# Two subnets communicating



## hac3ru (May 14, 2012)

Okay. I have a FreeBSD server which "generates" two subnets: 172.23.0.0/21 and 172.23.8.0/23. I want these two subnets to be able to communicate. I need the workstations on the second subnet (.8.0/23) to communicate with the apache server on the first subnet. I'm kind of lost.

Any help would be greatly appreciated.


----------



## SirDice (May 14, 2012)

Turn on routing and make sure routing is setup correctly.


----------



## hac3ru (May 14, 2012)

Could *yo*u give me more details pl*ea*s*e*?

Need to mention: I already have some routing done. The defaultrouter is 193.236.7.219 and *I* have some routing from 172.22.0.0/21 and from 172.24.0.0/21.


----------



## SirDice (May 14, 2012)

Unless you have another interface in that machine your default gateway is out of range of any of the other subnets.

To turn on routing, add to /etc/rc.conf:

```
gateway_enable="YES"
```


----------



## hac3ru (May 14, 2012)

It's on. 

I have two cards: bge1 which is LAN and em1 which is another server (the one providing internet) 193.236.7.219.

At the same time, this server is connected with others and all of them go into the Internet server. Now, *I* have two local subnets, as *I* said before, and *I* want the 172.23.0.0/23 to be able to communicate with 172.23.0.1.


----------



## SirDice (May 14, 2012)

Please post an image or a clear description of your network topology. Currently it looks like 172.23.0.0/23 is directly connected and thus should be accessible.


----------



## hac3ru (May 14, 2012)

Okay.

One fiber optic cable comming from the 193.236.7.219 which is the Internet server. I have three NICs: em0 and bge1 (which are in use) and one bge0 which will be used in a couple of weeks to link the other 172.22.0.0 and the 172.24.0.0/21 networks.

I have done the routing from 172.22 and 172.24 using as default router 193.236.7.x (can't check it now). It works this way so there's no problem with this.

I have done two subnets: 172.23.0.0/21 and 172.23.8.0/23. In the 172.23.0.0/21 *I* have an internet connection. In 172.23.8.0/23 *I* don't have an internet connection, *I* don't need an internet connection, *I* only need to communicate with 172.23.0.1 which is the LAN server of 172.23.0.0/21.

Does it make any sense or I'd better make a drawing?


----------



## SirDice (May 15, 2012)

A drawing would be nice because I still have no idea how 172.23.0.0/21 and 172.23.8.0/23 are connected to the FreeBSD machine.


----------



## hac3ru (May 15, 2012)

dhcpd.conf:


```
global variables

shared-network subnets {
subnet 172.23.0.0 netmask 255.255.248.0 {
options router 172.23.0.1
option broadcast-address 172.23.7.255

range 172.23.0.2 172.23.6.3
}
subnet 172.23.8.0 netmask 255.255.254.0
option router 172.23.8.1
option broadcast-address 172.23.9.255
range 172.23.8.2 172.23.9.254
}
```

So the subnets are created by the FreeBSD machine. Both of them.


----------



## SirDice (May 15, 2012)

That still doesn't tell me how they are connected. Physically.


----------



## hac3ru (May 15, 2012)

They are not. They're on the same interface: bge0. I divided my LAN into two subnets if I may call them like that. 

1 server, 2 network interfaces: the em0 which is the internet interface and bge0 which is subnet 172.23.0.0/21 and 172.23.8.0/23. Both of them on the same interface.


----------



## SirDice (May 15, 2012)

Ah, that wasn't quite clear.

In that case, simply turn on routing and you're done. Both networks are directly connected.


----------



## hac3ru (May 15, 2012)

/etc/rc.conf said:
			
		

> gateway_enable="YES"


It`s not working... 

Do I need to set up a route or something?


----------



## bbzz (May 15, 2012)

This is why drawing simple pic helps immensely.
I'm not sure how the topology looks.


----------



## SirDice (May 15, 2012)

hac3ru said:
			
		

> Do I need to set up a route or something?


Routes to 172.23.0.0/21 and 172.23.8.0/23 are implied because they are directly connected.

Do you have _any_ experience with routing? If not, I suggest brushing up on your knowledge.


----------



## hac3ru (May 15, 2012)

There we go. Drawing


----------



## SirDice (May 15, 2012)

The interface bge1 needs to have an address in both subnets. Looking at your DHCP configuration it should be 172.23.8.1 and 172.23.0.1.

It's also possible the switch is configured with VLANs to seperate those two subnets. In that case you'd need to create a VLAN trunk and assign those two VLANs to bge1.

Or, if it's a layer 3 switch, it's possible the actual routing is done by the switch's routing module. In that case you'll need to reconfigure your switch.

If you don't understand any of this I suggest hiring someone that can take care of it for you.


----------



## bbzz (May 15, 2012)

Now that's a drawing. A+
What you have is called router-on-a-stick, that is, a router trunked into switch. You want to look at vlan(4).
Also, that dhcpd.conf you posted has nothing to do with interface setup and routing.


----------



## hac3ru (May 15, 2012)

SirDice said:
			
		

> The interface bge1 needs to have an address in both subnets. Looking at your DHCP configuration it should be 172.23.8.1 and 172.23.0.1.
> 
> It's also possible the switch is configured with VLANs to seperate those two subnets. In that case you'd need to create a VLAN trunk and assign those two VLANs to bge1.
> 
> ...



Oww damn. Could *yo*u tell me how to configure the subnet / the interface so it'll have an address in both subnets?

I don`t want to do the management using the switches. I just don`t.

