bridging subnets over the internet

[Cerebus451]

Okay, this might be a little long winded, so kick back with a cold one. If you make it all the way through, PM me your address and I will mail you a cookie. This question has probably been asked, but it is a difficult one to find through searching, so if it has been beaten to death already, feel free to break out the trout.

I have my network at home behind my router, subnet 192.168.0.x. I have two friends with home networks behind routers, subnets 192.168.1.x and 192.168.2.x (all 3 routers are Linksys). The idea is to connect the subnets over the internet for nothing more than pure gaming fun. In the past this involved one person DMZ'ing, then everyone could connect to the exposed game server. The advent of Age of Mythology and this no longer works (part of the push to get people to use the gaming services?). Here are my two thoughts:

1) VPN. I get a VPN router, the other two tunnel into my network. 1 extraordinarily painful week with a Netgear FVS318 and we had this working. I could see each of them, they each could see me. Problem, they could not see each other, thus gaming would be out. The reason for this is readily apparent because their subnets on my end were the same as their home subnets. If I ping'd 192.168.1.x my router knew to send it through the VPN tunnel. Likewise if they ping' 192.168.0.x their VPN client knew to send it through the tunnel. However, the person in the 192.168.1.x subnet had no way to talk to the person in the 192.168.2.x subnet. I thought about giving them the same subnet on my end, but I don't think VPN would take to that very well. I seriously doubt the Netgear would be able to handle sending the same request down multiple tunnels, however I don't know everything there is to know about VPN. If someone out there knows more about VPN and getting multiple clients tunneling into the same VPN to talk to each other, your insight would be greatly appreciated. A solution (though expensive) is for all of us to have VPN routers, then each person builds a tunnel to the other 2, but this isn't very practical.

2) Static Routes. The Linksys routers provide the capabilities for static routing, so it seemed logical that we should be able to set this up between our subnets. As an example, I could put a static route into my router that says send anything for the 192.168.1.x subnet to the other person's router, using his WAN IP address as the gateway IP address. As logical as this would seem, it did not work in practice. Doing a traceroute to the other subnet showed the packets making it about 2 hops into my ISP before they would vanish. There is no way to tell, however, if the router was properly performing the static routing, and that this static routing model simply won't work over the internet, or if the router was not forwarding the packets properly, and my ISP was properly eating private IP addressed packets.

So, there you have it. It seems like a solvable problem, and it seems like VPN is a logical route to take, I just do not know enough about setting up VPNs to figure out how to get multiple clients talking to each other (instead of just to the VPN router), and since this is not something that VPNs are typically used for, none of the VPN specs you can find on the internet talk about it.

Thoughts? Comments? Someone have a working solution already in place?

 

[mboy]

How about using 3 different subnets with your VPN solution? Altho VPN would slow u down. WHy not one just host the game server, forward the appropriate ports in his router and be done with it

 

[Cerebus451]

Originally posted by: mboy
How about using 3 different subnets with your VPN solution? Altho VPN would slow u down. WHy not one just host the game server, forward the appropriate ports in his router and be done with it

I was using different subnets with the VPN and the problem was the subnets could not see each other. I could see each of the other subnets and they could see me, but they could not see each other. This will work with some games that use dedicated servers (such as Quake, CS, and the like), but most RTS games use peer-to-peer networking and all the clients need to talk to each other.

As for the port forwarding, that is an alternative to DMZ, but it requires finding the ports for the games, and it doesn't always work (for instance we cannot do direct IP with Age of Mythology right now, we have to use the ESO service). Also, this does not work when there is more than 1 gamer in one of the given subnets, which does happen on occasion. Just trying to find a decent solution that will work in all cases.

 

[Darksamie]

I think you will have problems with this (cost wise) any way you look at it......

If you are using VPN, then you will need to set up VPN tunnels to every connection if you want everyone to be able to see eachother. This is unless you are using something like a Watchguard firebox where you can use the VPN manager to get around stuff like this and make it really easy, but that would be the expensive option.

 

[ScottMac]

When you had the VPN thing working (sorta) did you all have "Dynamic Routing" enabled? This is basically RIP.

It still may not work, because of a wrinkle in the protocols called "Split-horizon" which says the router can't advertise a route it learned over interface "A" back out of interface "A." (to reduce the posibillity of a router loop).

The static routes should have worked, the two routers that are remote to you (or the central/common connection) have to have a route pointing to the other remote router , with the central router set as the next hop. You, as the central router, should not need any static routes because both subnets are "local" to your router.

You must send all the traffic through a VPN to do this. The addresses using 192.168.X.X are (by convention/RFC) only for private use, and will be filtered by the ISP. When you use the VPN, those private addresses are encapsulated and not visible to the transit routing system (the Internet routers).

So, to summarize: Set up the VPN, each segment on it's own subnet, and put a static route on the REMOTE routers for the OTHER REMOTE, using the common router's address as the next hop.

OR

Set up the VPN, all routers using the same private subnet address (192.168.1.X). The only gotcha here is that all of the hosts must be on different host addresses (if you all have your computers set for 192.168.1.1, there'll be a conflict). SO maybe site A can use the host range 1-80, site B use 81-160, and site C uses 161-240 .... something like that.


Good Luck

Scott

 

[Cerebus451]

Okay, so it sounds like having the remote VPN users on the same subnets locally could work. Unfortunately I had to give up on the Netgear router because I did not want to sit around and see if Netgear was going to fix the FVS318 while my return window at Best Buy disappeared. I have a Zywall 10II on order. Once that arrives and we can get the VPN stuff back up and running I will try either a static route between VPN subnets or putting the remote users into the same subnet and see what works and post back.

 

[Need4Speed]

.

 

[Need4Speed]

.