1

I have a networking issue similar to Route to a server on subnet. I have tried the solution but without success.

Here is my network topology:

Internet
    |  
    | 
   ADSL 
x.x.x.x (external)
Linksys WAG120N (Router1)---------------------+
255.255.255.0                                 |
192.168.1.1 (internal)                        |
  DHCP active                                 |
    |                                         |
    |                                         |
    |                                         |
LAN-to-WAN                                    |
192.168.1.2 (external, static)          192.168.1.100 (DHCP)
D-link DSL-2730E (Router2)                 PC1 Windows 10
255.255.255.0                        
192.168.2.1 (internal)
  DHCP active
    |
    |                             
192.168.2.2 (static)          
Ubuntu Server 16.04 with node server on Port 3344

Additional info:

  • Router1 is connected to Router2 LAN-to-WAN
  • both routers is NAT-enabled, dynamic routing disabled
  • Router2 SPI firewall protection switched off, unblocked anonymous WAN request
  • Router1 port forwarding to 192.168.1.2 WAN port 3344, LAN port 3344 TCP
  • Router2 port forwarding to 192.168.2.2 WAN port 3344, LAN port 3344 TCP
  • I can ping Router2 192.168.2.1 from my PC1
  • I cannot ping the server 192.168.2.2 from my PC1

The port forwarding is working and the server is responding when the traffic is coming from the internet i.e. when I enter the Router1 external IP address and the forwarded port x.x.x.x:3344 in a browser on PC1, I get a response in the browser. Strangely, when I enter Router2 external IP address 192.168.1.2:3344 or Router2 internal IP address 192.168.2.1:3344 (via static route) in the browser on PC1 which I expect the Router2 to forward the traffic to my server@192.168.2.2:3344, neither of them works, on Google Chrome it says "This site can’t be reached". Am I missing something? Thanks in advance.

Edit1:

  • The reason I want to separate two subnet is because I want to block the internet access of the 192.168.2.0/24 subnet.
  • I also tried to set up a static route on my Router1 with destination to 192.168.2.0, subnet mask 255.255.255.0, next-hop address 192.168.1.2, there is only one interface available which is a1 interface and the metric to 1 (not sure what it does), but still no luck.

Edit2:

  • My goal is to block internet access completely for the 192.168.2.0/24 subnet and to allow internet access for the 192.168.1.0/24 subnet.
  • There will be about 12 android client devices connecting to the server in the 192.168.2.0/24 subnet which are not allowed to access the internet except the server.
  • Another reason I want to use a separate subnet is because it will be easier to manage the internet access filter by filtering the whole IP range (except the server) in the subnet through a single router.
0

If you don't need to have two separate network 192.168.1.0/24 and 192.168.2.0/24 connect your first router to the second router via LAN ports. Second way - try to setup static route on your PC or on the first router: if the source is LAN IP (192.168.1.0/24) and the destination is 192.168.2.0/24 direct the packet to the LAN interface (on the first router).

  • thanks for the suggestion, I have considered this option but I would like to separate the network because I want to block the internet access of 192.168.2.0/24 subnet to prevent internet access traffic congestion. – lanette May 8 '18 at 15:02
  • @Tim_Stewart, thank you for your response, I should explain that I am designing the 192.168.2.x subnet for my company production floor internal reporting use and we worry that our employees will spend too much time in the internet rather than work so we need a separate subnet so that I can filter the IP/MAC address for internet access from my Router2, we also need to access the server from the 192.168.1.x subnet (my office) to get the data, I'm aware that this is not perfect, or is there a better way to do this? – lanette May 8 '18 at 15:44
  • Use the instructions I gave you, when you have qos setup, move to this link, it will allow you to deny internet access to any PC end-station you want...linksys.com/us/support-article?articleNum=136710 – Tim_Stewart May 8 '18 at 15:56
  • @Tim_Stewart, please allow me to correct myself that my goal is to block internet access completely and not to prioritize services, I don't see how QoS will help. Furthermore, we are using android app to post data to the server, so it will be difficult for me to filter each device's IP/MAC address and that's why I would like to have a separate subnet to manage the IP addresses so that I can filter the whole IP range in the subnet except for the server (as it will need to access the internet). This will save me more time and hassle than to maintaining the IP address filter for each device. – lanette May 8 '18 at 16:39
  • You should add the corrected information to your question when you have time. Just in case someone else has a better answer to this. This will be difficult on you under any circumstances. You are using consumer grade routers (home-routers) for a business network. And quite frankly you get what you pay for in terms of features. It's very common to have employee Macs in a organized list, give instructions to the employees for the Android OS to retrieve the wireless Mac and email it to you. I'm not sure if you can do ip ranges with these routers filter options honestly. – Tim_Stewart May 8 '18 at 16:51
0