Got it. I assigned an alias IP address to bge1.
Thank you for your time and patience.

Got another tiny problem: I could ping the 172.23.8.1 (bge1 alias) for about 2 minutes. After that, SILENCE! Any ideas why? The firewall is passing anything coming from 172.23.8.0/23 to any.


----------



## bbzz (May 15, 2012)

We're not mindreaders, how do you expect us to know what's wrong when you didn't show what has been done?
Show what you did so far, including switch configuration for trunk. 
And be more careful about how you format your messages, I see DD already pulling his hair out.


----------



## hac3ru (May 15, 2012)

Well... I only added an alias in rc.conf:


```
ifconfig_bge1_alias0="inet 172.23.8.1 netmask 255.255.254.0"
```
That's all. As I said, I don't like working with this switches. I can ping 172.23.8.1 for about 5 minutes after *I* restart the FreeBSD server. After that, silence.

How I format my messages? What's not right?
I admit, *I* skipped the rules.


----------



## DutchDaemon (May 15, 2012)

Well, then it's about time you stopped doing that, because you're causing me extra work. The comments under your posts should clue you in.


----------



## hac3ru (May 16, 2012)

Ok. I am sorry. 
I still need an answer if it is possible. I have an alias for bge0, which is 172.23.8.1, and I posted my dhcpd.conf before. 


```
shared-network subnets {
subnet 172.23.0.0 netmask 255.255.248.0 {
options router 172.23.0.1
option broadcast-address 172.23.7.255

range 172.23.0.2 172.23.6.3
}
subnet 172.23.8.0 netmask 255.255.254.0
option router 172.23.8.1
option broadcast-address 172.23.9.255
range 172.23.8.2 172.23.9.254
}
```
Here it is again. My problem is that, even with 
	
	



```
enable_gateway="YES"
```
 in rc.conf, workstations in the seconds subnet, 172.23.8.0/23 can not access 172.23.0.1. Anyone have any ideas?

I can ping 172.23.8.1 for five minutes after I restart the server and it doesn't respond after that.


----------



## bbzz (May 16, 2012)

I have a feeling you didn't check vlan(4)

You need something like this:

```
ifconfig vlan0 create
ifconfig vlan0 vlan 100 vlandev bge0
```

That's one 802.1q tagged subnet.


----------



## SirDice (May 16, 2012)

hac3ru said:
			
		

> My problem is that, even with enable_gateway="YES" in rc.conf, workstations in the seconds subnet, 172.23.8.0/23 can not access 172.23.0.1.


That's because it's gateway_enable, not enable_gateway.


----------



## hac3ru (May 16, 2012)

SirDice said:
			
		

> That's because it's gateway_enable, not enable_gateway.



My bad. It is enable_gateway indeed. It is written correctly in rc.conf. So, *I* need to create a VLAN. I didn't kn*o*w that. Thank you bbzz. I'll try it in a few minutes and be back with informations.

Same thing. I can ping 172.23.8.1 and 172.23.0.1 for about two minutes after *I* restart the server and it just suddenly dies. Checking logs now. Maybe I'll find something useful.


----------



## hac3ru (May 16, 2012)

Found something a little weird:

```
May 16 19:35:08 s3 dhcpd: DHCPDISCOVER from f4:e3:21:88:e4:d6 via bge1
May 16 19:35:08 s3 dhcpd: [b]imcp_echorequest 172.23.8.253: Invalid argument [/b]
May 16 19:35:09 s3 dhcpd: DHCPOFFER on 172.23.8.253 to f4:e3:21:88:e4:d6 (workstation2) via bge1
May 16 19:35:09 s3 dhcpd: DHCPREQUEST for 172.23.8.253 (172.23.0.1) from f4:e3:21:88:e4:d6 (workstation2) via bge1
May 16 19:35:09 s3 dhcpd: DHCPACK on 172.23.8.253 to f4:e3:21:88:e4:d6 (workstation2) via bge1
```
Can't understand what's bolded. Why 
	
	



```
echorequest 172.23.8.253: Invalid argument
```
?

Sorry for the double-post. I thought that I was editing my last post.


----------



## SirDice (May 16, 2012)

You currently have some serious networking issues. The server on 172.23.0.1 should be issuing addresses in the 172.23.0.0/21 range. It's currently issuing addresses from the 172.23.8.0/23 range.

Either both subnets are lumped together on the switch, or your FreeBSD machine is only connected to the 172.23.0.0/21 VLAN.

In any case, I seriously recommend finding someone that can configure the network for you, especially the switch.

For everything to start working properly the switch must have 2 VLANs, one for each subnet. You then need a VLAN trunk port to connect your FreeBSD machine on. Only when all that is set up correctly should you configure VLANs on the FreeBSD machine.

If you keep struggling because you don't know exactly what you're doing I can pretty much guarantee you you will get chased around the building by an angry mob of dissatisfied users because they can't work.


----------



## hac3ru (May 16, 2012)

I wanted it to issue IP addresses in both the subnets. Still, *I* think *I* am missing something.

Maybe *I* could use the first subnet, which is used only from 172.23.0.1 to 172.23.6.3 and get like 20 IPs from there? I could edit the dhcpd.conf like this: 

```
subnet 172.23.0.0 netmask 255.255.248.0{
option routers 172.23.0.1;
option broadcast-address 172.23.7.255;
option subnet-mask 255.255.248.0;
option domain-name "s3-network";

pool {
range 172.23.6.4 172.23.6.24;
allow unknown-clients;
```
Would this work?


----------

