Static Route through Router to Modem

[dave87]

Evening all,

Just bought the TP Link router suggested in the thread I created a while back and have set it up with the BeBox set to bridge mode. Works fine for internet etc.

Network: Internet ---- BeBox ---- TP Link TL-WR1043ND ----- rest of network

Except I can't get the Modem (BeBox) status page up through the router. If I ping the address, I get a time out. So, I think I need to set a Static Route through the WAN port of the Router so that it is accessible?

The IP of the routers config page is 10.0.0.138. A non routable IP. So the Router is looking on the LAN rather than through the WAN port for it, and hence not finding it. I go to the Static Route settings, and I input:

Destination Network - 10.0.0.138
Subnet Mask - 255.255.255.254 (or 255, tried both)
Default Gateway - My Router's IP (192.168 range)

and enable it.

If I ping the modem again, I get 'Destination host unreachable' a different error to what I previously got.

So where am I going wrong? I have yet to put DD-WRT on it (curious to see what the default firmwire is like) but to do what I think I need to do on DD-WRT I'd just need to follow this: http://beusergroup.co.uk/technotes/i...p?title=Dd-wrt


Any thoughts?

[Apex]

Try putting the router into the same ip and submask range has the be box -

Also - i take it the cable goes from the lan port on the be box to the wan port on the new router and that the be box is still doing the dhcp/dns and nat routing ?

[dave87]

BeBox is in bridge mode, so as I understand it, it is in effect transparent. Router is dealing with DHCP/DNS etc.

[badass]

BeBox is in bridge mode, so as I understand it, it is in effect transparent. Router is dealing with DHCP/DNS etc.

Can I ask why? It seems your network in unneccesarily complex, but of course I know nothing more than what I see here.

Assuming this is a necessary setup, what is the IP address of the Bebox? PM it to me if you don't want it on this forum.
In theory, a bridge will have no IP address apart from a virtual management IP address. This will likely need to be a public IP address as the bebox is outside your network effectively.
Can you access the bebox from other devices?

[spoon_]

The minute you put the modem in bridge mode you lose connectivity to it, even if you assign the IP in the same range. Its effectively on WAN side of the network not on a LAN.

Can I ask why? It seems your network in unneccesarily complex, but of course I know nothing more than what I see here.

That's the only way he can make use of the router...

[dave87]

Fair comment.

Three primary reasons for retaining the BeBox and getting a router. Firstly, FTTC is just around the corner here, so any new kit had to be suitable for use before & after FTTC. As I understand it, Infinity does much the same - Modem and then separate router. So instead of buying an ADSL2+ Modem/Router and then replacing it if I went to FTTC broadband, I emulated the same setup for ADSL2+. The second reason is that people on BeThere report higher sync speeds with the chipset the standard BeBox uses (it is shared in other ADSL2+ Modem/Routers) so, to get the most out of my line, I wanted to stick with it (it is, afterall, the chipset that BeThere designed their network for compatibility with). Thirdly DD-WRT only works on Routers, so if I wanted to use that, it had to be separate ADSL2+ Modem and Router.

Now I believe by setting the BeBox into bridge mode effectively makes it a modem only - i.e. turns off the router/wireless aspects. Then I've set the Router (TP Link TL-WR1043ND) to do the DHCP/DNS etc - the router functionality and then the wireless networking aswell. So all I've done is take what the BeBox could do, and separate out the functions. Unless I'm missing something here? The network is not behind dual NATs or anything like that - the BeBox is just acting as a modem (by setting it into bridge mode).

So Phoneline -> BeBox -> WAN port on TP Link TL-W1043ND

Now the 10.0.0.138 is one of two addresses the BeBox is programmed to respond on (the other being in the 192.168 range, which won't work because that is the same subnet as my LAN). So that must be the virtual management IP you talk about (allows me access to the configuration pages etc, and I presume but haven't tried, Telnet).

Problem is that 10.0.0.138 (because it is the BeBox) is on the WAN side of the router, and isn't normally a routable IP - so I can't connect on that, unless I specify a route to it?

If I plug my laptop in via ethernet into the BeBox (bypassing the router) then I can get the page up straight away - but that means being downstairs and plugging straight into the BeBox, not being able to access the page through any computer on the Local LAN. Bit of a pain if you want to check what the sync speed is or some such.

So the question is how do I get the Router to understand that for 10.0.0.138 it is not on the LAN side of the router, but infact on the WAN side? I think that is the point of the static route?

[dave87]

That is how Infinity is setup. Phoneline -> VDSL modem -> Router

I've done the same, except Phoneline ->BeBox ADSL2+ Router in bridge mode -> Router

Idea being if I go FTTC then I can simply swap out the BeBox for the VDSL modem.

