Win 2k network with router

[andras hiesz]

Hi!

I am not sure about the answer so i ask u, maybe u can tell me the truth.:)

It's not possible if :
i have a win2k server with 2 nic
1. nic to my local network(with 192.168.1.100)
2. nic to my router(static) which is connected to the internet.(192.168.123.50)

So: without a proxy server installed on the win2k its inpossible to connect my local area PCs to the Net?! Is it true or not.
I think its true but i am not 100% sure.
Thx for your answers..

[John Collier]

Andrias,

I'm not sure I understand your question. Could you please make it clear if you are trying to connect a separate PC to the Internet through your Win2k Server?

If you are trying to connect something from your secondary NIC (the one with the 192.168.1.xxx address) then you may want to look into the help files on your machine for something called Internet Connection Sharing. It would be one way to accomplish connecting other PCs on that network to the Internet through your Win2k Server.

The big thing that concerns me is the security risk on a network configuration such as this. The way I understand what you are trying to do, all someone has to do is to crack into your Win2k Server and they immediately have access to your entire network.

I would seriously look into a router that has a separate interface for machines that you want to use to serve information to the WWW and keep your private network completely separate from your servers.

If you have an old PC sitting around that you aren't using for anything else you could build one using that. That's what I did and I have never been happier.

Just my thoughts (for what they are worth)

[Jerome Henry]

To complete John's tip, your 2k machine can definitely act as a router. Read at :
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windows2000serv/reskit/default.asp

You have ther all routing functions details from m$.

But please follow John's advice on security, it's so easy to compromise such a machine...

J

[andras hiesz]

so, it wasnt clear than, what i wanted to ask:)

I tell it again:
I have a router.(SMC baricade)
The router shares the internet connection between some computers.(my neigbours:)
The router serves IP addresses from 192.168.123.x addresses.
My win2k server is connected to this router with the IP 192.168.123.50, and has an other NIC with static 192.168.1.100.

My mother machine is connected to this 192.168.1.x network with its 192.168.1.1 IP address.

My question is, that is it possible that my mother comp access the internet without any proxy server running on my win2k server.
(its only a theoretical question)

I think its not possible, couze if i use NAT or ICS than the packets are forwarded by my server with the source IP address of 192.168.1.1 but when the reply packets reaches the router, the router cant forwad them couze they dest ip address is the 192.168.1.1 which is unknown for the router.
It only know about the 192.168.123.x network.

So the question is, is there any other possibility (which is not the proxy) to reach the net from my mother PC?

This is the question:)

thx, for your help..

[Roger Faucher]

Andras:

I assume you want your internal NIC (local network) to route packets to your external NIC (router). There is an Internal Routing (bridging) capability that needs to be activated. I can't seem to locate it right now. Look around in your TCP/IP properties and Network properties and see if you can locate it and turn it on. I'll keep looking and let you know if I find it or one of the other people will refresh my memory.
HTH

Roger

[andras hiesz]

i little mistake:

the ICS would be good but i can only use the ICS if i dont have a DNS server or DHCP server. But my win2k server serves ip addresses on the 192.168.1.x network..
(and i use my own DNS server as well..).

[John Collier]

Andrias,

I think I may be following you a little bit better now (but I could still be off a bit).

If you turn on the forwarding services that we have mentioned before, you will be just fine with the connection passing through your server to your mother machine.(as you put it) simply because the server will then wrap your IP packet up in another layer of identifiers that the existing router will understand and know how to route. It will then go through to the I-net, and come back in through the router and get sent back to the server. At that point the server will strip off the extra layer of addressing that the router used and send it back to the mother machine without error since the server knows where it came from in the first place.

What you are basically doing if you follow the suggestions above is to put one router behind another (the Win2k Server does double duty as a router). As long as both routers know how to speak to each other, they do not both have to know every machine that the other knows. The traffic will still flow.

By the way, the router I built out of an old 133 Celeron for my house has a built in proxy server on it and the drive is only about 1.2 GIG in size. This still leaves me with enough room for about 1 GIG of proxy space available for my home network. If you really want a proxy server, I would strongly suggest it. Besides, the additional security that it offers is well worth the effort IMHO.

[Roger Faucher]

Hi:

Here's a link that talks about it: http://support.microsoft.com/default.aspx?scid=kb;en-us;139334&Product=win2000

Roger

[Roger Faucher]

Andras:

Keep in mind that article I directed you to is for the reverse problem, where you don't want the NICs to route packets and they do. So check the box instead of unchecking it.

Roger

[andras hiesz]

john: thx the link above:)
both: thx for your help but:

i am a little sceptic about yours article:

1.
if i use the w2k server as a router, than
(in opposite john words) there isnt any 'extra' layer on the packets, its only forwarded to the right way, but no chances are made in the soure or dest address ip fields.
Therefore the simple routing doesnt seems to be good at this problem, couze at the moment when the packets with the other subnet ids arrive to the (outer) router it recognizes that these packets arent from the subnet that it serves, so it drops them...

2. ICS isnt good as well,as i mentioned above.

3. i dont know what this "internal routing"
means but maybe it could be good.