Topic: How to set up the SME GW/Server as a second router

[dbaddour]

Hi All,

This been trouble me for a week. what my original set up is:
we have an SME GW/server set up with VPN for 2 locations. 1st location with 192.168.1.x and where this SME is IP 192.168.5.x, Works great. about a year ago i added another SME GW/Server as a router to another subnet in order to extend and keep this subnet for Developers only. this router has ext IP 192.168.5.x which talks to 5.x and 1.x thru the vpn both connections. the internal IP is 192.168.2.x, this works great without any issues. Now i have a task to add another subnet for different dep. the new subnet will be 192.168.3.x, we need this to be connected thru the .2.x subnet (making data move better without going thru the 5.x) but also in case someone on the .5x subnet need to access it will be able as well..
I set up the SME as GW/Server dedicated, i gave it the ext ip of 192.168.2.xx and internal 192.168.3.xx. I added this subnet to trusted network on the .2.x and the same on the .5.x subnet. now i can access any system on the .2.x and .5.x subnet from the .3.x but not from the .5 or .2.. so one way out but not in...
what should i do? what am i missing here..? i tried many suggestions thru the forums but none worked. I thought about adding both GWs IPs .2x and .5.x to the router on the .3.x but this did not work as error: the router (GW) is not accessible from this subnet).

I have to add this subnet to the enviroment and must be accessible from the other subnet, but i like it to be going thru the .2.x to attend lower the network traffic as the .2.x and .3.x are used only by Dev dep.

Thank you in advance for all of your hepl?

[CharlieBrady]

I set up the SME as GW/Server dedicated, i gave it the ext ip of 192.168.2.xx and internal 192.168.3.xx. I added this subnet to trusted network on the .2.x and the same on the .5.x subnet. now i can access any system on the .2.x and .5.x subnet from the .3.x but not from the .5 or .2.. so one way out but not in...

SME server does not do any routing of inbound connections on the WAN interface. Connections out via the WAN interface use NAT.

[dbaddour]

THank you Charlie,

Not been picky, I was under the assump that NAT is enable by default. Any configuration to be done on The NAT? if so how? would you please?

THank you

[CharlieBrady]

Not been picky, I was under the assump that NAT is enable by default.

NAT is always enabled. And inbound firewalling is enabled and does allow any inbound packets except those directed at the external interface - i.e. it doesn't accept any packets that have destination on internal LANs. If I have understook you correctly, you want SME to work as a pure router, without firewalling. Or at least, with very different firewalling than it has currently. You would need to rewrite /etc/rc.d/init.d/masq to do that.

[dbaddour]

Hi Charlie,

You are correct the only use of the SME is to route the traffic to the other subnets and vise-versa? don't care much about the firewall as it will be for internal use only.
Now /etc/rc.d/init.d/masq in order to rewrite? i thought cannot be edited since it will disapear when the system rebooted?

Thank you

[Stefano]

dbaddour: I would buy a router and use it.. the time you will loose trying to bend SME is more valuable IMVHO