I have a server and a client PC directly connected to the same desktop switch. But I also want to put a dedicated separate high speed link between them as well. The aim being to connect them to the internet and LAN with 1G but traffic between PC and server is at 10G:
If relevant, the PC runs Windows 10 on an Asus workstation board, and the server runs FreeBSD 12 on a Supermicro board. Both have Intel 1G and Chelsio 10G NICs, and both baseboards have fully featured workstation/server firmwares. Both are in the same LAN-wide subnet at present.
My questions:
- What are the more correct or easily implemented way(s?) to configure the PC and Server's networking, so that the loop doesn't cause networking issues? Meaning, traffic between the PC and Server can only go via the 10G link, and traffic to/from any other devices can never go via the 10G link?
(So that if I disconnect the wire between PC and switch, the PC isn't still connected to other LAN devices via the loop through the server)
- If in future I upgrade the switch to a fully managed switch that can handle access controls, such as Netgear ProSAFE, or I start to use VLANs on it, does the "correct answer" change?
Update
As the comments are getting long, this is a summary of some of the issues that they have revealed, which have made this a difficult question.
The main issue is that the network is DNS based. That's important because IP addresses don't show up in Windows file explorer, only discovered host names do. An IP address can be used for a SMB file server and its shares, but it will have to be manually entered every time a file share is accessed, and many programs unfortunately don't have scope to enter a manual path, its expected that all browsable devices will appear in a populated file explorer navigation tree, or descend from one of a list of discovered devices. So using the 10G IP for the server isn't a reliably viable solution.
(Discovery is presumably DNS or WS-discovery from the PAC, and DNS/WS-Discovery/mDNS-bonhour from some other devices. SMBv1/NetBIOS/WINS are all disabled - thanks for noting this aspect @user1686)
The fact that the server has 2 unbridged NICs, one of which has no link to the DNS server and is direct point to point, presumably means its IPs need to be distinct. (And the 10G IPs will need to be static, as there's no DHCP on that link/subnet).
I also suspect I have to block discovery via the 1G link separately if it doesn't use DNS, or configure discovery to use DNS and no other method - from memory one can configure Windows with which discovery methods are enabled and what order to try them in, and specify DNS only? Again thanks @user1686
From the answers, I think I see perhaps 3 possible solutions. Which would be more correct, or are they all valid?
Possible solution 1?
What i get from the answers so far is that if the 10G are in a different subnet and the PC hosts file is manually hacked to override DNS and use the 10G IP for the server and routing or firewalling is set up that ensures the servers 1G IP isn't reachable from the PC, that sounds like it would work.
But its incredibly clumsy and feels like a "hack job". Too much manual overrides set on individual machines. I don't know if that's "normal".
Possible solution 2?
Another option relies on the local DNS running on Unbound
, which (like BIND
) supports views. That means the DNS server can be configured to give the usual IP of the server to all devices at lookup, but the servers 10G IP to the PC (only). I'm not sure if that's sufficient - is it?
If it is then a solution might be: LAN subnet 10.0.0.0/8, server 1G IP allocated by DNS to say 10.0.0.1 server 10G static 10.0.0.2, and then use DNS to provide the server's 1G IP to all devices except the PC, but return the server's 10G IP + the PC's 10G NIC as its first hop/gateway, to the PC.
Naively the result would be: The 1G and 10G IPs are on the same subnet so the server is seen as being on the correct subnet by the PC. But the 10G IP is invisible to all other devices, and the 1G IP is visible but ignored by the PC, so no conflict arises. So its almost all done in DNS.
Is this workable?
Possible solution 3
Same IPs as above (2), but configure DNS to return both IPs to all devices. Non-PC LAN devices will fail to find 10.0.0.2 and eventually decide that 10.0.0.1 is the IP used. The PC gets firewalled so it drops all packets to 10.0.0.1, and thus decides that 10.0.0.2 is the only working IP (it may need a first hop hint). So again its all done in DNS barring a firewall entry to block the 1G loop.
Workable as well?