192.168.4.1 ip to connect to 10.132.116.1 ip

[MadSmiler]

Hello,On the sixth form Wifi, they connect with a 192.168.0.1 address and the website is on a 10.132.116.1 address. Because of this, the wifi will not allow the kids to go to the website. I am trying to build a network bridge with no success.

 

You are unable to ping any internal ips while being on the wifiHas anyone get any ideas?ThanksAlex

[themightymrp]

It is a routing issue that you have. You need to either use a router or a layer-3 switch with routing enabled and assign that device IP addresses on both ranges. There is also likely VLAN's in use so you'll have to check the IP ranges for each VLAN.

[Davit2005]

Try the website via IP address.

 

Is the WiFi network setup using a Firewall as a gateway for the WiFi subnet??

[Opendium_Steve]

Hello,On the sixth form Wifi, they connect with a 192.168.0.1 address and the website is on a 10.132.116.1 address. Because of this, the wifi will not allow the kids to go to the website. I am trying to build a network bridge with no success.

 

You are unable to ping any internal ips while being on the wifiHas anyone get any ideas?ThanksAlex

 

There's no reason why 192.168.0.1 address can't talk to 10.132.116.1 so long as they are both on the same LAN (i.e. no hops over the public internet), your routers all know about both subnets and there are no firewall/acl rules blocking the traffic.

 

Start by looking at the default gateway of the machine connected to wifi - that will be something on the same network (192.168.something - lets say 192.168.0.254 for the sake of this example). Figure out what device has the 192.168.0.254 address and check its routing table.

 

Do the same for the web server - it should have a default gateway on its network (lets assume 10.132.116.254). Figure out which device has the 10.132.116.254 address and check its routing table.

 

You should be able to find a route in both directions by tracing through all the routing tables of intermediate devices. In a well set up network I would expect only one or two routers:

- Either you'll have a single layer 3 switch on both the 192.168.0.254 and 10.132.116.254 addresses - in this case your problem is almost certainly ACLs on that switch or on your wifi system.

- Or you'll have a layer 3 switch handling your wired network and a separate router (the wifi controller, or a separate firewall) handling the wifi traffic. In this case you need to make sure that the layer 3 switch and the separate router have routing for each other.

 

If you've got more than two routers, probably best to start running away from the mess.

 

Be careful to avoid opening up any massive security holes - it goes without saying that the kids on wifi should probably not have free access to everything on the wired network!

[MadSmiler]

We are using VLANS so 10.132.116.1 and 192.168.0.1 don't talk to each other.

 

I've been trying to setup a source NAT and LLB policy which has worked but it has allowed anyone on the WIFI to connect to ANY IP.

[Davit2005]

We are using VLANS so 10.132.116.1 and 192.168.0.1 don't talk to each other.

 

I've been trying to setup a source NAT and LLB policy which has worked but it has allowed anyone on the WIFI to connect to ANY IP.

 

If using a Layer3 switch to do IntervLAN routing then normally traffic would route as long as their are no ACL's to block. I suspect the Firewall is doing the DHCP for the WiFi and handling routing hence why traffic will not go between the vlans.

[Opendium_Steve]

We are using VLANS so 10.132.116.1 and 192.168.0.1 don't talk to each other.

 

I've been trying to setup a source NAT and LLB policy which has worked but it has allowed anyone on the WIFI to connect to ANY IP.

 

VLANs don't prevent devices from talking to each other, they just prevent them talking _directly_ to each other - i.e. the traffic has to go via a router. Assuming both VLANs use the same internet connection, you'll already have a router between the two networks since that's required to give them internet access. My guess is that the internet router is set up not to forward traffic between the wifi and wired VLANs, so this is where you should be looking.

 

To be honest, it sounds to me like you're going about things the wrong way:

- NAT should be avoided wherever possible. Its basically a bodge to deal with the shortage of public IPv4 addresses, and it breaks stuff while offering almost no security. NAT has no place within a LAN - it should only be used when connecting a LAN to the internet.

- Since you almost certainly already have a router between the two VLANs, that's where you should be looking. Figure out why that router isn't passing the traffic between the two VLANs - you probably just need to adjust the ACLs.

- Adding a second router between the two VLANs is going to overcomplicate the network and provides a second place where ACLs can be misconfigured to inadvertently create security problems.

- Depending on your network design, it's probably not actually possible to add a second router without either manually adding static routes to all of the client devices (unmaintainable, and not possible on many devices), using ICMP redirects (an unreliable bodge that requires you to reconfigure the main router anyway) or using some horrendous mix of NAT and possibly proxy-arp (an unreliable bodge that will be an almighty headache in the long run).

[AlanD]

I assume both networks have a default gateway which I am guessing might not be same as the gateway you are creating. Once you create a route from one network to the second, you must also add a route back from the server on the second network to the first. So on the server in a cmd window type route add network1 mask gateway. Where network1 is something like 192.168.0.0 and mask is 255.255.0.0 and gateway is the network2 gateway address if it's not the default gateway.