Author Topic: Subnets routing?  (Read 736 times)

Gabriele

  • Newbie
  • *
  • Thank You
  • -Given: 2
  • -Receive: 2
  • Posts: 43
    • View Profile
Subnets routing?
« on: November 07, 2017, 02:27:13 pm »
Hi all,

my home OS/2 server has three network interfaces. Currently I'm using just two of them, with Injoy in the middle acting as firewall and providing NAT for the LAN.

I would like now to use the third network interfaces to create a second LAN where I would confine the increasing number of "Internet Of Things" devices around.

Unfortunately, I know nothing about routing! With a setup.cmd file like this one:

route -fh
arp -f
ifconfig lo 127.0.0.1
ifconfig lan0 192.168.0.1 netmask 255.255.255.0 metric 1 mtu 1500   # existing LAN
dhcpstrt -i lan1 -d 0                                                                               # WAN
ifconfig lan2 192.168.2.1 netmask 255.255.255.0 metric 1 mtu 1500   # the hypothetical second LAN
inetcfg -s all
ipgate on

devices on lan0 would be effectively hidden from devices on lan2?

Thanks!
Gabriele



Andreas Kohl

  • Full Member
  • ***
  • Thank You
  • -Given: 4
  • -Receive: 9
  • Posts: 169
    • View Profile
    • warpserver.de
Re: Subnets routing?
« Reply #1 on: November 07, 2017, 07:07:38 pm »
Hi all,

my home OS/2 server has three network interfaces. Currently I'm using just two of them, with Injoy in the middle acting as firewall and providing NAT for the LAN.
I don't know about Injoy's features but I doubt that it can provide NAT for the LAN. But it can probably do for a subset of the IP networking stuff.

Quote
I would like now to use the third network interfaces to create a second LAN where I would confine the increasing number of "Internet Of Things" devices around.
For a second (dedicated) LAN an additional physical network infrastructure etc. is required. Static routes will not help much. I don't know what you want to achieve? More reliability or higher theoretical bandwith? A working solution will require the analysis of the common network traffic and the used protocols. At the next step you should define some requirements or usage scenarios.

Dave Yeo

  • Hero Member
  • *****
  • Thank You
  • -Given: 7
  • -Receive: 88
  • Posts: 1142
    • View Profile
Re: Subnets routing?
« Reply #2 on: November 08, 2017, 01:33:37 am »
I don't know about Injoy's features but I doubt that it can provide NAT for the LAN. But it can probably do for a subset of the IP networking stuff.

Works fine here (the Injoy Dialer) for providing NAT for my LAN.

Ian Manners

  • Global Moderator
  • Full Member
  • *****
  • Thank You
  • -Given: 30
  • -Receive: 18
  • Posts: 243
  • I am the computer, it is me.
    • View Profile
    • OS/2 Site
Re: Subnets routing?
« Reply #3 on: November 08, 2017, 12:26:20 pm »
InJoy Firewall includes NAT, you can also run more than one copy to create two subnet's but this is something I've not done for over 10 years and have no idea if Bitwise works version allows that (including in it's license).

With your x:\mptn\bin\setup.cmd file, you can add other routes without problems even without using InJoy but once more this is something I am very rusty with as it's been so long.

route -fh
arp -f
ifconfig lo 127.0.0.1
ifconfig lan0 192.168.0.1 netmask 255.255.255.0
dhcpstrt -i lan1 -d 0
ifconfig lan2 192.168.2.1 netmask 255.255.255.0
route add default 10.0.0.1 netmask 255.255.255.255 -hopcount 1

experiment with:-
==> route add -net xxx.xxx.xxx.xx netmask 255.255.255.255 -hopcount 1
or
==>route add -host 192.168.2.1 10.0.0.2

ie, you need to add a route from your second network to where you want the packets to go, also, hmm, no idea how it works with DHCPd :o)
I would use static IP's as its easier to plan out on paper, then use InJoy's DHCPd module to hand out IP's if you need to for other devices.
Actually, come to think of it.. I think you can setup InJoy with a seperate range for it's DHCPd to the two static ranges ..

Quote
devices on lan0 would be effectively hidden from devices on lan2?
Assuming your routing has been setup correctly then yes, devices on LAN2 can be hidden from LAN1 but remember this is only on the software layer. Unless it is required I would setup your internet modem/router with a second internal IP if it has more than one ethernet port and physically separate the networks. Depends on what you wish to do like monitor via InJoy's GUI etc.

Hope I'm not confusing you, I'm getting old :)
Cheers
Ian B Manners

Lars

  • Full Member
  • ***
  • Thank You
  • -Given: 0
  • -Receive: 20
  • Posts: 145
    • View Profile
Re: Subnets routing?
« Reply #4 on: November 09, 2017, 09:51:18 am »
Giving it a guess:

route add -net 192.168.0.0 netmask 255.255.255.0 192.168.2.1
route add -net 192.168.2.0 netmask 255.255.255.0 192.168.0.1

What the first line should should do is allowing to access network 192.168.0 via the gateway 192.168.2.1, that is access to whatever attaches to lan0 from lan2.
The second line works vice versa: it allows access to network 192.168.2 via the gateway 192.168.0.1, that is access to whatever attaches to lan2 from lan0.

If you want to get lan1 into play, I would assume that it is seen under gateway 10.0.0.1:
route add -net 192.168.0.0 netmask 255.255.255.0 10.0.0.1
route add -net 192.168.2.0 netmask 255.255.255.0 10.0.0.1


Gabriele

  • Newbie
  • *
  • Thank You
  • -Given: 2
  • -Receive: 2
  • Posts: 43
    • View Profile
Re: Subnets routing?
« Reply #5 on: November 11, 2017, 10:33:04 am »
Thank you everybody for your replies! What is most important to me is that "Internet of things" devices on LAN2 can't access the PCs on LAN0. I read that too often such devices can easily be compromised and I don't want a hacked air conditioner accessing my wife's Windows 10 PC :-)

So, if I understand well, if I don't add a "route add" command from LAN2 to LAN0, devices on LAN2 will not be able to scan what is on LAN0. Is this correct? Ian, when you say: "Assuming your routing has been setup correctly then yes, devices on LAN2 can be hidden from LAN0 but remember this is only on the software layer", what do you mean with "this is only on the software layer"? I could connect LAN2 directly to the provider's modem, but then I would loose any control on the traffic happening on that LAN.

The best thing would be being able to access devices on LAN2 from PCs on LAN0 and forbid the other way, but I guess I need to start the IBM firewall service for that and I don't want to start playing with it... I can live accessing devices on LAN2 directly from the gateway server.