Post #124,419
11/6/03 12:34:31 AM
|
I'm *always* ready to give more info. :)
> Well, as long as the external world sees
> what it did before, your VPN will be fine.
The problem is, the external world used to see three different networks, and now it only sees one.
>So your internal network - lets say will be be 192.168.1.x
> - these go to some router - say a Linux box with a kernel
> that does iptables - having 2 NICs - the external NIC will
> be configured as one of the IP addresses your provider gave you...
> Can you now give some info about the VPN and how it was connected before?
The thing I think I'm not making clear is that I don't want ALL of the traffic to go through the VPN box--I want it to continue to be a 'back door' into the LAN, mostly because I want the normal traffic to go through hardware (like the PIX), not software (like a Linux box). Obviously there's HW and SW on both, but I think you understand what I mean.
The VPN used to bridge its virtual ethernet tap device with the internal NIC. AFAICT, it can't work if both the external and internal NICs are on the same network. So I need an 'external' network now. The only network I have besides the Nat'ed internal one (192.168.0.0) is the set of IP's the ISP is doling out--problem is, there's only one ethernet jack on their router, and that goes straight into the WAN jack on the PIX router that we own. So I think I'll try putting them both on a hub I've got lying around and see if I can get all three devices (the ISP's router/gateway, the PIX, and my VPN's external NIC) on the same network.
I was one of the original authors of VB, and *I* wouldn't use VB for a text
processing program. :-) Michael Geary, on comp.lang.python
|
Post #124,420
11/6/03 1:07:50 AM
|
Re: I'm *always* ready to give more info. :)
What network was the VPN on before?
Plus, by definition, if your internal nets were 172.16to31, 192.168, or 10. they would be invisible from outside.
-drl
|
Post #124,433
11/6/03 4:35:14 AM
|
Check out my first post in this thread.
Since the diagram explains best, I think. The VPN had 2 NIC's: one on the internal network (192.168.0.0) and one on the network which existed between the two DSL routers (172.16.0.0, IIRC). In addition, since it was running an ethernet bridge, it had a virtual NIC (a tap device), which was bridged to the internal NIC. The bridged ethernet was set up per [link|http://openvpn.sourceforge.net/bridge.html|http://openvpn.sourc...e.net/bridge.html]
I was one of the original authors of VB, and *I* wouldn't use VB for a text
processing program. :-) Michael Geary, on comp.lang.python
|
Post #124,449
11/6/03 9:23:42 AM
|
Re: Check out my first post in this thread.
I don't understand your diagram without network addresses.
-drl
|
Post #124,509
11/6/03 2:56:44 PM
|
Ahhh.. here ya go.
\n DSL DSL 66.126.207.234\n 66.126.207.242 \\ /\n Router DSL 63.200.221.34\n 172.16.0.1 | \\ /\n | Router\n | | 10.0.0.8\n | |\n 172.16.0.16 | | 10.0.0.5\n VPN PIX 506\n 192.168.0.251 | | 192.168.0.110\n | |\n (3) 10/100 switches\n | | | | | |\n LAN computers on 192.168.0.x\n clients and servers\n Plus a wireless hub in that 172.16.x.x network that I left out for clarity. :) I was one of the original authors of VB, and *I* wouldn't use VB for a text
processing program. :-) Michael Geary, on comp.lang.python
|
Post #124,515
11/6/03 3:36:47 PM
|
What a mess :)
OK now draw what's happening now.
-drl
|
Post #124,557
11/6/03 10:22:22 PM
|
Working solution:
\n __Dumb Hub__\n / | \\\n 64.73.226.17 / | \\ 64.73.226.18 /\n T1 GW (Adit) | Wireless Router--WLAN Clients\n | | 192.168.3.1 \\\n | |\n 64.73.226.19 | | 192.168.3.3\n PIX OpenVPN\n 192.168.0.110 | | 192.168.1.251\n | |\n (3) 10/100 Switches\n | | | | | | | |\n LAN clients and servers\n Someday Real Soon Now I'm going to switch the innermost network (on the bottom) to 10.x, just need time. I was one of the original authors of VB, and *I* wouldn't use VB for a text
processing program. :-) Michael Geary, on comp.lang.python
|
Post #124,558
11/6/03 10:33:15 PM
|
That's better :)
You shouldn't switch to a 10. network unless you need to do a lot of internal subnetting - say, if you're IBM.
-drl
|
Post #124,437
11/6/03 5:00:32 AM
|
That extra hub sounds like the solution.
Particularly now you've re-described the situation.
Wade.
Is it enough to love
Is it enough to breathe
Somebody rip my heart out
And leave me here to bleed
| |
Is it enough to die
Somebody save my life
I'd rather be Anything but Ordinary
Please
| -- "Anything but Ordinary" by Avril Lavigne. |
|
Post #124,510
11/6/03 2:57:00 PM
|
Thanks. I'll try it tonight.
|
