<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
</style>
</head>
<body class='hmmessage'>
Oh, I'm sorry, I think there was a little misunderstanding at my side. The solution you described here:<br><br>> >> If you cannot go the VLAN way, the only way to deal with this is just<br>> >> do your configuration using just "eth0". You can have a route where<br>> >> the in and out interfaces are the same, and you can control the flow<br>> >> of traffic between subnets using "src" and "dst" with the "route"<br>> >> commands.<br><br>is actually what I tried to achieve so far. My understanding of subnets was right then, but thanks for the very good explanation, which confirmed my theorie.<br><br>Here's what I've done so far and what used to work on the old server:<br><br>router alpha2delta src 192.168.0.2 dst 192.168.1.50<br> route all accept<br>router beta2delta src 192.168.0.4 dst 192.168.1.50<br> route all accept<br><br>Again: it works "sometimes". For example alpha can ping delta, but beta can't. Wait a few minutes and the behaviour may be vice versa. Even more interesting is that delta happens to be a network printer with a web interface. Even when I'm able to reach the printer by ping, I may not be able to access it's web interface (things are getting spooky here, don't they?).<br><br>There's no real security policy, but it would just be nice to seperate the two networks from each other: business/office and home. Besides, I'd like to find the root of this problem. So if you do have any ideas what might be causing it, and you've got some minutes to answer, I'd be more than happy to hear from you.<br><br><br>Thank you so far,<br><br>Morin<br><br><br>> > Would this really work? If all computer are situated in the very same subnet<br>> > and they are connected by just one switch, how does the server have an<br>> > influence on the flow of data? If there's a package coming from A directed<br>> > to B, the switch will just put the package on the particular port B is<br>> > connected to and the server (being conntected to the same switch on another<br>> > port) won't even notice. Or am I mistaken?<br>> <br>> For the switch, A and B are the source and destination mac addresses<br>> contained in ethernet frames, which may or may not be the mac<br>> addresses of the hosts you are calling "A" and "B".<br>> <br>> Let me give you two examples:<br>> <br>> 1. Hosts A and B are on the same subnet. Host A sees that B's ip<br>> address is on the same subnet, so it sends an ARP request to find B's<br>> mac address. It then sends ethernet frames with B's mac address as<br>> destination, containing ip packets with B's ip address as destination.<br>> The switch sends these frames/packets to host B.<br>> <br>> 2. Hosts A and B are on different subnets. Host A sees that B's ip<br>> address is on a different subnet, so it goes to the routing tables and<br>> finds its default gateway (server C). Then it sends and ARP request to<br>> find C's mac address. It then sends ethernet frames with C's mac<br>> address as destination, containing ip packets with B's ip address as<br>> destination. The server C receives these frames and basically does the<br>> same as example 1.<br>> <br>> So, when two hosts are on different subnets, it doesn't matter if the<br>> physical link is the same or not, traffic will flow through C, so it<br>> can be controlled there.<br>> <br>> But, like I said before, without VLANs this separation is easily<br>> broken by a malicous host, which only needs to change its ip address<br>> to circumvent any controls imposed by the server. But in your case<br>> this risk may not be of concern, only you can tell.<br>> <br>> -- <br>> Carlos Rodrigues<br><br /><hr />Der neue Messenger 2009 ist da! <a href='http://redirect.gimas.net/?n=M0902WLM2009' target='_new'>Kostenlos downloaden!</a></body>
</html>