Greg Freemyer wrote:

You have 2 separate default non-routable networks setup with a suse gateway router between them and you're asking how to have the suse gateway router route the default non-routable traffic between them.

Actually, only the 169.254 network is not routable. The 192.168 network is routable, but not on the public internet. So, if he were to choose a different network, according to RFC1918, instead of the 169.254 network, he should be able to do what he wants. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Greg Freemyer wrote:

Thanks James. For my clarity, is this right?

That is correct. The addresses listed in RFC1918 can be routed internally, but not onto the public Internet. In fact my ISP uses addresses in the 10.x.y.z range within their network. The 169.254 range is called "link local" and cannot be routed, even locally. It's purpose is to allow for file sharing etc. on a local network without having to configure IP addresses. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 8/6/2013 8:03 AM, Greg Freemyer wrote:

On Tue, Aug 6, 2013 at 1:18 AM, Marc Chamberlin wrote:

...

Ok i been fooling around with this, and suspect I am missing something dumb... I have the following SOHO network configuration -

Internet | Router A 169.254.1.1 | |-----169.254.1.200 Router B 192.168.20.1 --------- 192.168.20.100 Machine A | 169.254.1.100 (eth0) OpenSuSE Gateway Machine with SuSEFirewall 192.168.10.1 (eth1) | | 192.168.10.20 Machine B

So how do I set up the SuSEFirewall and the network routing tables on the OpenSuSE Gateway to allow Machine B to see Machine A? I did set up a route in the Routing Table in YaST2 for the network interfaces as follows -

Destination 192.168.20.0 Genmask 255.255.255.0 Gateway 169.254.1.200 Device eth0

The gateway address for Machine A is set to 192.168.20.1 The gateway address for Machine B is set to 192.168.10.1 The gateway address for the OpenSuSE Gateway Machine is set to 169.254.1.1

So far I have been unable to get Machine B to even ping Machine A. Is the SuSEFirewall interfering and if so what do I have to do to make it behave? I tried a few things with it also, but so far no joy.

Gotta be something dumb I am missing, appreciate and thanks in advance for a bit of help..

Marc... You need to rephrase your question:

You have 2 separate default non-routable networks setup with a suse gateway router between them and you're asking how to have the suse gateway router route the default non-routable traffic between them.

I don't know how to override the default lack of routing of 169.254.x.x and 192.168.x.x addresses in the suse gateway router, but I'd be shocked if you can't be done easily. Hopefully someone else knows how to override the default behavior and route those IPs.

fyi: This is not a "dumb" question. You have setup a more complex network, but companies do similar things all the time. If a company is lucky enough to have their own class A, class B, class C's, Then they can do it all with routable IPs.

The reality today is most companies don't have that luxury, so the do use multiple non-routable networks so they can do things such as have a 10.x.x.x for the main network and a 192.168.x.x for a wireless guest network, etc.

To accommodate that routers have override options to allow those IP ranges to be routed. I just have never been the one responsible for setting that up, so I don't know any details of how to do the override.

Greg

Thanks Togan, James, Greg for your replies. Togan, James, you both pointed out the same thing, which I was kinda afraid of, that the 169.254.x.x network is a non-routable IP address range. I have encountered issues with this before and so far have not come up with a good answer. My trouble is that the devices on this network consist of some Motorola Canopy wireless access points and subscriber modules. These sit on towers and are not easily accessible, and the trouble is that if there is a power cycle, then these devices reboot and come up with a default IP address on the 169.254.x.x network. This is how I get my internet access to my SOHO network at home/business, I live way out in the woods! (I have tried to look into upgrading the firmware of these devices but so far no joy in figuring out how to do so, in order to get around this problem.) I set up the router B for the 192.168.20.x network to handle smart cell phones and some associated devices and get them off of the gateway computer and internal network (192.168.10.x) used for my home/business computers and servers. This is an attempt to improve phone call drops and intermittent issues we were having when the cell phones were on the same network as all the rest of our computers. Greg - Yes I think you see/understand what I am trying to do with having a separate network set up outside of my gateway computer. It sounds to me that from what you are saying, even if I could switch the 169.254.xx network address over to something like a 10.x.x.x network I would still have routing problems. Hmmmm, anyone got any ideas on how to go about solving this? Suggestions on wireless routers I can use? Right now I am using Rosewill wireless routers and I don't see any settings that allow me to override routing rules and still provide NAT capabilities. Marc... -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Marc Chamberlin wrote:

...

...

Togan, James, you both pointed out the same thing, which I was kinda afraid of, that the 169.254.x.x network is a non-routable IP address range. I have encountered issues with this before and so far have not come up with a good answer. My trouble is that the devices on this network consist of some Motorola Canopy wireless access points and subscriber modules. These sit on towers and are not easily accessible, and the trouble is that if there is a power cycle, then these devices reboot and come up with a default IP address on the 169.254.x.x network. This is how I get my internet access to my SOHO network at home/business, I live way out in the woods! (I have tried to look into upgrading the firmware of these devices but so far no joy in figuring out how to do so, in order to get around this problem.) Is there no non-volatile memory for storing configuration? If not, I'd consider those devices to be defective out of the box. There is absolutely no excuse for that sort of nonsense.

Well that sucks... I will again see what I can do to upgrade the firmware on these Canopies, I tried once but ran into other issues. Yes

On 8/6/2013 9:02 AM, James Knott wrote: they do have non-volatile memory, just did not store the IP address in it on these early models. I may just have to live without it for awhile, getting/paying a guy to climb the towers is expensive. Marc... -- "The Truth is out there" - Spooky -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 8/6/2013 3:27 PM, James Knott wrote:

Marc Chamberlin wrote:

...

