Routing question

[sneakyneil]

My brain's fried - How do I specify all 192.168.*.* subnets *except* 192.168.0.0/24? Is it something like 192.168.0.0/23? this is the same as 255.255.254.0 right?

Edited by sneakyneil on Monday 29th January 12:45

[JamieBeeston]

sneakyneil said:

My brain's fried - How do I specify all 192.168.*.* subnets *except* 192.168.0.0/24? Is it something like 192.168.0.0/23? this is the same as 255.255.254.0 right?

Edited by sneakyneil on Monday 29th January 12:45

you can't specify exception on subnet masks, only inclusions


192.168.0.0 is a /16, so 255.255.0.0

192.168.0.0/23 is simply 192.168.0.0-255 + 192.168.0.1-255

255.255.254.0 is the correct subnet for a /23

What are you trying to do?

J

[sneakyneil]

Thanks looks like it's back to the drawing board!

I'm trying to reconfigure a vpn link between 192.168.0.* and 192.168.1.* so that a 192.168.3.* subnet that's hanging off the .1 net is accessible from the .0 net. Nothing of earth shattering importance just something I spend a few minutes on every now and then!

the far router .1 and .3 said:

# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
xxx.xxx.203.81 127.0.0.1 255.255.255.255 UGH 0 0 0 lo
xxx.xx.73.73 xxx.xxx.203.81 255.255.255.255 UGH 0 0 0 ppp0
xxx.xx.73.73 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0
xxx.xx.73.73 0.0.0.0 255.255.255.255 UH 0 0 0 ipsec0
192.168.3.0 192.168.1.1 255.255.255.0 UG 1 0 0 br0
192.168.3.0 192.168.1.1 255.255.255.0 UG 2 0 0 br0
192.168.1.0 192.168.1.4 255.255.255.0 UG 0 0 0 br0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
192.168.0.0 xxx.xx.73.73 255.255.255.0 UG 0 0 0 ipsec0
127.0.0.0 0.0.0.0 255.255.0.0 U 0 0 0 lo
239.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 br0
0.0.0.0 xxx.xx.73.73 0.0.0.0 UG 0 0 0 ppp0
# ping 192.168.3.254
PING 192.168.3.254 (192.168.3.254): 56 data bytes
64 bytes from 192.168.3.254: icmp_seq=0 ttl=127 time=0.0 ms

the near router .0 said:

# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
xxx.xx.73.73 xxx.xx.207.141 255.255.255.255 UGH 0 0 0 ppp0
xxx.xx.73.73 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0
xxx.xx.73.73 0.0.0.0 255.255.255.255 UH 0 0 0 ipsec0
xxx.xx.207.141 127.0.0.1 255.255.255.255 UGH 0 0 0 lo
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 ipsec0
192.168.0.0 192.168.0.1 255.255.255.0 UG 0 0 0 br0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
127.0.0.0 0.0.0.0 255.255.0.0 U 0 0 0 lo
239.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 br0
0.0.0.0 xxx.xx.73.73 0.0.0.0 UG 0 0 0 ppp0

These tables are not messed with except for the entries for the .3.* net on the far end. I tried putting entries in the near router for the .3 net but it didn't work - I also noticed that the routers can't directly ping the other nets, but the other nets can ping each other through the routers

Anyway it's just a 'nice to have' but any insights gratefully received!

eta, sorry for the crap formatting

Edited by sneakyneil on Monday 29th January 14:12

Edited by sneakyneil on Monday 29th January 14:17

[Guydw]

what vendor router ?

If you were using Cisco, or better Juniper I could help you....

But logically what you want is the whole 192.168/16 without that one /24. So you would want whatever passes as an access list and first of all explicitly deny 192.168.0.0/24 THEN on the next line allow 192.168.0.0/16.

What you need to be sure of is the order in which the filter / access list is processed - so on a cisco router, anything matching the deny statement would be denied at that line and dropped. Everything would go to the next line as it wasn't a match, then be accepted by the next line.

a /23 will match 192.168.0.0/24 and 192.168.1.0/24.

[griffgrog]

The way that most routers or routing daemons work is the most specific entry in the routing table is the one used. For example, say your routing table said:

192.168.0.0 255.255.0.0 via Router A
192.168.3.0 255.255.255.0 via Router B

As the route to 192.168.3 is more specific, despite it being included in the previous entry, the router would choose the route via router B.

[sneakyneil]

Guydw said:

what vendor router ?

If you were using Cisco, or better Juniper I could help you....

That might be part of the problem, its only a netgear dg834 which I don't think is really supposed to be that flexible, at least the webmin part isnt. I'm only able to telnet in and get to the routing table because its running a slimmed down version of linux...


Griffgrog, thanks that makes sense since the list seems to be ordered by length of netmask. I guess that means one could put in a generic/16 route like you say then light the local net up again with a more specific one? I'l try that, might have more luck than keeping things specific. Cheers!

[Guydw]

hang on I just re-read, and we need a picture....

are you saying you have this:



192.168.0.0 ----- 192.168.1.0 ------- 192.168.3.0

if this is the case then you problems aren't anything to do with filtering routes or whatever, it is simple routing.....

so the 0 network needs a route to .3 via the interface it shares with the .1 network, the .1 router needs a route to the .0 network and the .0 network (is it connected?) If the .3 network has a router, it needs a route back to the .0 network, if not it needs a default route back to .1

If this doesn't entirely make sense drop me a line with a picture and I'll try and explain more.