2 subnets with one FIOS router

I am using the FIOS router for home and sometimes need to test certain situations for my work. I have set up a virtual lab that uses the 192.188.1.x subnet from the router. I have also set up a second virtual network that uses the 192.168.2.x subnet and have the two networks routed (virtually) between them. When it comes to accessing the internet, all of my .1 hosts, physical and virtual can connect with no problem, but none of my .2 hosts can do this. DNS resolution works, but actual outbound traffic is somehow being blocked. I set up a network object that contains all the IP addresses of my 192.168.2.x subnet and created a new input and output rule in Firewall > Advanced Filtering that allows all outbound and inbound traffic to/from the other subnet. It still doesn't work, but I think I'm close. I can't see anything else that would block this and the firewall logging doesn't really help either. Has anyone been able to successful do this? Just to clarify, I do not have and additional physical routers in the mix, all virtual using Windows routing and Hyper-V virtualization.

Any help is appreciated.

Thanks

Accepted answers

Jin356b

I figured out a way to get these P0S routers to NAT all my internal networks, WITHOUT having to add a secondary NAT router in between. Say for instance my default internal network is 192.168.1.0/24, and the verizon router's internal IP is 192.168.1.1. Then I have 2 internally routed networks: 192.168.2.0/24 and 192.168.3.0/24. To get the verizon router to NAT the 192.168.2.0/24 and 192.168.3.0/24 nets, you have to trick it into thinking that these networks are part of it's default internal network.

1. Go the router's My Network -> Network Connections -> edit LAN

2. Click the Settings button

3. Scroll down to Routing Table and click New Route

4. Enter the routes to your internal networks. Ensure you leave the metric at 0.

5. Repeat steps 3 & 4 for all your internal networks

6. Apply the settings.

7. At this point all your internal networks should be able to communicate with one another (provided you setup each device's default gateway correctly).

8. Go back into the LAN connection settings page

9. Scroll down until you see the IP Address and Subnet Mask fields. The IP Address should already be set to 192.168.1.1. Change the subnet mask to 255.255.0.0.

10. Apply the settings.

This will trick the router into NATing all 192.168.x.x networks. And the static routes you entered in step 4 will ensure the 'incorrect' subnet mask doesn't break internal routing. I Hope this helps all you Enterprise Network admins that are stuck using this crap...

All comments

lasagna

The issue is that the ActionTec appears to only apply the NAT for the inside segment that's the address of it's inside address. So, while you might have routing working internally and with the router, any traffic which flows from the .2 network toward the internet passes thru without the NAT being applied. If you were to have your FiOS router provisioned on the WAN side to use ethernet, you could see this with a packet sniffer.

I have not yet found a place to make a rule adjustment to also NAT the secondary network -- so I've just resort to building my tests behind a second NAT router and NAT everything leaving my .2 and .3 networks first onto .1 and then out to the internet.

dcybnrmal

Thanks for the reply. Can you explain what you mean by

so I've just resort to building my tests behind a second NAT router and NAT everything leaving my .2 and .3 networks first onto .1 and then out to the internet

Thanks

lasagna

My home network is on 192.168.1.x (attached to the actiontec)

I have a secondary NAT router (Cisco Linksys) running in the standard internet configuration with it's WAN interface connected to the ActionTec (and getting a 192.168.1.x address) and the private LAN addressed as 192.168.2.x (it's running in NAT/Firewall mode so everything which passes thru it get's assigned the 192.168.1.x address of the WAN interface of the Linksys).

Behind the Linksys, I have a router and some switches running various configurations with VLAN's and additional networks -- such 192.168.3.x and 192.168.4.x) and these are all routed internally on that network and defined to the Cisco Linksys. Anything from these networks that get routed to the Linksys NAT to the 192.168.1.x address on their way to the internet (the linksys can handle multiple networks).

dcybnrmal

Ok, I see that now, but is it possible to acheive the same thing without using a seperate (physical) router? I'm wondering if I dedicate on my server's NICs and dedicate one of the Actiontec's router ports for a seperate VLAN?

Jin356b

1. Go the router's My Network -> Network Connections -> edit LAN

2. Click the Settings button

3. Scroll down to Routing Table and click New Route

4. Enter the routes to your internal networks. Ensure you leave the metric at 0.

5. Repeat steps 3 & 4 for all your internal networks

6. Apply the settings.

7. At this point all your internal networks should be able to communicate with one another (provided you setup each device's default gateway correctly).

8. Go back into the LAN connection settings page

9. Scroll down until you see the IP Address and Subnet Mask fields. The IP Address should already be set to 192.168.1.1. Change the subnet mask to 255.255.0.0.

10. Apply the settings.

HollyW00d

I just wanted to reply and say THANK YOU. I was just setting up my lab at home and was about to thrown my monitor on the floor because I could not get my second subnet on the internet. After attempting numerous static routes and firewall rules I was going to give up until I saw your post.

At least now I know it's this crappy router, and not what I was doing that was causing the router to not forward NAT for that second subnet.

hndcb

Here is an interesting document from Actiontech indicating how to create different VLANs :

http://support.actiontec.com/doc_files/Creating_an_Ethernet_VLAN.pdf

It will provide great flexibility to control the MI424WR unit.