Well that sucks... I will again see what I can do to upgrade the firmware on these Canopies, I tried once but ran into other issues. Yes they do have non-volatile memory, just did not store the IP address in it on these early models. I may just have to live without it for awhile, getting/paying a guy to climb the towers is expensive. Do they support DHCP? If so that would be a solution. You can map MAC addresses to specific IP addresses, if necessary.

Thanks James I will set your suggestion aside for the moment however as I am pursuing a test path at the moment. I have set up a test network identical to the way I showed it in my first email, and have switched the non-routable 169.254.x.x addresses in the network to a routable 10.10.10.x network. While the Canopies will not hold these 10.10.10.x address should there be a power cycle, I am just wanting to see if I now can get my Machine B to see/ping my Machine A. I modified my route table according... And no joy! Still cannot ping Machine A from Machine B. Any ideas? From your suggestion, are you implying that I need to turn off the NAT functionality of my router for the 192.168.20.x network? Marc.. -- "The Truth is out there" - Spooky -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 8/6/2013 7:03 PM, James Knott wrote:

Marc Chamberlin wrote:

...

Any ideas? From your suggestion, are you implying that I need to turn off the NAT functionality of my router for the 192.168.20.x network?

I have no idea if those 169.254 addresses will work with NAT. They're not supposed to be routed at all and I suspect that means NAT as well. The devices should not be attempting to use any router, including NAT, for those addresses. As far as I can tell, the only solution is to move off that address range.

I think you misunderstood my previous email James. I have set up a network such that it is not using the 169.254.x.x addresses. Instead it is now using 10.10.10.x addresses, which is routeable but still private IP addresses AFIK. I am still getting no joy getting my two private 192.168.x.x networks to see each other. Marc... -- "The Truth is out there" - Spooky -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Marc Chamberlin wrote:

On 8/6/2013 7:03 PM, James Knott wrote:

...

Marc Chamberlin wrote:

...

Any ideas? From your suggestion, are you implying that I need to turn off the NAT functionality of my router for the 192.168.20.x network?

I have no idea if those 169.254 addresses will work with NAT. They're not supposed to be routed at all and I suspect that means NAT as well. The devices should not be attempting to use any router, including NAT, for those addresses. As far as I can tell, the only solution is to move off that address range.

I think you misunderstood my previous email James. I have set up a network such that it is not using the 169.254.x.x addresses. Instead it

is now using 10.10.10.x addresses, which is routeable but still private

IP addresses AFIK. I am still getting no joy getting my two private 192.168.x.x networks to see each other.

Marc... I would assume my first email still applies. You need to override a default "don't route setting" for those private networks. Greg -- Sent from my Android phone with K-9 Mail. Please excuse my brevity. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Wed, Aug 7, 2013 at 8:27 AM, James Knott wrote:

Greg Freemyer wrote:

...

I would assume my first email still applies. You need to override a default "don't route setting" for those private networks.

In all the work I've done with routers, I've never seen that setting. While 169.254 traffic should never get to a router, proper routers will route those RFC1918 addresses just fine.

James, It has been a long time since I worked at an ISP, but I am fairly confident the routers we bought dropped private IPs by default. Looking at wikipedia http://simple.wikipedia.org/wiki/Private_network I see "Public Internet Routers by default will not forward packets with RFC 1918 addresses. Unlike public Internet routers that need additional configuration to forward these packets, internal routers do not need any additional configuration to forward these packets." Thus it appears we could both be right depending on what the manufacturer (or opensuse engineer) thought was going to be the typical use for the router. Greg -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Greg Freemyer wrote:

"Public Internet Routers by default will not forward packets with RFC 1918 addresses. Unlike public Internet routers that need additional configuration to forward these packets, internal routers do not need any additional configuration to forward these packets."

As I mentioned, I have a lot of experience with routers, both industrial and consumer grade. An industrial grade does not have any such setting, as it has to be able to work anywhere and access lists or rules are used to determine what is passed or not. Consumer grade routers are limited in function in that they only do NAT and are nor capable of routing networks in the same manner as the industrial ones. With them, there would be no means of the local network addresses to be routed onto the Internet, as they don't support that function at all. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Tue, 2013-08-06 at 16:21 -0700, Marc Chamberlin wrote:

Thanks James I will set your suggestion aside for the moment however as I am pursuing a test path at the moment. I have set up a test network identical to the way I showed it in my first email, and have switched the non-routable 169.254.x.x addresses in the network to a routable 10.10.10.x network. While the Canopies will not hold these 10.10.10.x address should there be a power cycle, I am just wanting to see if I now can get my Machine B to see/ping my Machine A. I modified my route table according... And no joy! Still cannot ping Machine A from Machine B.

Any ideas? From your suggestion, are you implying that I need to turn off the NAT functionality of my router for the 192.168.20.x network?

Marc, If you still can't make it work, please show us 1) routing table content on both Router A and B, and on the gateway SuSE box("ip route" or "route"). Then 2) traceroute result from/to Machine A to from Machine B, which Koenraad suggested. You need to turn off NAT on the GW machine if other part of your network want to send packets to 192.168.10.0/24 network. NAT will hide the subnet behind (192.168.10.0/24 your case) and only outside address of the GW box(10.10.10.?/32) is reachable and you need to set up port forwardings from the 10.10.10.? to each machine behind the GW. Toshi -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org