Mounting share form a different sub-net

M

mefizto

Greetings all,

I am trying to separate my network (Network_1) form a network that I have been sharing with my landlord (Network_2), see the attached drawing. At this stage, the router/firewall/managed switch is working. I would like to share (at least temporarily) the media server that is on the Network_2.

When I try to mount the share on the media server, I see the first (SYN) packet of the 3-way TCP handshake reach the media server, but the response (SYN-ACK) packet does not arrive. My hypothesis is, that the media server does not know where to respond, so it sends the SYN-ACK packet to the default (192.168.0.1) gateway, instead to the (192.168.0.6) gateway from which the SYN packet arrived.

Is this correct? Is there any way I can change the configuration to complete the 3-way TCP handshake, thus mount the media server?

Kindest regards,

M
 

Attachments

  • Network.png
    Network.png
    83.4 KB · Views: 19
your hypothesis seems correct. since the media server is on your landlord's side of the network, meaning you can't set up routes on it directly, we would probably tackle this by setting up your router to NAT traffic from your network's subnets to 192.168.0.0/24 to its own address. then the media server will see 192.168.0.6 as the source, send replies there, and your router will untranslate it.
 
Hi atax1a,

first, thank you for the reply.

I tried that, but the result is the same. Now, I do not know, whether I do have the correct command:

pass out inet on igc3 form igc1:network to any net-to igc3

Kindest regards,

M
 
for debugging pf, we'd enable log on the rules in question, check the rule statistics with pfctl -vvsr, plus also do some tcpdumps on both sides of the interface. hope this helps.
 
Hi atax1a,

yes, I have both:

Makefile: 
match log all
block log all

I am not sure, how to look at both sides of the interface, I am essentially looking at:

tcpdump -eni pflog0

I will have to research how to do it.

Kindest regards,

M
 
use two tcpdumps, one on each network interface involved. then you can compare what the packets look like on each "side", before the NAT and after it.
 
You must log in or register to reply here.
Back
Top