Actiontec Q2000 Wireless Router and Internal 8-Port Switch in small business environment.

sreeves89

Reputable
Apr 2, 2015
4
0
4,510
Hello!

First and foremost, the set up I have currently is that I have an Actiontec Q2000 router at the edge of the network managing my CenturyLink internet and acting as the wireless router. The Actiontec is then connected to an 8-port Linksys BEFSR81 switch that connects to 3 computers and a networked printer.

I dub these my 'internal' network and 'external' network. The 'internal' network relates to all devices connected to that switch. Currently DHCP is enabled on BEFSR81 and we have 192.168.110.x assigned. The external network assigns anything it's connected to, (which in our environment is only the WiFi devices), 192.168.0.x.

Now for the questions!
1.) With the current set up, the internal networked items can see the wireless devices, but not the other way around. I like this and it is much more important to keep it this way, but I do have a couple of laptops that log into the wireless that I would like to have see the internal devices connected to the BEFSR81. For example, I want to be able to print and scan on the networked printer and I want to run backups from a couple of laptops to one of the internal computers. Is it possible to manually assign these particular laptops to allow routing into the internal network but for other WiFi users that come in, (which is rare, but happens when people who don't normally work in the office just need access to the internet), keep it the way it is and not allow them to see the internal network?

2.) This entire thing got me started looking into the network set up when I tried doing some ping tests. For the life of me I hooked up one laptop into the internal network but couldn't get other computers to see it. It had a proper IP address and I checked that all of the Windows 7 network settings were set up like the other computers. This led me to the realization that pinging any computer by host name within the internal network doesn't work, but pinging by IP address to ALL, (including that laptop), does. So i've been racking my brain and scouring Google to figure out why. I know that the BEFSR81 is doing DHCP for the internal devices and has NAT enabled. This thing does not have any DNS services however so I divert that to ISP provided DNS servers and my Actiontec IP address is also within the list of DNS servers. I feel like it has something to do with the fact that the internal network and external network are on different IP ranges, but I want the best of both worlds. How can I keep the set up, (or even change IP ranges if I need to.. I'm still trying but not well-versed in IP addresses and how to deal with the subnet), but get it so I can do connections via hostname between internal devices but keep things separate. My thought was to get the BEFSR81 to do DNS but it seems to not be capable of that.


...Overall I'm just trying to use my network to understand networking even more and make sure I have total control over everything that happens. Is anyone has some other suggestions I need to keep in mind, please let me know. Otherwise I'm mostly just at a loss for why I can't seem to figure out why I can't ping by host name as well as possibly trying to get CERTAIN wireless devices to access internal items.

Thanks!
 
Solution
You are pretty much stuck. Both the issues you see are the reason this configuration is not recommended.

You could for example use port mapping to allow the external network to access device in the interal. If the router has the ability to filter you could then limit which IP in the external network could access these. Problem is anyone that knows what IP is allowed could change their PC in your external network to that IP and get access if the real pc that had that ip was off on not around. The other problem is coming up with the port mapping rules. You quickly get into trouble if you need to say map port 80 to multiple devices. You might come up with a method that works it will just be tedious to figure out.

The DNS thing...
You are pretty much stuck. Both the issues you see are the reason this configuration is not recommended.

You could for example use port mapping to allow the external network to access device in the interal. If the router has the ability to filter you could then limit which IP in the external network could access these. Problem is anyone that knows what IP is allowed could change their PC in your external network to that IP and get access if the real pc that had that ip was off on not around. The other problem is coming up with the port mapping rules. You quickly get into trouble if you need to say map port 80 to multiple devices. You might come up with a method that works it will just be tedious to figure out.

The DNS thing is because your machines on the LAN are not actually using DNS they are just broadcasting out looking for other machines. This works in a lan but not when you have a routed network. Other than building your own DNS server the easist solution will be to put the names of the machine into the host files of the machines that need them. Sorta a minidns on every machine.

Still this tends to be a huge pain. There really is no good solution when you can not trust other device on a lan. Even firewalls can not easily block lan-lan traffic.
 
Solution

sreeves89

Reputable
Apr 2, 2015
4
0
4,510


Appreciate the response..! I was afraid of that answer, but I figured it didn't hurt to ask. I'll look into other solutions that will work for us.

Thanks again!