I have a routing problem that I nee

[jmics]

I have a routing problem that I need to resolve, which involves three XP machines and three networks.

This does not actually involve a Cisco router, but rather an XP machine operating as a router, but since the problem is a routing issue, it might as well be a Cisco device, which would need the same tables to achieve the desired result.

I posted here because I expect to find the routing expertise in this forum. Since routing is not a commonly used feature in XP (disabled by default), it is not likely that members in the XP forum will be familiar with the subject.

The WKA1 machine is on the 192.168.2.0 network, with an IP of 192.168.2.21 and a gateway of 192.168.2.1
The WKB1 machine is on the 192.168.3.0 network, with an IP of 192.168.3.21 and a gateway of 192.168.3.1
The XP-R machine has three interfaces, one in each of the above networks, and one in the 192.168.1.0 network
The IP 192.168.2.1 has a gateway of 192.168.1.150
The IP 192.168.3.1 has a gateway of 192.168.1.150
The IP 192.168.1.150 has a gateway of 192.168.1.1

The XP-R machine has routing enabled.

The WKA1 machine can ping 192.168.3.1 and 3.21, and 1.150, but not 1.1
The WKB1 machine can ping 192.168.3.1 and 3.21, and 1.150, but not 1.1
The XP-R machine can ping 192.168.2.21, 192.168.3.21 and 192.168.1.1

The message in the failing pings is "Request timed out"

It seems that I need to make changes to the routing table on XP-R, but I am not sure what.

Here is output from ROUTE PRINT on all three machines.

WKA1 machine

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 0c 29 87 e1 90 ...... AMD PCNET Family PCI Ethernet Adapter - Packet
cheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.2.1 192.168.2.21 10
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.2.0 255.255.255.0 192.168.2.21 192.168.2.21 10
192.168.2.21 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.2.255 255.255.255.255 192.168.2.21 192.168.2.21 10
224.0.0.0 240.0.0.0 192.168.2.21 192.168.2.21 10
255.255.255.255 255.255.255.255 192.168.2.21 192.168.2.21 1
Default Gateway: 192.168.2.1
===========================================================================
Persistent Routes:
None

WKA2 machine

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 0c 29 4f a5 17 ...... AMD PCNET Family PCI Ethernet Adapter - Packet
cheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.3.1 192.168.3.21 10
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.3.0 255.255.255.0 192.168.3.21 192.168.3.21 10
192.168.3.21 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.3.255 255.255.255.255 192.168.3.21 192.168.3.21 10
224.0.0.0 240.0.0.0 192.168.3.21 192.168.3.21 10
255.255.255.255 255.255.255.255 192.168.3.21 192.168.3.21 1
Default Gateway: 192.168.3.1
===========================================================================
Persistent Routes:
None

XP-R machine

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 0c 29 65 ea 6d ...... VMware Accelerated AMD PCNet Adapter - Packet S
heduler Miniport
0x3 ...00 0c 29 65 ea 63 ...... AMD PCNET Family PCI Ethernet Adapter - Packet
cheduler Miniport
0x4 ...00 0c 29 65 ea 77 ...... VMware Accelerated AMD PCNet Adapter #2 - Packe
Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.150 10
0.0.0.0 0.0.0.0 192.168.1.150 192.168.3.1 10
0.0.0.0 0.0.0.0 192.168.1.150 192.168.2.1 10
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.1.0 255.255.255.0 192.168.1.150 192.168.1.150 10
192.168.1.150 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.1.255 255.255.255.255 192.168.1.150 192.168.1.150 10
192.168.2.0 255.255.255.0 192.168.2.1 192.168.2.1 10
192.168.2.1 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.2.255 255.255.255.255 192.168.2.1 192.168.2.1 10
192.168.3.0 255.255.255.0 192.168.3.1 192.168.3.1 10
192.168.3.1 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.3.255 255.255.255.255 192.168.3.1 192.168.3.1 10
224.0.0.0 240.0.0.0 192.168.1.150 192.168.1.150 10
224.0.0.0 240.0.0.0 192.168.2.1 192.168.2.1 10
224.0.0.0 240.0.0.0 192.168.3.1 192.168.3.1 10
255.255.255.255 255.255.255.255 192.168.1.150 192.168.1.150 1
255.255.255.255 255.255.255.255 192.168.2.1 192.168.2.1 1
255.255.255.255 255.255.255.255 192.168.3.1 192.168.3.1 1
Default Gateway: 192.168.1.150
===========================================================================
Persistent Routes:
None

 

[VinceWhirlwind]

First thing is, does 192.168.1.1 have routes to 192.168.2.0/24 & 192.168.3.0/24?

The next thing to look at would be the routing on XP-R
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.150 10
0.0.0.0 0.0.0.0 192.168.1.150 192.168.3.1 10
0.0.0.0 0.0.0.0 192.168.1.150 192.168.2.1 10
192.168.1.0 255.255.255.0 192.168.1.150 192.168.1.150 10
192.168.1.150 255.255.255.255 127.0.0.1 127.0.0.1 10

I'm not sure what that all means. Looks like 3 default routes and some weird stuff on Interface 1.150.

 

[jmics]

1.1 is actually the trusted side of a firewall, which acts as an outbound gateway to the net. The gateway for the 2.0 and 3.0 networks to the 1.0 subnet is through the 1.150 inteface on the XP-R machine. The firewall will let me build routing between the otuside and trusted interfaces, but it is not involved in the 2.0 or 3.0 subnets. If a packet hits the 1.1 IP, it is trying to get across the firewall, not back the other way.

All zeros translates to 'any' in the Cisco world. So for the first line in the routing table on XP-R,
For any network not already defined, given any netmask, IP 192.168.1.1 as the gateway, and send the packet out of this machine via the interface with IP 192.168.1.150. The route has a metric of 10.

It does look like 3 default routes, but that is how XP loads the routing table for a machine with 3 interfaces. I have not modified the table in any way.

 

[unclerico]

If a packet hits the 1.1 IP, it is trying to get across the firewall, not back the other way.

That's not how it works. Take for example 2.21 trying to ping 1.1. 2.21 knows how to reach 1.1 due to the default route and xp-r having a directly connected interface for the 1.x network. When the packet reaches 1.1, how does it know where to send the response if it doesn't have a reverse route back to 2.x??

The IP 192.168.2.1 has a gateway of 192.168.1.150
The IP 192.168.3.1 has a gateway of 192.168.1.150

Remove these. You see this

0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.150 10
[b]0.0.0.0 0.0.0.0 192.168.1.150 192.168.3.1 10
0.0.0.0 0.0.0.0 192.168.1.150 192.168.2.1 10[/b]

because you have the 2.1 and 3.1 interfaces each populated with default gateways. You should only have one interface with a default gateway applied unless you set a higher metric for any subsequent default routes you add.

 

[VinceWhirlwind]

The gateway for the 2.0 and 3.0 networks to the 1.0 subnet is through the 1.150 inteface on the XP-R machine."

I suspect this is just a peculiar way XP does routing?
Normally, a single device has a single routing table. A routing table only needs one default route.

" The firewall will let me build routing between the otuside and trusted interfaces, but it is not involved in the 2.0 or 3.0 subnets."

This is your problem: If the firewall doesn't have 2.0 and 3.0 in its routing table, it cannot pass traffic to them.

Bear in mind that session-based protocols are not uni-directional....