Re: Wireless Access Point and proxy server setup problem

["Tom Jedrzejewicz" <tomjedrz@xxxxxxxxxxxxxx>]

On Jan 20, 2008 10:14 PM, Peter Dow (ML) <maillist@xxxxxxxxxxxxxxx> wrote:
> The 4-port router connects to a 24-port, 1GB switch via a single cable.
> LTwo cables go from the switch to the proxy server, one to each NIC
> ("inside" and "outside").

This is where it gets weird.  You are asking the switch to manage
traffic from two different IP subnets.  Switches generally don't like
do that unless you program them specifically .. that is the "VLAN"
that I mentioned earlier.

> As I understand routers, the only routing that takes place is between
> the LAN ports and the WAN port, right?   So only traffic headed for the
> internet would be routed.  Local traffic is switched by the router
> between the LAN ports.

IP packets that are not on the same IP subnet as the current device
must be "routed" to the correct subnet.

DRAMATIC SIMPLIFICATION
IP packets have (essentially) a "next hop" IP address and a "final
destination".  If the final destination IP is on the same subnet as
the originating device, the final destination is set as the "next
hop".  Otherwise the default gateway (or default route) is set as the
next hop.  Switches do NOT route; if they recognize the "next hop" IP
address they pass the traffic to it, otherwise they ignore the packet.

Note that the reailty is far more complex, involving MAC addresses and
ARP tables, but in this case the effect is as described.

> Since all the PC devices are on the 10.0.0.x
> subnet, it should just be switched from one of the router's LAN ports to
> another.  In the case of internet traffic from a PC device (whose
> gateway is 10.0.0.1) that is connected to the router's LAN port, it
> should end up at the proxy server's "inside" NIC.  Other PC devices are
> connected directly to the 1GB switch and don't go through the router.

I think you are expecting too much of a consumer-grade DSL router.  It
is NOT a full-blown router; rather it knows about a single "inside"
subnet, and everything else. It can't handle two different internal
subnets.

You MIGHT be able to kludge this problem by giving the DSL router a
bigger inside subnet (10.0.0.1, subnet 255.254.0.0), but it may not
like an address space this large, nor might the switch, and you would
not accomplish your stated objective of isolating the Netgear from the
PCs.

> All of these devices work fine.
>
> The two that do not work fine connect to the AP wirelessly, and the AP
> in turn is connected to a router LAN port, which seems to me like other
> PC devices that are connected to one of the router's LAN ports.

The devices are doing what they should be doing; the topology is flawed.

Take care.