Intrude/infiltrate between provider and router (IP pass through)

V

varda

Hello Gentlemen.

I have a company where provider's router simultaneously makes the LAN and VoIP. It works disgusting and telephony often occupies the entire bandwidth. Maybe provider abuses. Their representative did not visit this client for years. But provider does not give me access to his router. I want to separate LAN and shape telephony. Usage of phones does not bother me.

IP addresses are statically assigned by a simple scheme:
(Provider gateway : 1.1.1.1) <---> (Provider router: 1.1.1.2) <---> (VoIP & LAN)
Certainly I can not change IP addresses.

But I can connect and isolate with two intermediate routers.

Provider gateway: 1.1.1.1
|
My 1st router:
1st interface: 1.1.1.2 nat redirect_addr 192.168.0.2 1.1.1.2
2nd interface: 192.168.0.1
|
My 2nd router:
1st interface: 192.168.0.2 nat redirect_addr 1.1.1.2 192.168.0.2
2nd interface: 1.1.1.1
|
Provider router: 1.1.1.2
|
VoIP network

Can anybody suggest how to simplify things with a single intermediate router in the middle?

Thank You.
 
I'm not entirely sure this is going to work but you could place a FreeBSD router in between the ISP router and the uplink. If you bridge both network cards it'll be transparent. Adding IPFW should allow you to shape the traffic. But keep in mind the shaping only happens on outgoing connections.
 
Hello SirDice.

I think bridge will be just like switch or even network hub. How can I separate or filter originating traffic between between provider's devices? What interface and IP I should to use in order to pass/NAT LAN traffic outside and inside?
 
It's a bridge so it doesn't have an IP address, this will make managing it a little difficult, but you could add a third interface specifically for management. As it is a bridge there would be no need for NAT either. Connection between the two networks is on layer 2. But you can still use IPFW to filter on layer 3. That means you can still shape the traffic.

https://www.freebsd.org/doc/en_US.ISO8859-1/articles/filtering-bridges/article.html
 
Sorry, still do not understand how to pass out and accept in traffic for LAN (which I want to separate from VoIP) without having IP address. Please point me how to do that.
 
You must log in or register to reply here.
Back
Top