3

I need some help to build my first subnet between two routers.

My office is located near another office, and those two offices are linked together with a network cable, and both offices have independent Internet access.

Each network has their own network IP scope:

  • Network A is 10.35.1.*
  • Network B is 10.35.2.*

I would like to set a subnet between those two networks, to share network resources.

How can I set up my DD-WRT router, to route those two networks?

Here is a quick sketch of the network’s design:

Actually all Subnet mask are 255.255.255.0

     Network  A                                Network  B

    PC1              PC2                 PC3              PC4         
(10.35.1.10)    (10.35.1.11)         (10.35.2.12)    (10.35.2.13)
     |                |                   |                |
     ------------------                   ------------------
             |                                    |
      Router A (DD-WRT)  --------------------  Router B
        (10.35.1.1)                          (10.35.2.1) 
             |                                    |
             |                                    |
         {Internet}                           {Internet}

Edit: Now I've added a manual static route in the router at 10.35.1.1 (highlighted in yellow in the image) But still can't ping 10.35.1.1 from Router TelNet or PC from the Network A Full routing table

5
  • 1
    Use a 2 IP (/30) "glue network" between them, and setup routes in the routers. For the best chances on getting a longer/more detailed and specific answer, what have you tried so far, and where are you getting stuck exactly? Also specifics about exactly which routers are in question, and exactly how they're wired together, would probably help. Oct 6, 2015 at 20:31
  • 4
    You already have "subnets". You need a route between these two. Oct 6, 2015 at 20:33
  • What route exactly? Here what I've try; Destination LAN NET: 10.35.2.0 Subnet mask: 255.255.255.0 Getway: 10.35.2.1
    – Hugo
    Oct 6, 2015 at 20:36
  • But with that route, the router at 10.35.2.1 remain unreachable
    – Hugo
    Oct 6, 2015 at 20:46
  • I've added the full Routing table in the question
    – Hugo
    Oct 7, 2015 at 15:54

3 Answers 3

3

First off, each local network would be its own subnet (which is shorthand for "subnetwork", where "network" refers to the entire network; in your case, the "network" is most likely the Internet). What you need to do is set up routing between the two subnets. They will remain separate entities, but traffic will be able to flow between them.

The first thing you need to confirm is that the IP ranges are non-overlapping. For example, 10.35.1/24 and 10.35.2/24 is fine, but 10.35.1.0/16 and 10.35.2.0/16 is not (because in the latter case, the IP ranges overlap and there is no good way for the router to know which traffic should go where).

I don't know exactly what steps you need to take to configure this in dd-wrt (as in "click here, type this, ..."), but what you need to do is:

  1. Physically connect Router A to Router B (either wired or wireless, direct or through a tunnel, but they need a way to talk to each other).
  2. Configure Router A to route any traffic intended for the network served by Router B (10.35.2/24) across its link to Router B.
  3. Configure Router B to route any traffic intended for the network served by Router A (10.35.1/24) across its link to Router A.
  4. On both routers, set up any necessary firewall rules to allow the traffic to flow between the networks served by Router A and Router B. Depending on the specifics this may or may not be strictly required.

Steps 2 and 3 (which are the magic sauce for making this work at all) are usually accomplished through setting up static routes. Any moderately competent IP stack provides a way of doing this, and I can't imagine that dd-wrt would be any exception, though the exact mechanics of how to do that vary. The general idea is to tell each router that "to reach the network a.b.c.d/e", it needs to "forward the traffic over link fghij" and/or "pass the traffic to next hop router k.l.m.n"; this is how all routing on an IP network such as the Internet works. If you are specifying a next hop router, then that router must be reachable through some other configured route.

For example, consider the following IPv4 routing table, which should be similar to what you have set up:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.254   0.0.0.0         UG    0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

What this says is: to reach network 192.168.1.0 netmask 255.255.255.0 (which corresponds to 192.168.1/24), use gateway 0.0.0.0 (that is, just dump the traffic onto the network) over the interface eth0. To reach the network 0.0.0.0 netmask 0.0.0.0 (or 0.0.0.0/0, the "default route"), the best option is to ask 192.168.1.254 to forward the traffic toward its ultimate destination. Only core network routers have no default route; that's called the DFZ or Default-free zone. When you get a "no route to host" error, it's almost always because you have hit a router that has no way of passing the traffic on toward the destination host.

Routes are always considered in a most-specific-match-wins fashion, and also as a consequence the default route is only consulted if no other configured route matches. Hence, if I want to route traffic to 172.16.128.0/23 over the physical link attached to eth1, I would end up with a routing table much like the following:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.254   0.0.0.0         UG    0      0        0 eth0
172.16.128.0    0.0.0.0         255.255.254.0   U     0      0        0 eth1
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

By making the corresponding change on the other side, I can ensure that the return traffic will be able to flow back to the originating network, enabling two-way communication over the dedicated link.

