Coexistence and routing of two internet feeds

F

Fernando Ronci

Hi,

Here is my current setup.
I administer a network comprised of several workstations running Windows
2000 Professional that have internet access through a Windows 2000 Server
gateway which performs NAT between the network interface that "talks" to the
outside world, and the one that talks to the LAN. NAT is achieved via
Windows 2000 Server's "Routing and Remote Access", as per Knowledge Base
Article # 299801 configuration guidelines.
On the LAN side, the Win 2K workstations have access to the web, SMTP, and
the rest of the traditional internet services. Additionally, these client
workstations establish a VPN connection to a remote server for corporate
mail access. As with the ordinary internet traffic, the VPN is routed
through the Windows 2000 Server NAT server. For security reasons, VPN access
and the rest of internet traffic are exclusive, that is, when a user does
VPN he/she cannot access the web simultaneously and viceversa, so VPN and
ordinary internet access never overlap.
In this scenario, everything works absolutely fine. However, and for reasons
that go beyond the scope of this subject, the internet feed is of the VSAT
type, with tons of downstream bandwidth available and a bare 19.2 Kbps for
upload, which is kind of unsuitable for the VPN, where a more "symmetric"
service would speed things up. Then, the company managers have thought of
buying an ADSL connection which, although asymmetric, its upstream bandwidth
would meet our needs. Their goal is to use ADSL *only* for the VPN and keep
the other pipe for the web, etc. In this situation, the Win 2K Pro client
workstations should be configured in such a way that they route their
ordinary internet traffic through the VSAT pipe and the PPTP traffic through
the ADSL feed. At this point I have two doubts: 1) If this kind of routing
is possible to achieve on the Win 2K workstations and 2) if it is possible
to configure the "Routing and Remote Access" service on the Win 2K gateway
to "include" the new ADSL connection. (I wouldn't mind if I had to add one
or more NICs on the gateway machine).
By the way, the two internet feeds come from different ISP's, thus the IP
address range of the two feeds belong to different subnets. What's more, I
dare say the ADSL provider will assign us a dynamic, already-NATted address
of class 192.168.x.x, as is common practice these days. On the other hand,
the NIC on the WAN side of our gateway in our current setup owns a static,
public IP address.

I will appreciate if someone provided some insight on how to make two feeds
from different ISP's coexist and achieve proper routing without conflicts.

Thank you.
Fernando Ronci
E-mail: (e-mail address removed)
 
R

Robert L [MS-MVP]

if I understand correctly, this is routing issue. assuming you have just one
VPN connection say, the VPN server is 10.0.0.1, you can configure the
routing table point all internet traffic to the VSAT and VPN goes to DSL.

--
For more and other information, go to http://www.ChicagoTech.net

Don't send e-mail or reply to me except you need consulting services.
Posting on MS newsgroup will benefit all readers and you may get more help.

Robert Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN, Anti-Virus, Tips & Troubleshooting on
http://www.ChicagoTech.net
This posting is provided "AS IS" with no warranties.
 
B

Bill Grant

As Robert said, this is a routing problem that RRAS should be able to
handle. Two gateways are not really a problem if one of them is only used
for a specific group of IP addresses.

You cannot use RRAS to share two different Internet connections. You
need some sort of additional hardware/software to do load balancing. RRAS
will just use one gateway, and only switch if that goes down.

A VPN connection is different. You do not need to use default routing
for a VPN link because you know exactly what traffic needs to go over the
VPN. So you can set a default route to your Internet link but use a static
route to direct VPN traffic to a different gateway.
 
F

Fernando Ronci

Thanks.

Does this mean that I can set up a second (separate) gateway, say, another
machine running Win 2K Server and set up its RRAS for the ADSL feed and, on
the Win 2K workstations, add a static route to it for the VPN while keeping
the current (routing) setup for internet access ?
Thanks again.

Fernando
 
B

Bill Grant

Yes, that should work. You would set the Internet router as the default
gateway on the clients. On the Internet router, add a static route to
redirect the traffic for the VPN link to the alternate gateway.
 
F

Fernando Ronci

Thanks.
Just a last question.
On a Windows 2000 Server, where should I add the "route add" command to add
the static route to the VPN server and make it permanent between reboots ?
For example, if the IP address of the (remote) VPN server is, say,
200.43.70.80 and the address of the ethernet interface on the *new* Windows
2000 NAT server (installed to handle PPTP traffic only) on the LAN side is
192.168.1.2, then the command to add on the (old, so to say) Internet router
would be something like "route -p add 200.43.70.80 192.168.1.2"
Am I wrong ?

Thank you,

Fernando Ronci
E-mail: (e-mail address removed)
 
B

Bill Grant

The route command should have the IP subnet which needs to go to the
alternate router for delivery by VPN.. So if your private-addressed site
which is across the VPN is using say 192168.53.0/24 then the route command
would be

route add -p 192.168.53.0 mask 255.255.255.0 <IP address of VPN router>

By default routing , all non-local traffic comes to the default router,
but the VPN traffic is redirected to the VPN router. All other traffic
continues out to the Internet from the default router.
 
F

Fernando Ronci

Thank you Bill, I was wrong.
I thought that, being 200.43.70.80 the static public IP address of the
remote VPN peer, it was unnecessary to reference a route to the
private-addressed site behind that host (such as 192.168.x.0/24), as all
packets addressed to that site are wrapped/encapsulated within IP packets
carrying the public IP address of the destination peer (200.43.70.80 in this
case), which should be enough to find a route to its destination.

Thanks again for your insight.
Fernando Ronci
E-mail: (e-mail address removed)
 
B

Bill Grant

The packets still have their original private IP addresses while they
are on the LAN. They are not encrypted and encapsulated until they reach the
VPN endpoint (which in your case is the second RRAS router).
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top