1

In our network, all wired PCs have a direct access to internet (83.XX.XX.XX) and a secondary IP address on the same NIC in order to access a subnetwork (192.168.10.XX) with wired peripherals (scanners, printers, etc). The problem is that wireless devices (such as laptops or mobile phones), which access internet via an AP are in a third subnet (192.168.1.XX) and have no access to these peripherals. See the attached diagram.

enter image description here

If I change the WAN of the AP to 192.168.10.XX, wireless devices will access peripherals but will lose internet.

Is it possible for wireless devices to access both internet AND peripherals?

Improve this question
6
  • How come you use dual NIC on your hosts? Why not make it all part of the same VLAN and then route/firewall everything?
    – user36472
    Commented Jan 29, 2019 at 15:23
  • @Cown I use double ip addresses, not two NICs per PC. And i cannot put all PCs under a VLAN because a. we have lots of servers and machines that are remotely controlled and b. i have no access to institution firewall. This setup is for a lab with 10 main computers/servers, 32 workstations (that exist in another subnet) . I tried to simplify my question as much as i could, the real setup is much complicated.
    – Lazikas
    Commented Jan 29, 2019 at 15:32
  • Well without any knowledge of how your equipment is configured or the real overview of how everything is connected it's gonna be hard to help.
    – user36472
    Commented Jan 29, 2019 at 15:34
  • @Cown Computers, peripherals and AP are all wired to a common switch. Two different nets (83.XX and 192.168.10.XX) live under same switch and wires. No firewalls or routers needed for these nets, all are simple because computer's NIC cards can have multiple addresses. Problem occurs on wireless devices that have no access to 192.168.10.XX since AP cannot have multiple WAN addresses and reroutes packets only to 83.XX net.
    – Lazikas
    Commented Jan 29, 2019 at 16:16
  • You need to show us how your routing is done (which routers & which routes) and what your firewall policies look like. Likely, one of those is the problem or both.
    – Zac67 ♦
    Commented Jan 29, 2019 at 18:09

2 Answers 2

Reset to default
3

Welcome to Network Engineering! Using multiple addresses per host in order to "get away with" not using routers causes problems as you've discovered. Essentially, you're doing a "hack" to make your routing work.

Access points (and wireless routers) can't do what you need to make this work. You are going to have to use a router between your subnets in order to get your wireless clients to reach both subnets.

Improve this answer
0

Use a router with a routing table on the WAN edge. Use a pool of NAT addresses to give each device a 1-to-1 NAT address; that way each device only has to have 1 IP address, and that address will be on the private subnet.

Improve this answer
1
  • NAT is a hack to extend the life of IPv4, and it should be avoided whenever possible. It should almost never be used inside a a network, and it is totally unnecessary in the network described in the OP because there is no need to translate between private and public addresses, nor are there networks with overlapping addresses.
    – Ron Maupin ♦
    Commented Feb 16, 2019 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.