[badass]

Now the 10.0.0.138 is one of two addresses the BeBox is programmed to respond on (the other being in the 192.168 range, which won't work because that is the same subnet as my LAN). So that must be the virtual management IP you talk about (allows me access to the configuration pages etc, and I presume but haven't tried, Telnet).

Problem is that 10.0.0.138 (because it is the BeBox) is on the WAN side of the router, and isn't normally a routable IP - so I can't connect on that, unless I specify a route to it?

If I plug my laptop in via ethernet into the BeBox (bypassing the router) then I can get the page up straight away - but that means being downstairs and plugging straight into the BeBox, not being able to access the page through any computer on the Local LAN. Bit of a pain if you want to check what the sync speed is or some such.

So the question is how do I get the Router to understand that for 10.0.0.138 it is not on the LAN side of the router, but infact on the WAN side? I think that is the point of the static route?

First things first - calling a 10.x.x.x IP address non routable is misleading and may be causing confusion. Any address in the following ranges:
10.0.0.0 to 10.255.255.255
172.16.0.0 to 172.32.255.255
192.168.0.0 to 192.168.255.255
is a private IP address. These addresses will not be routed on the public internet, however they most certainly are routable. I'm not saying it's wrong to call them non routable - just that calling them that can cause confusion. I will refer to these addresses as private IP addresses from now on. The addresses that are actually used on the internet I will refer to as public addresses from now on.

Secondly, i'm a little confused here. You're on the Be network. They allocate public IP addresses. I know Virgin media allocate Private IP addresses and then use NAT to provide internet access to their customers, but I'm pretty sure Be internet do not do that. I use the business version and my IP address is most certainly public.

You say that the Bebox has 2 addresses, 10.0.0.138 and 192.168.x.x
Although it is theoretically to have a bridge with 2 IP addresses in 2 separate subnets, they would never be used for anything other than management. This does not sound right.

One more thing - a route when defined always has a destination address, a destination mask - together they make up the destination network, an interface and a gateway. i.e. data destined for the destination network must be sent through interface xxx to the gateway specified. The router must ask you somehow which interface to use to send the data to the next hop.


A possible solution:
Forget bridge mode and configure the Bebox as a NAT router again. Configure it to have a completely new "inside" network with a network address of say 192.168.10.0 with a mask 255.255.255.0. Give it the IP address 192.168.10.1.

Give the WAN port on the TP Link TL-WR1043ND an Ip address of 192.168.10.2
Configure the Bebox to forward and NAT all traffic to/from 192.168.10.2
Configure the inside of your TP Link TL-WR1043ND to use your existing private subnet.
Provided you only use one subnet inside, this should now allow you to access the config page of your Bebox using the address 192.168.10.1 from any machine inside your network. You shouldnt need to define any routes as the Bebox will be the default gateway for the TP Link TL-WR1043ND and the TP Link TL-WR1043ND will be the default gatewat for everything inside.

[dave87]

You are right about BeThere providing Public IPs - I'm given a BeThere Static IP with the package I'm on. That has remained the same (simply had to enter that, the Default gateway, subnet mask and DNS Servers when I setup the TP-Link). From there, the TP Link is doing all the NAT work - inc port forwarding/uPnP etc - the BeBox just passes the data.

The motivation for offloading the router part of things to another box was due to performance issues with NAT (especially uPnP/Port Forwarding & xBox Live), so I'm reluctant to re-enable the BeBox as a router, especially as the only issue I've got at the moment is not being able to access the BeBox's config page without plugging directly into it. That said, if there is a way to configure the setup such that I can without doing so, all the better.

As far as I understand it, apart from the management IP of 10.0.0.138, the BeBox is invisible. It, by virtue of being connected in Bridge mode, is not doing anything but passing the data to the TP-Link. The TP-Link is the router part, the BeBox simply becomes the modem.

So, unless I'm missing something, it is exactly as you were saying:

One more thing - a route when defined always has a destination address, a destination mask - together they make up the destination network, an interface and a gateway. i.e. data destined for the destination network must be sent through interface xxx to the gateway specified. The router must ask you somehow which interface to use to send the data to the next hop.

But I don't get the option of which side. This is the system routing page on the TP-Link:



With IP details removed for security reasons.

If I enable the static route I created on the other page:



The system routing page then shows this:




As an additional line. Now what I believe needs to happen, is the interface needs to be set to WAN rather than LAN & WLAN. But I can't see how to do that? It doesn't allow 0.0.0.0 to be set as the gateway (as per the predefined routes on the System Routing page).