You have contradicted yourself. You are trying to port forward to the server, to open a port to the internet for your server. but then say that you want to block internet access for the 192.168.2.0 /24 network.

The way to control congestion on your LAN is to use quality of service at the main router, or if you have used qos and are fully utilizing the ISP connection with qos, you would upgrade the ISP plan to one with more bandwidth.

This is how you would set it up:

ADSL (wag120N).
SSID = "home-net".
LAN IP address = "192.168.1.1 255.255.255.0".
DHCP-Pool = "192.168.1.2 - 192.168.1.249".
WPA2-PSK = "MyPass1234!".
security type = "AES only".
Firewall = on!
Channel-1.

D-link DSL-2730E.
MODE = AP.
SSID = "home-net".
LAN IP address = "192.168.1.254 255.255.255.0".
DHCP = "disabled on this router!".
WPA2-PSK = "MyPass1234!".
security type = "AES only".
NAT & Firewall = OFF!
Channel - 6 or 11.
Connect the two, (router1 Lan port) to (router2 Lan port)

Ubuntu Server 16.04 192.168.2.250 255.255.255.0

Write down the Mac address of the servers nic. You will need it for the next steps.

Now is a good time to do a speakeasy.net speed test to determine what the actual throughput is you are receiving from your ISP. Make sure no one is using the internet when you do, you want it to be accurate. Disconnect users if you need to. Write down the total up/down. Go to 192.168.1.1, login via your admin/password.

Click on the Applications and Gaming tab then select QoS from the sub-tabs.

NOTE: Wi-Fi Multimedia (WMM) Support is a wireless QoS feature that improves quality for audio, video, and voice applications by prioritizing wireless traffic. It is Enabled by default.

Under the No Acknowledgement section, keep this disabled.

On the Internet Access Policy Priority field, select Enabled.

NOTE: You can set the Upstream Bandwidth to Auto or Manual. Auto will set the upstream bandwidth to 512 Kbps. Use manual, enter the total up/down that you wrote down earlier. Enter it in this field about 10% lower for up/down then what you wrote down. The idea is to have a bottleneck on your side of the connection, that you are in control of, not the ISP routers.

Click on the drop-down arrow to select the appropriate Category based on how you want to set up priority. Create a name to easily identify the device and enter its MAC Address then select the desired level of priority.

Click to save your changes.

NOTE: The settings you made would appear right away in the Summary field below.

That's pretty much it, if you don't want the server traffic interfering with your home network traffic, set the server to a lower priority then the rest of the homes clients.

I hope this helps you out.

  • As an added bonus, following these instructions will make a seamless roaming network where wifi clients will switch to the highest strength AP without intervention. The wpa2 key and SSID must be the same for it to work. – Tim_Stewart May 8 '18 at 16:21
  • I have made an exception not to block the internet access of the server by assigning it a static IP address outside the DHCP range and only filter the internet access of the IP range assigned by the DHCP of the Router2. – lanette May 9 '18 at 2:28
  • I have tested the port forwarding and the server is responding when the traffic is coming from the internet i.e. when I enter the Router1 external IP address and the forwarded port x.x.x.x:3344 in a browser on PC1, I get a response in the browser. Strangely, when I enter Router2 external IP address 192.168.1.2:3344 or Router2 internal IP address 192.168.2.1:3344 (via static route) in the browser on PC1 which I expect the Router2 to forward the traffic to my server@192.168.2.2:3344, neither of them works, Google Chrome says "This site can’t be reached". – lanette May 9 '18 at 2:44
  • If you have blocking rules, put them both in the same subnet (bridge the two). You are jumping through hoops for something very simple.... – Tim_Stewart May 9 '18 at 4:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.