VPN with static routes

[Norm Fisher]

It took me a while to get VPN working, so perhaps I'm just not understanding something fundamental here, so here goes.

Setup is this:

Three networks in different parts of the city. All connected to the net via cable modem with a VPN router right behind the modem. Two of the routers are Netgear FVS318, the third is a Planet model of some kind.

I've configured them as one central hub (the main office) and two remote sites.

I have VPN working fine between central and each hub, but can't get the hubs to talk to themselves. Printing, machine location, everything is working between each individual office and the central office. Nothing works between the two remote offices.

I thought that static routes would make this work, but perhaps that doesn't work going through the VPN tunnel?

Main office is 192.168.1.X net; router at 192.168.1.1

Office A is 192.168.5.X. router at 192.168.5.1. Can see everything on main net and office A LAN. Can ping to machines on the 5.1 net and the 1.1 net from each side.

Office B is 192.168.9.X. router is at 192.168.9.1. Can see everything on main net and office B LAN. Can ping to machines on 9.1 net and the 1.1 net from each side.

I try to ping 192.168.9.1 (office A router) from 192.168.5.110 (my machine) and I get no reply.


Static route in my planet router is set to 192.168.9.0, mask 255.255.255.0, gateway 192.168.1.1

Static route on my FVS318 at the 9.1. hub is set to 192.168.5.0, mask 255.255.255.0, gateway 192.168.1.1

hub router (192.168.1.1) does NOT have any static routes defined.


Now .. nothing works. If I'm reading everything correctly, a ping from 192.168.5.110 to 192.168.9.1 should be sent through the VPN to 192.168.1.1, then since 192.168.1.1 knows how to get to 192.168.9.1 it should just go to the router through the second VPN.

What am I doing wrong?

Yes, I could configure a second VPN between office A and office B, but that doesn't seem very logical because then if I add a third remote site I'd have to do multiple extra connections. AND .. it just seems to me that this should WORK.

Thanks in advance!

 

[bsop]

You need a router.

The only time you don't need a router is when you have a dedicated circuit and no routing is done what so ever.

Once you are dealing with more than a Point to point connection, you must have a router.
If you get a Cisco router, RIP will automatically build a routing table.


Of note,

10.x.x.x
172.x.x.x
192.168.x.x
ALL ARE ILLEGAL non routable addresses on the internet.
You must have a router or a gateway that will add a legal address to move data across a TCP/IP network.

You also have some of your equipment configured in different networks.
If this is intentional, you MUST have a router.

192.168.1.x is one network
192.168.5.x is yet another
192.168.9.x is yet anoter network.
None of these networks can ever communicate with each other without a router.
Your network masks look ok. They are default.

The x.x.1.x can only ping anyghing in the x.x.1.x range and the same with the other 2 addresses. To overcome this, I will repeat, you need a router and a routing table that tells the router how and where to get x.x.1.x to x.x.5.x or any other way you need to communications.

I suggest you get a book and study hard and long TCP/IP.

The fix here is easy but very lengthly to explain and
the professional that can do this is worth $200.00 an hour as a contractor.

 

[Norm Fisher]

I'm not sure what you mean by that ..

The FVS318 is in the "routers" section of the netgear site
http://netgear.com/products/prod_details.php?prodID=129&view=

but I guess it's true it doesn't include the term "router" in the name.

Their FVL328 does state that it's a "router". Is this what would be required?
http://netgear.com/products/prod_details.php?prodID=155&view=

Perhaps I'm unclear on the concept, but it seems very close to functional now .. I have two remote offices all communicating with a central office, and the three networks tied together, except for the fact that the two remote offices can't ping each other. ping from one remote to the central works just fine -- I can see all the machines in network neighborhood, can access them, read data off of them, write data to them, etc.

The FVS318 DOES allow you to use RIP, and allows you to enter static routes.

I'm hoping that I just don't quite understand what I'm supposed to put into the static route definition to make all this work.