Nat routing between two lans

stevenz

Honorable
Mar 27, 2013
3
0
10,510
Hi all,

Nat routing between two independent lan networks does not work.
Basically, port forwarding does not work for an unknown reason.

Network configuration and goal
-----------------------------------------

The two networks have their own connection to the internet using a ADSL router.

Internet <--> Router R1 192.168.1.1 <-> 192.168.1.X LAN1
Internet <--> Router R2 192.168.2.1 <-> 192.168.2.X LAN2

Each lan has its own adsl router and connection to the internet.
There is no physical link between the two lans.

The general goal is to make the machine 192.168.1.200 available to the lan 192.168.2.X:

192.168.1.200 -> 192.168.2.11 smb file sharing port 445; 192.168.1.200 initiates the connection
192.168.2.11 -> 192.168.1.200 unkown port (printing); 192.168.2.11 initiates the connection

The only possible traffic between LAN1 and LAN2 should be those two connections:
we do not want to put them in the same LAN.

Current (non working) solution
----------------------------------------

We use a NAT internet router R3 (TPLINK TL-WR741ND)

192.168.1.X LAN1 <--> 192.168.1.254 WAN IP Nat router R3 LAN IP 192.168.2.254 <--> 192.168.2.X

Connection from LAN1 to 192.168.1.200 works fine using routing rules 192.168.1.X -> 192.168.2.254 in R2.

We use port forwading to let 192.168.1.200 connect to 192.168.2.11, using the PF following rule in R3:
External port 445 Internal Port 445 LAN IP 192.168.2.11

Problem
-----------

The problem is that, from a computer in LAN1, the cmd 'telnet 192.168.1.254 445' does not work.
The cmd 'telnet 192.168.2.11 445' from LAN2 works (port 445 is opened on machine 192.168.2.11).

Defining 192.168.2.11 as the dmz target results in the same behaviour ('telnet 192.168.1.254 445' from LAN1 does not work).
Any idea why port forwading is not working in this configuration?

Thanks,

Steven.



 
Your post is very hard to read I suspect you typed lan 1 when you meant lan 2 in a couple cases.

I am going to guess it is because your routing is asynchronous because it should work in general. The traffic in one direction goes directly to router 3 and traffic returning passed router 2 if I read correctly. Many times this confuses routers or they block it because of firewall type concerns.

I would try to place the routing in the end machines pointing to the r3.

In your case what you need is a actual router instead of these things that are actually "gateways" that they sell to home users. I am unclear if your router will run 3rd party firmware. You could look at open-wrt or dd-wrt or even one of the tomato variants. These would give you the ability to define 2 lans on the lan ports and just route between the 2 networks directly.
 

stevenz

Honorable
Mar 27, 2013
3
0
10,510


This is what I am planning to do. TL-WR741ND is supported by dd-wrt hence I can go that way.
I never used dd-wrt before.
Can I connect LAN1 192.168.1.X to LAN PORT 1 and LAN2 192.168.2.X to LAN PORT2 and add a routing rule between the two LANS? The routing would enable traffic only between 192.168.1.200 and 192.168.2.11.
Can give me a pointer to some documentation in order to do this using ddr-wt?
 
Would be nice if there was good documentation on anything in dd-wrt. I guess you get what you pay for. There is a wiki that talks about running multiple vlans but like normal I can't find it now. Unfortunately the routing would enable traffic for all machines between the networks. You would then have to place a firewall rule in to prevent other ips.

The key thing to really study on dd-wrt is how to flash the firmware. You will find post after post on those forums discussing if and how you unbrick a router because of loading wrong flash or something. I never did tplink stuff so I can't say if its easy or not
 

stevenz

Honorable
Mar 27, 2013
3
0
10,510


It is farily easy to install ddr-wt on TL-WR741ND.
What is not clear at all is if vlans are supported on TL-WR741ND.
What about connecting LAN1 on the WAN and LAN2 on one of the LAN ports, and add a routing rule + firewall rules?
It would be simpler than defining vlans.