[badass]

You are right about BeThere providing Public IPs - I'm given a BeThere Static IP with the package I'm on. That has remained the same (simply had to enter that, the Default gateway, subnet mask and DNS Servers when I setup the TP-Link). From there, the TP Link is doing all the NAT work - inc port forwarding/uPnP etc - the BeBox just passes the data.

The motivation for offloading the router part of things to another box was due to performance issues with NAT (especially uPnP/Port Forwarding & xBox Live), so I'm reluctant to re-enable the BeBox as a router, especially as the only issue I've got at the moment is not being able to access the BeBox's config page without plugging directly into it. That said, if there is a way to configure the setup such that I can without doing so, all the better.

As far as I understand it, apart from the management IP of 10.0.0.138, the BeBox is invisible. It, by virtue of being connected in Bridge mode, is not doing anything but passing the data to the TP-Link. The TP-Link is the router part, the BeBox simply becomes the modem.

So, unless I'm missing something, it is exactly as you were saying:



But I don't get the option of which side. This is the system routing page on the TP-Link:



With IP details removed for security reasons.

If I enable the static route I created on the other page:



The system routing page then shows this:




As an additional line. Now what I believe needs to happen, is the interface needs to be set to WAN rather than LAN & WLAN. But I can't see how to do that? It doesn't allow 0.0.0.0 to be set as the gateway (as per the predefined routes on the System Routing page).

I have an idea of what might be going on here, but I need to see the real IP addresses on the TP link box. Any IP address that begins with 192.168 or 10 or between 172.16 and 172.32 simply cannot be accessed from elsewhere on the internet. If the addresses begin with anything else, do not post them.

As a possible fix, change the gateway on the 10.0.0.138 route to 10.0.0.138
The TP link box may be assuming the route is on the inside due to the gateway IP address being on the inside subnet.

One more thing. Can the TP link box be accessed by SSH/telnet? If so, you may find its command line far more flexible than the GUI.

[funkymunky]

Try putting the router into the same ip and submask range has the be box -

Also - i take it the cable goes from the lan port on the be box to the wan port on the new router and that the be box is still doing the dhcp/dns and nat routing ?

Apex is right, your router needs to have an IP in the same subnet as the BeBox so that it can speak to it, it'll generate the routing able entry by itself using the interface as the gateway.

[shaithis]

As nice as it is to have, I haven't needed to access the webadmin on my bridged-mode BeBox since enabling it 2 years ago.

[dave87]

I have an idea of what might be going on here, but I need to see the real IP addresses on the TP link box. Any IP address that begins with 192.168 or 10 or between 172.16 and 172.32 simply cannot be accessed from elsewhere on the internet. If the addresses begin with anything else, do not post them.

As a possible fix, change the gateway on the 10.0.0.138 route to 10.0.0.138
The TP link box may be assuming the route is on the inside due to the gateway IP address being on the inside subnet.

One more thing. Can the TP link box be accessed by SSH/telnet? If so, you may find its command line far more flexible than the GUI.

That looks more promising - haven't had the time to play - but it generates what I think are the right entries in the respective pages.

As nice as it is to have, I haven't needed to access the webadmin on my bridged-mode BeBox since enabling it 2 years ago.

Aye, have begun to think that - haven't needed access to it since I setup the TP-Link, but as you say, would be nice to have

[burble]

I know Virgin media allocate Private IP addresses and then use NAT to provide internet access to their customers

I've not seem them do that on either the cable or ADSL networks. The WAN IP I've got on my router is definitely not an RFC1918 address.

[blueball]

I've not seem them do that on either the cable or ADSL networks. The WAN IP I've got on my router is definitely not an RFC1918 address.

It used to be visible as the first hop after your router but now it is masked. It is normally a 10.x.x.x address.

[Konan555]

Provided the firewall supports it....

All you have to do is add another IP (often refered to as an IP Alias or Virtual IP) to the WAN side of the firewall that is on the same subnet as the router's web interface. It should work via a default NAT in most cases, no need to worry about things like static routes.

The screen grab below shows a ZyWall USG set up with two WAN1 addresses.

WAN1 is DHCP and is related to the PPoE connection that the firewall logs in to (bridged by the router).

WAN1:1 Is set to 192.168.1.2 - The router's LAN interface is 192.168.1.1

LAN is a 192.168.0.0/24 subnet. Anything on the LAN with this firewall set as the gateway will be able to connect via NAT to 192.168.1.0/24 subnet devices connected to the WAN1 port of the firewall (in this case, the router).