<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<div id="editbody1">
<div>
<div> </div>
<div class="v1BodyFragment">
<div class="v1PlainText">Our church has a Business Comcast DPC3939 connected to Our little Cisco RV 180 VPN.<br /><br />The Comcast has a local IP of 10.1.10.1, and the WAN Static Address of <br />50.248.230.105. <br /><br />Our Cisco router has a WAN address of 50.248.230.106, and it supports a <br />192.168.1.X network behind that, which is where everything on the LAN <br />lives.</div>
<div class="v1PlainText"> </div>
<div class="v1PlainText">INTERNET==>Comcast DPC3939 <===>Our Cisco RV180VPN<====Our 192.168.1.X LAN <==JackTrip Raspberry Pi Virtual Studio</div>
<div class="v1PlainText"> 50.248.230.105 50.248.230.106 <== Everything else on the LAN</div>
<div class="v1PlainText"> 10.1.10.1</div>
<div class="v1PlainText"> |== Ubuntu JackTrip Audio Server</div>
<div class="v1PlainText"> 10.1.10.91</div>
<div class="v1PlainText"> Port Forwarding 4464, UDP 61002-62000</div>
<div class="v1PlainText"><br />We really need to do a couple of things:</div>
<div class="v1PlainText">- our office administrators need to occasionally be able to http access the Comcast router from our 192.168.1.X LAN. They cannot. Any attempt <br />times out. (Fun fact: you CAN http to 50.248.230.105, and get a login response, BUT the correct userid/password will result in a Password failure. It only allows login from the 10.1.10.1 address.) </div>
<div class="v1PlainText">- we need for ME to be able to occassionally get an ssh session from an office PC TO the Ubuntu server. Similar challenge I think.</div>
<div class="v1PlainText">- The Raspberry Pi Virtual Studio box in the sanctuary needs to connect to the Ubuntu server on port 4464. I think it can hit the external address of the Comcast router for that. I've got that port forwarding all working now at home with a UVerse router. <br /><br />We can access the Comcast Router as http://10.1.10.1 IF we go downstairs to the furnace room and plug into the LAN ports on the DPC3939. The PC will then get a 10.1.10.X address.<br /><br />Now, when I look at the DPC3939, I see no evidence that it has a static route for our LAN. So, when someone on, say 192.168.1.145 puts <br />10.1.10.1 in their browser, the PC hands it to our Cisco router, it knows it's not on our LAN, so it hands it to its gateway: the DPC3939. </div>
<div class="v1PlainText"> </div>
<div class="v1PlainText">And then I THINK the DPC3939 then says, "I don't know where to send 192.168.1.145" and so it times out.<br /><br />I THINK the Comcast router needs a static route that says 192.168.1.X is behind our Cisco router: 50.248.230.106. <br /><br />Am I thinking right? I don't mind stuffing in the route myself, but I asked Comcast first, since it's their equipment. Tier 1 said, "no that's not possible". Tier 3 response was:</div>
<div class="v1PlainText">
<div> </div>
<div style="padding-left: 40px;"><strong><em>1- you need to know, in order for two local networks to communicate they have to be in the same lan scheme, either both 192.168.x.x or 10.1.x.x</em></strong></div>
<div style="padding-left: 40px;"> </div>
<div style="padding-left: 40px;"><strong><em>2- My suggestion is to change the local IP scheme for Comcast modem/router to match the other router </em></strong></div>
<div style="padding-left: 40px;"><strong><em><span style="font-family: 'Segoe UI WestEuropean', 'Segoe UI', Helvetica, Arial, sans-serif; font-size: 14.6667px; font-variant-ligatures: normal; font-variant-caps: normal;">192.168.1.X</span></em></strong></div>
<div style="padding-left: 40px;"><strong><em><span style="font-family: 'Segoe UI WestEuropean', 'Segoe UI', Helvetica, Arial, sans-serif; font-size: 14.6667px; font-variant-ligatures: normal; font-variant-caps: normal;"> </span></em></strong></div>
<div style="padding-left: 40px;"><strong><em><span style="font-family: 'Segoe UI WestEuropean', 'Segoe UI', Helvetica, Arial, sans-serif; font-size: 16px; font-variant-ligatures: normal; font-variant-caps: normal;">3- Make sure the IP scope of the modem is not conflicting with the other router.</span></em></strong></div>
<div style="padding-left: 40px;"><strong><em><span style="font-family: 'Segoe UI WestEuropean', 'Segoe UI', Helvetica, Arial, sans-serif; font-size: 16px; font-variant-ligatures: normal; font-variant-caps: normal;"> </span></em></strong></div>
<div style="padding-left: 40px;"><strong><em><span style="font-family: 'Segoe UI WestEuropean', 'Segoe UI', Helvetica, Arial, sans-serif; font-size: 16px; font-variant-ligatures: normal; font-variant-caps: normal;">For example if the other router IP scope is from </span><span style="font-family: 'Segoe UI WestEuropean', 'Segoe UI', Helvetica, Arial, sans-serif; font-size: 14.6667px; font-variant-ligatures: normal; font-variant-caps: normal;">192.168.1.1 to </span><span style="font-family: 'Segoe UI WestEuropean', 'Segoe UI', Helvetica, Arial, sans-serif; font-size: 14.6667px; font-variant-ligatures: normal; font-variant-caps: normal;">192.168.1.100 then make the modem DHCP </span><span style="font-family: 'Segoe UI WestEuropean', 'Segoe UI', Helvetica, Arial, sans-serif; font-variant-ligatures: normal; font-variant-caps: normal; font-size: 14.6667px;">192.168.1.101 to </span><span style="font-family: 'Segoe UI WestEuropean', 'Segoe UI', Helvetica, Arial, sans-serif; font-variant-ligatures: normal; font-variant-caps: normal; font-size: 14.6667px;">192.168.1.200. Same lan scheme different IP scope to avoid future issues.</span></em></strong></div>
</div>
<div class="v1PlainText"> </div>
<div class="v1PlainText">The Tier 3 response sounds insane to me; if I'm on 192.168.1.145, and I want to send data to 192.168.1.4, my IP stack will just put it out on the LAN wire. The Comcast router is never going to see that, 'cause it's connected to the WAN port on our router. The only way my gateway would get involved is when a workstation knows that the destination is NOT on the local network, and hence the packet needs to get passed to the gateway. The Tier 3 response also seems to open up all kinds of security issues if it in fact worked; then a compromise to anything on the Comcast side could easily bleed into our LAN. </div>
<div class="v1PlainText"> </div>
<div class="v1PlainText">What is kinda weird to me is that at home this "just works". I have an AT&T Uverse router which provides 192.168.1.X. I have a Sonicwall VPN router plugged into that, which provides a LAN of 192.168.100.X. The linux and PC devices are on the 100.X network. There are a few expendable devices and IOT on the 1.1 network. I can ssh and http from the 100.1 network to hosts on the 1.1 network; but of course they cannot go the other way. I didn't do anything for this to happen. Did the routers exchange BGP and just figure that out? </div>
<div class="v1PlainText"> </div>
<div class="v1PlainText"><br />Regards,<br /><br />Neal Rhodes<br /><br /><br /></div>
</div>
</div>
</div>
</body></html>