Once you have made this type of change in your dd-wrt configuration on both ends, hosts on the two networks should at least be able to talk to the router on the other end of the link. (At that point, it very likely comes down to configuring the firewall to allow appropriate traffic through.)

3
  • I've try to do what you tell me, but it still don't work. I've added a static route on each router. From the example above, I've added a route in the router A (DD-WRT Router) ; Dest: 10.35.2.0, Mask: 255.255.254.0 Metric 0 Gateway: 0.0.0.0 and on the Route B (Asus Router); Dest: 10.35.1.0, Mask: 255.255.254.0, Gateway 0.0.0.0, Metric 0
    – Hugo
    Oct 7, 2015 at 13:00
  • @Hugo Please edit your question to include the exact IP ranges and subnet masks for each network. (Because you are using RFC 1918 space, this should not present any problems.) I'm pretty sure the netmask you quoted is wrong; /23 is not a common prefix length on LANs (I used it only to illustrate the different routes).
    – user
    Oct 7, 2015 at 13:03
  • I'm not sure I understand what you mean by "range", what is the "/23" mean? actually all PC behind each router have a mask of 255.255.255.0, ans there respective Router's IP has default Gateway
    – Hugo
    Oct 7, 2015 at 13:10
0

It is actually an easy problem. The two DD-WRTs can be configured as an OpenVPN client-server pair, which allows merging of the two separate subnets.

Setting up the OpenVPN connection, in the bridged configuration is explained on this very clear DD-WRT wiki page. The configuration is sometimes called a site-to-site bridged VPN.

The only remaining thing to do is to persuade the two routers that the two subnets actually belong to a larger net. You can achieve this simply by using a wider subnet mask. The smallest one encompassing the existing nets is /22, or 255.255.252.0. This implies that you will have to change the subnet mask in the configuration GUI of each DD-WRT router. Once this is done, it will take some time (= the lease time, or 1 hour for most LANs) for the change to propagate to your DHCP clients.

Comments:

  1. Do not change the range of IPs assigned by each router. As they stand now, they are non-overlapping, which is all that matters.

  2. You will get some Layer 2 traffic crossing from one subnet to the other. This includes ARP traffic, and so on. If you have a commercially fast network, i.e., at least 10Mb/s, do not worry about that at all, you will not be wasting scarce bandwidth at all. Instead, you will have all protocols working across the divide, you can print on a printer in the other office, share directories and files, and so on: there are no restrictions, everything will work as if the two offices were one. If you really want to block layer-2 traffic the reference above shows you how to do it with ebtables, but it is not worth the pain.

  3. When a DHCP request is made, it is not clear which router will win the race, which means that you may have a 10.35.1.xx pc amidst 10.35.2.xx brethren. You do not need to worry about this: exactly because the two subnets are perfectly integrated, the system will work flawlessly no matter what. If however you are disturbed by this, all you have to do is to introduce an iptables rule, on each router which blocks DHCP replies (not the requests, which use raw sockets):

      iptables -A FORWARD -dport 67:68 -sport 67:68 -j DROP
    
  4. The system is robust. Seven years ago I setup one connection of this type between my home and my lab at the University where I work: the connection has never had a glitch.

3
  • Thank Marius for your input, but I'll like to do that part without a VPN
    – Hugo
    Oct 7, 2015 at 13:01
  • @Hugo Why? VPN provides total security, with a negligible overhead due to encryption. Oct 7, 2015 at 13:11
  • Security isn't a issue, since both network in a close loop. But later I'll try to add a third network (my home) via VPN. And from there I think a will try your suggestion.
    – Hugo
    Oct 7, 2015 at 13:15
-1

I finally give up, DD-WRT is way to buggy.

DD-WRT on Linksys WRT54G, build DD-WRT v24-sp2 (08/07/10) vpn (SVN revision 14896)

Wireless security keep switching to TKIP without reason, so my laptop and smart phone can't connect. PPTP VPN link between to DD-WRT incomplete route access.

What else, that I don't now...

I'll go with another solution.

But thank everyone for your input, I've learn I bit more from you!



Solution using Subnet Masking

For the record... I've been able to link to two network 10.35.1.0/24 and 10.35.2.0/24, together, using a different SubNet Mask. On each router, and every DHCP server you need to include both IP scope, witch is something like 255.255.252.0 (10.35.0.1 - 10.35.3.254). The Mask is a bit too wide, but it don't really matter for me actually. I'll add other subnet later.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .