How can I get two separate subnets to share one internet connection?

[rightwingnut]

Goal: to have two(2) separates groups of computers (presumable separate subnets) share a DSL connection but not be able to see computers in the other group.

History: Client had about 20 PC's in her building connected via a couple of switches behind a Linksys BEFSR41. Client scaled back and decided to lease a portion of her building. Wants to share internet access with her tenant without allowing tenant access to her remaining 10 computers. So, I purchased a BEFSR81 and connected it as follows.

WAN side of BEFSR81 connected to switch behind the BEFSR41. "81" gets a 192.168.1.xx IP address on the WAN side from the "41". "81" is configured on the LAN side to 10.2.1.1 and will DHCP 10.2.1.xxx (100-149). This seems to work perfectly with regard to internet access and separation of the subnets. All PC's on either subnet have good internet access. Computers on the 10.1 subnet also work well with regard to any folder / file sharing. Files can be copied or opened across the subnet as expected. Computers on the 192.168 subnet choke when trying to touch a file across the subnet. No network files can be opened or copied. Problem disappears instantly if I unplug the "81" router.

Anyone have any suggestions? Am I thinking correctly on how this should work? If there's a better way to accomplish the goal ...

Tried to call Linksys but got no where. Thanks !!

 

[bcastner]

Add one more router.

Have then both routers setup as you did the befsr81, with the original befsr41 used as the internet gateway device.

 

[bcastner]

Note: give the new router a LAN subnet of 192.168.2.x

 

[rightwingnut]

Thanks very much for your reply. If I understand you, you are suggesting that I put two (2) routers (one for each subnet) behind a single 3rd router (the original router) acting only as a gateway. In my head, this seems like it would work. However, is there another way to meet my goal considering this additional issue?:

Various PC's on the original subnet are scattered around the building. Due to geographical issues (and lack of original planning), some PC's are connected "directly" to the back of the "41" router (or on a switch physically close to the router). Then a single cable runs from the same router to the wiring closet all the way across the building where it connects to another switch. All the remaining PC's connect to this closet switch. So, the problem is that I can not readily group each subnet's PC's on a router directly "behind" the first router.

Essentially, I want to split up the PC's that are wired to the panel in the closet into two groups: the tenant group on one subnet; and the original subnet separate (but remaining peers with the other PC's that are connected to the router via the first switch (or the router's directly which is not anywhere near the closet). Is there a way to do this without a massive wiring project (please don't say wireless, as the client doesn't want it).

Thanks again.

 

[bcastner]

At the original location (where the BEFSR41 and switch are located) add a second BEFSR41. Connect its WAN port to the original 41 (just as you did the 81) and give it a LAN IP network address of 192.168.2.x. Unplug from the original 41 any tenant connections, and plug them into the new 41. Plug in the switch in that location from the old 41 to the new 41.

The old 41 has two connections now: one to the 81 WAN port, and one to the new 41 WAN port.

The new 41 has a WAN connection to the old 41, the workstation clients that used to be on the old 41, and an uplink to the switch at the old 41 location.

Done.

As a second thought, if you installed Netbui on the tenant workstations, this would likely resolve the networking problems without any other steps taken.

http://www.scotsnewsletter.com/38.htm#tipadaweek

http://www.scotsnewsletter.com/40.htm#tipadaweek

 

[rightwingnut]

Thanks again, but I guess I'm not being very clear. Let me try one more time using different words.

The original "41" router/switch is connected to the DSL modem at location "A" in the building. Several CLIENT computers are connected right to this router or on a switch right next to it. Also, coming out the back of this "41" router is a single CAT5 cable running quite a distance to a wiring closet; location "B". The cable goes to a standard 24-port switch. Also, going into the switch is, let's say 16, patch cables from the majority of the workstations that are wired to the patch panel in the closet. ONLY at this location are there any TENANT cables. So, essentially, I need to split up the 16 PC's that come to the closet into two groups of 8. Easy enough except I need one group to continue to be on the same subnet as the PC's that are locally connected to the "41" router/switch by the DSL modem (all the way across the building at location "A").

If you have the picture in your head now, you can see that I originally daisy-chained the "81" switch in the closet to make a new subnet. But the "81" router/switch's presence on the subnet administered by the "41" router/switch screws up that subnet (only problem is moving/opening files across the subnet as described before; internet ok everywhere on both subnets).

Your first suggestion I know will work but I've got this distance problem. Do you (or anyone else) know of a way to make this happen without running cables for the TENANT PC's from the closet all the way to the "41" router (so, I could put 2 routers right behind 1 as you first suggested). It seems like the "81" router is interfering in some way with the "41" subnet's traffic. Any idea on what it might be and could I use a filter or other tool to fix this issue?

Is that clear?

Thanks again.

 

[rightwingnut]

ADDITIONAL INFO:

I DMZ'd the "81" router (the router with it's WAN interface on the "41" router's LAN side) from the "41" setup. After doing this, I am now able to copy/open files across the "41" subnet. There's still something funny going on because it's v-e-r-y s-l-o-w. What should take 1-2 seconds takes 2-3 minutes but it does work now instead of getting a "resource unavailable" error message. So, I know I'm touching a nerve - the "81" router on the WAN port is somehow interfering with the traffic on the "41" subnet. So, it seems that all "41" subnet traffic is seen by the "81" as Internet traffic and it's doing something to interfere with (or maybe respond to) that traffic.

Any CISCO hot shots here than can help me tweak something?

 

[bcastner]

. Do you have Block WAN requests disabled on the 81?

My thinking is that this is a Netbios end-point Browser issue.

If you have an XP client on the 41 network, could you Start, Administrative Tools, Event Viewer, and see if there are any Master Browser issues shown in the log?

 

[bcastner]

Also, do the 41 and 81 have unique Workgroup names?

 

[rightwingnut]

I have tried both enable and disable "Block WAN request" on the 81 router with no noticeable difference.

Not familiar with "Master Browser" issues. Have XP client on 41 router so will try to take a look.

Re workgroup names: problem exists only by connecting the 81 router. Tenants haven't moved in yet so no computers connected. This 81 router is complete responsible for the intereference without anything connected to it.

Here's something that might be an issue though. Since the 81 router is sitting behind a 41 router, I think I want to have it's working mode be a "router" as opposed to a "gateway". Just about every Linksys router I have ever used has this setting option. I almost always leave it the default of "gateway". The only time in the past I have changed it was when I had one connected behind a PC with a satellite connection and I had the PC SHARING that internet connection (using XP internet connection sharing). In this case the "router" was sitting behind the PC for the sole purpose of using it's DHCP over wireless (but I had it dispensing IP address in the same subnet as the PC was dispensing). Back to this issue ... in the 81 router setup, I can't find this simple selection ... router or gateway. Under Dynamic routing options, I only have choices about protocol to use (diabled, RIP1, RIP1-compatible, RIP2).

Any idea how to tell this thing not to be a gateway? This is a BEFSR81 V3 which now has the "cisco" logo. The downloadable user guide no longer matches the setup screens. Does selecting RIPXX imply "router" vs "gateway". I'm in too deep and may need to take a routing / switching class.

Thanks again.

 

[bcastner]

Lets start over.

. Make sure you have the 2/4/04 firmware upgrade for the 81, the non-Zone Alarm version; connect the 81 directly to your computer while doing any firmware changes. Start by holding the reset button down for at least 30 seconds. Turn it off. Wait 20 seconds, turn it on. Do the firmware flash. Repeat the reset cycle, power-off, power-on, and then do a configuration of the router.

. Rather than let the 81 pull a DHCP assigned IP from the 41, give it a static address of 192.168.1.3 on its WAN port (I am assuming this does not conflict with any other static IP on the 41, if so, pick a number < 99, or > 155).
The Gateway address should be 192.168.1.1, subnet mask 255.255.255.0

I say this as there have been issues where the 81 has had firmware issues with DHCP assigned addresses.

. The local LAN subnet should be configured as the 10.0.0.x you started with.

. Ignore concerns about Router vs. Gateway. The setting should be there under Setup, Advanced Routing, but you do want Gateway mode -- the default.

. Do not set any static or dynamic routes on the 81

. Make sure your long cable run goes to the location "B" Switch; that from the switch you go to the 81. You want the long cable run from the 41 to pass through the switch, and then from the switch to the 81. It will not work otherwise. While the 81 version 3 is autosensing, I would use a cross-over cable for this last connection.

. Reset all devices. Power on the 81 last.