPN router endpoints with a permanent tunnel connected to our corporate headquarters. This works well for us... Thanks,

Matt Wray

 

[WillShakespeare]

Hi Matt, yes the WAN is through a VPN connection. Essentially the VPN is through their ADSL line to our UK leased line. I'll draw a diagram...

______ _________ |--wkstn
| | | | _____|--wkstn
| | ______ | SPAIN | | |--wkstn
| UK |------VPN---|ADSL|---|NIC1 | ___|____
|ROUT| |____| | NIC2|----| HUB |
| | | | | |______|
|____| | |_______| |
| |
|_____________________|


The Workstations can see the internet because of the connection from the hub direct to the adsl router... they can also see the server through NIC2 which is 192.168.0.2
Wkstns are DHCP in this range. NIC1 has two IPs, an external which it always had, and also 192.186.0.3
The ADSL router has 192.168.0.1
We can RDP to the Spain Server, and then do an RDP from that server to the internal network, but this isn't ideal. Plus, people in Spain need access to resources on the UK server network. AT the moment, we have to copy across to Spain, and then give them access which is not ideal.
We'd like to get rid of the link from the hub to the ADSL router, and have the wkstns access the internet, the VPN, and our network through NIC2. I'm sure there is a simple config to do here, but can't find any documentation to the effect.

Any ideas MATT, or anyone?

Will

PS - I'd like details of how your connections are set up matt, as currently the VPN connection to the network must be initialised manually before we can connect.

 

[WillShakespeare]

Bugger... you need to cut and paste into a mono spaced font environment to see the above diagram successfully...

Will

 

[WillShakespeare]

Though here it is in Arial...
______ ________ |--wkstn
| | | | _____|--wkstn
| | ______ | SPAIN | | |--wkstn
| UK |------VPN---|ADSL|----|NIC1 | ___|____
|ROUT| |_____| | NIC2|----| HUB |
| | | | | |_______|
|_____| | |_______| |
| |
|_________________|

 

[WillShakespeare]

Right, let's try it this way... (using TGML)

Will

 

[WillShakespeare]

We actually RDP to the Spain Server using the external IP address, so this is visable using the VPN connection... I gues it goes traight through the ADSL router to NIC1.

Let me know what you all think...

Will

 

[MattWray]

You can remove the link from the ADSL Router to the hub. Set up NAT in RRAS, for network routing. We used to have the same setup, workstations connected to switch, then thru the server to the router.
Let me get this straight. You can connect to the 193.x.x.x NIC in the server, but cannot get inside? If this is the case, NAT should correct this problem...
Here is a link for network routing, and don't forget to add a static route for 0.0.0.0 with mask 0.0.0.0 out your external interface on the server/router...

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q299810&sd=tech

Thanks,

Matt Wray

 

[SupaTech1]

RRAS will fix the problem