Re: 3 Nics - Dual (Tripe) Homed Host

From: Travis Troyer (tm_troyer_at_hotmail.com)
Date: 05/11/04

  • Next message: ES11 Development Team: "pkg_info: read_plist: bad command '@conflicts acroread-3*' - proper resolution" 
    To: freebsd@stevenfettig.com, freebsd-questions@freebsd.org
Date: Tue, 11 May 2004 15:54:28 -0400

    >From: "Steven N. Fettig" <freebsd@stevenfettig.com>
    >To: Travis Troyer <tm_troyer@hotmail.com>, FreeBSD - questions
    ><freebsd-questions@freebsd.org>
    >Subject: Re: 3 Nics - Dual (Tripe) Homed Host
    >Date: Mon, 10 May 2004 09:55:46 -0500
    >
    >Travis Troyer wrote:
    >
    >>I have a FreeBSD system that acts as a NAT Gateway, currently providing on
    >>LAN with access to the Internet. I have added a third NIC, connected to a
    >>second LAN. The second LAN does not need internet access, but I would
    >>like it to be able to communicate with the first LAN. I have tried
    >>reading various sources, but have not found anything dealing with this
    >>situation. I would appreciate any help. Below is a diagram of my current
    >>setup and the output of ifconfig.
    >>
    >> Internet
    >> |
    >> [ xl0: DHCP assigned ]
    >> Router
    >> | |
    >> [ xl1: 10.0.0.1] [ xl3: 192.168.1.10]
    >> 10.0.0.0/24 LAN 192.168.1.0/24 LAN
    >>
    >>Output of ifconfig:
    >>xl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    >> options=8<VLAN_MTU>
    >> inet 24.33.126.252 netmask 0xffffff00 broadcast 255.255.255.255
    >> ether 00:60:97:74:35:b0
    >> media: Ethernet autoselect (10baseT/UTP)
    >> status: active
    >>xl1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    >> options=b<RXCSUM,TXCSUM,VLAN_MTU>
    >> inet 10.0.0.1 netmask 0xffffff00 broadcast 10.0.0.255
    >> ether 00:01:02:37:93:eb
    >> media: Ethernet autoselect (100baseTX <full-duplex>)
    >> status: active
    >>xl2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    >> options=b<RXCSUM,TXCSUM,VLAN_MTU>
    >> inet 192.168.1.10 netmask 0xffffff00 broadcast 192.168.1.255
    >> ether 00:01:02:cc:63:d2
    >> media: Ethernet autoselect (100baseTX <full-duplex>)
    >> status: active
    >>lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    >> inet 127.0.0.1 netmask 0xff000000
    >>
    >Travis,
    >
    >Although I have been dealing with routing for years, I can't claim I really
    >understand it well, so my advice may not be so intelligent, but here's a
    >stab at it anyway:
    >I think what you want to do is to bridge both LAN's. You need to tell your
    >gateway that in order to get to 10.0.0.0/24 from 192.168.1.0/24, you need
    >to tell the routing tables that the route to 10.0.0.0/24 is via xl1 and
    >vice versa.
    >
    >route add 10.0.0.0/24 -interface xl1
    >
    >and vice versa:
    >
    >route add 192.168.1.0/24 -interface xl2
    >
    >In the handbook, it says
    >(http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-bridging.html):
    ><--begin quote-->
    >19.5.4 Enabling the Bridge
    >
    >Add the line:
    >net.link.ether.bridge=1
    >
    >
    >to /etc/sysctl.conf to enable the bridge at runtime, and the line:
    >net.link.ether.bridge_cfg=if1,if2
    >
    >
    >to enable bridging on the specified interfaces (replace if1 and if2 with
    >the names of your two network interfaces). If you want the bridged packets
    >to be filtered by ipfw(8), you should add:
    >net.link.ether.bridge_ipfw=1
    >
    >
    >as well.
    >
    >For FreeBSD 5.2-RELEASE and later, use instead the following lines:
    >net.link.ether.bridge.enable=1
    >net.link.ether.bridge.config=if1,if2
    >net.link.ether.bridge.ipfw=1
    ><--end quote-->
    >
    >I am not sure if this will work, though, because I'm not sure what effect
    >(if any) it would have on the NAT from the 192.168.1.0/24 network. You
    >might want to first try this approach while NAT and the firewall are turned
    >off. I have a similar situation that I want to test, so I'd be curious if
    >you succeed and how.
    >
    >Steve Fettig
    >

    Steve,

    Thank you for your suggestion, however, I gave that a try, and really wasn't
    getting anywhere. For the sake of not angering the roommates too much by
    having to disable NAT, I tried every option but that. In my research I
    found out about Virtual Hosts, or IP aliasing, and, since there were only
    two machines on the 10.0.0.0 network that needed to access machines on the
    192.168.1.0 network, and they were both running FreeBSD, I simply gave each
    machine a second IP on the 192.168.1.0 network, and everything is working
    fine. In case you're interested, I used this bit of information:

    http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/configtuning-virtual-hosts.html

    I'm not sure if you were aware of aliasing, as I was not, or if this fits
    your situation as well as it did mine. I'm curious now as to whether or not
    my gateway/router machine could still provide connectivity between the two
    networks, via the virtual hosted interface, for clients on both LANs.
    Though my setup suites me now, I may give that a try.

    Regards,

    Travis Troyer

    _________________________________________________________________
    MSN Toolbar provides one-click access to Hotmail from any Web page – FREE
    download! http://toolbar.msn.com/go/onm00200413ave/direct/01/

    _______________________________________________
    freebsd-questions@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"

  • Next message: ES11 Development Team: "pkg_info: read_plist: bad command '@conflicts acroread-3*' - proper resolution"

    Relevant Pages

    • Re: Home computer network problem
      ... I tried rerunning the network setup wizard but when I applied LAN setting it finished the wizard. ... Still if anyone feels they can offer more simple instructions to allow me to fix this & so share folders over my home network I would again be grateful for your help & will give it another try! ... I don't recommend either McAfee or Norton so don't have those programs running on any machines; therefore, I can't check the exact location of those configuration options for you. ...
      (microsoft.public.windowsxp.network_web)
    • Re: Firewall Questions
      ... No firewall. ... > sketch their idea of what they saw as a new network plan. ... > They want this firewall to be in NAT mode where everything in the LAN ...
      (comp.security.firewalls)
    • Re: 56k dial up on laptop 802.11G ?
      ... are you now a believer that I can control outgoing traffic without ... >>the definition of a network firewall. ... > that NAT is a real firewall because it functions to protect the LAN ...
      (alt.internet.wireless)
    • Re: VDQ : machine names??
      ... One other way that I've tried is to use system-config-network, and edit the configuration of eth0; but that seems to be little more than a pacifier. ... I want something that shows up in the prompts, and that I can use in ssh and scp, without having to look up IP numbers on the router all the time -- especially since not all LAN machines are on one floor. ... When your system connects to the network, it can tell the network which name it wants to be known as. ...
      (Fedora)
    • Re: Routing between subnets with a twist
      ... different network shared only with the router, ... connected to the LAN network via a separate router. ... What I suspect you're hoping for is to use the SBS single-NIC, ... machines and router all on the same network, and to use the second SBS ...
      (microsoft.public.windows.server.sbs)