1

In our network, all wired PCs have a direct access to internet (83.XX.XX.XX) and a secondary IP address on the same NIC in order to access a subnetwork (192.168.10.XX) with wired peripherals (scanners, printers, etc). The problem is that wireless devices (such as laptops or mobile phones), which access internet via an AP are in a third subnet (192.168.1.XX) and have no access to these peripherals. See the attached diagram.

enter image description here

If I change the WAN of the AP to 192.168.10.XX, wireless devices will access peripherals but will lose internet.

Is it possible for wireless devices to access both internet AND peripherals?

6
  • How come you use dual NIC on your hosts? Why not make it all part of the same VLAN and then route/firewall everything?
    – user36472
    Jan 29 '19 at 15:23
  • @Cown I use double ip addresses, not two NICs per PC. And i cannot put all PCs under a VLAN because a. we have lots of servers and machines that are remotely controlled and b. i have no access to institution firewall. This setup is for a lab with 10 main computers/servers, 32 workstations (that exist in another subnet) . I tried to simplify my question as much as i could, the real setup is much complicated.
    – Lazikas
    Jan 29 '19 at 15:32
  • Well without any knowledge of how your equipment is configured or the real overview of how everything is connected it's gonna be hard to help.
    – user36472
    Jan 29 '19 at 15:34
  • @Cown Computers, peripherals and AP are all wired to a common switch. Two different nets (83.XX and 192.168.10.XX) live under same switch and wires. No firewalls or routers needed for these nets, all are simple because computer's NIC cards can have multiple addresses. Problem occurs on wireless devices that have no access to 192.168.10.XX since AP cannot have multiple WAN addresses and reroutes packets only to 83.XX net.
    – Lazikas
    Jan 29 '19 at 16:16
  • You need to show us how your routing is done (which routers & which routes) and what your firewall policies look like. Likely, one of those is the problem or both.
    – Zac67
    Jan 29 '19 at 18:09
3

Welcome to Network Engineering! Using multiple addresses per host in order to "get away with" not using routers causes problems as you've discovered. Essentially, you're doing a "hack" to make your routing work.

Access points (and wireless routers) can't do what you need to make this work. You are going to have to use a router between your subnets in order to get your wireless clients to reach both subnets.

0

Use a router with a routing table on the WAN edge. Use a pool of NAT addresses to give each device a 1-to-1 NAT address; that way each device only has to have 1 IP address, and that address will be on the private subnet.

1
  • NAT is a hack to extend the life of IPv4, and it should be avoided whenever possible. It should almost never be used inside a a network, and it is totally unnecessary in the network described in the OP because there is no need to translate between private and public addresses, nor are there networks with overlapping addresses.
    – Ron Maupin
    Feb 16 '19 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.