How to configure Windows 2003 as a Router ?

The following how to is for remote access, but it is the same idea.

How to setup vpn on 2003 as routerHow to setup VPN and NAT on Windows Server 2003 as a router. Pre-requirement:. 1. Two network interface cards. 2. One static public IP on the outside NIC. ...
http://www.howtonetworking.com/VPN/2003vpn1.htm


Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
"Peter" <[email protected]> wrote in message news:[email protected]...
I am new to networking and would like to seek your advice.

We would like to configure a Windows 2003 Server as a router between 2
subnets.

There are already 2 NICs and each of them is assigned IP address of
different subnets.

We would like to know is it necessary for us to install any service (like
RRAS) to achieve our need ? Besides, does it mean that the default gateway
for those workstations connected to that Windows 2003 Server will use its IP
address as default gateway ?

Thank you for your help.

Peter

I am new to networking and would like to seek your advice.

We would like to configure a Windows 2003 Server as a router between 2
subnets.

There are already 2 NICs and each of them is assigned IP address of
different subnets.

We would like to know is it necessary for us to install any service (like
RRAS) to achieve our need ? Besides, does it mean that the default gateway
for those workstations connected to that Windows 2003 Server will use its IP
address as default gateway ?

Thank you for your help.

Peter

You'll need to configure RRAS. Simply select it from the Admin Tools menu
and use the help to get it working.

Assuming a simple network with the only way out of the network being via the
WS03 box, then you will need to set the default gateway for the workstations
to be the network interface of the server. Keep in mind that devices on the
other side of the server that is acting as the router need to have a static
route for the workstation subnet that goes back through the WS03 RRAS server
in order for return traffic to come back to the workstation.

I hope this is clear.

Cheers,
Jeremy.

"Peter" <[email protected]> wrote in message
news:[email protected]...
>I am new to networking and would like to seek your advice.
>
> We would like to configure a Windows 2003 Server as a router between 2
> subnets.
>
> There are already 2 NICs and each of them is assigned IP address of
> different subnets.
>
> We would like to know is it necessary for us to install any service (like
> RRAS) to achieve our need ? Besides, does it mean that the default
> gateway for those workstations connected to that Windows 2003 Server will
> use its IP address as default gateway ?
>
> Thank you for your help.
>
> Peter
>
>

It is possible to allow IP routing without using RRAS, but it is pretty
pointless. Simply configure RRAS to be a LAN router from the wizard and it
will do it for you.

As Jeremy pointed out, all this does is configure the machine so that it
can forward traffic from one subnet to the other. Whether it routes or not
depends on how the two subnets are configured.

If all you want to do is link these two subnets, the routing is trivial.
You simply make the RRAS router the default gateway for both subnets. eg

192.168.1.x dg 192.168.1.1
|
192.168.1.1 dg blank
RRAS
192.168.2.1 dg blank
|
192.168.2.x dg 192.168.2.1

Any traffic which is not local (ie not in the same IP subnet) is sent to
the router. The router can deliver it in the other subnet because it has an
interface in that subnet (ie the target machine is local to the router).

Usually the setup is not as simple as that. One subnet is usually using
some other router, such as an ADSL Internet device as its default gateway.
Simply enabling IP routing doesn't do much because the trafffic never gets
to the RRAS router. You need extra routing to get the traffic to the correct
router. If you are in that situation and can't see what extra routing you
need, post a description of how your network is set up.

PS. I hope this server is not a DC. Using a DC as a router is not recomended
and it may cause you all sorts of odd problems.

Dear Robert,

Thank you for your advice.

When setting up the RRAS, I would like to know which option should I choose ?
1) VPN access and NAT
2) Secure connection between 2 private networks

Regards,
Peter
"Robert L [MVP - Networking]" <[email protected]> wrote in message news:[email protected]...
The following how to is for remote access, but it is the same idea.

How to setup vpn on 2003 as router How to setup VPN and NAT on Windows Server 2003 as a router. Pre-requirement:. 1. Two network interface cards. 2. One static public IP on the outside NIC. ...
http://www.howtonetworking.com/VPN/2003vpn1.htm


Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
"Peter" <[email protected]> wrote in message news:[email protected]...
I am new to networking and would like to seek your advice.

We would like to configure a Windows 2003 Server as a router between 2
subnets.

There are already 2 NICs and each of them is assigned IP address of
different subnets.

We would like to know is it necessary for us to install any service (like
RRAS) to achieve our need ? Besides, does it mean that the default gateway
for those workstations connected to that Windows 2003 Server will use its IP
address as default gateway ?

Thank you for your help.

Peter

Dear Bill,

Thank you for your advice.

The reason why we consider this option is because our Network Officer says
that by using a Windows 2003 Server as a router for connecting machines in
headquarter to a remote site.

I just wonder whether it is a good idea as the single point of failure will
be the Windows 2003 Server and the 2 NIC.

Regards,
Peter


"Bill Grant" <not.available@online> wrote in message
news:[email protected]...
> It is possible to allow IP routing without using RRAS, but it is pretty
> pointless. Simply configure RRAS to be a LAN router from the wizard and it
> will do it for you.
>
> As Jeremy pointed out, all this does is configure the machine so that
> it can forward traffic from one subnet to the other. Whether it routes or
> not depends on how the two subnets are configured.
>
> If all you want to do is link these two subnets, the routing is
> trivial. You simply make the RRAS router the default gateway for both
> subnets. eg
>
> 192.168.1.x dg 192.168.1.1
> |
> 192.168.1.1 dg blank
> RRAS
> 192.168.2.1 dg blank
> |
> 192.168.2.x dg 192.168.2.1
>
> Any traffic which is not local (ie not in the same IP subnet) is sent
> to the router. The router can deliver it in the other subnet because it
> has an interface in that subnet (ie the target machine is local to the
> router).
>
> Usually the setup is not as simple as that. One subnet is usually using
> some other router, such as an ADSL Internet device as its default gateway.
> Simply enabling IP routing doesn't do much because the trafffic never gets
> to the RRAS router. You need extra routing to get the traffic to the
> correct router. If you are in that situation and can't see what extra
> routing you need, post a description of how your network is set up.
>
> PS. I hope this server is not a DC. Using a DC as a router is not
> recomended and it may cause you all sorts of odd problems.
>

Whatever device you use as a router, it is going to be a single point of
failure unless you have a very complicated routing setup with multiple
paths.

How are you planning to connect HQ to a remote site? Leased lines or
VPN?

"Peter" <[email protected]> wrote in message
news:[email protected]...
> Dear Bill,
>
> Thank you for your advice.
>
> The reason why we consider this option is because our Network Officer says
> that by using a Windows 2003 Server as a router for connecting machines in
> headquarter to a remote site.
>
> I just wonder whether it is a good idea as the single point of failure
> will be the Windows 2003 Server and the 2 NIC.
>
> Regards,
> Peter
>
>
> "Bill Grant" <not.available@online> wrote in message
> news:[email protected]...
>> It is possible to allow IP routing without using RRAS, but it is pretty
>> pointless. Simply configure RRAS to be a LAN router from the wizard and
>> it will do it for you.
>>
>> As Jeremy pointed out, all this does is configure the machine so that
>> it can forward traffic from one subnet to the other. Whether it routes or
>> not depends on how the two subnets are configured.
>>
>> If all you want to do is link these two subnets, the routing is
>> trivial. You simply make the RRAS router the default gateway for both
>> subnets. eg
>>
>> 192.168.1.x dg 192.168.1.1
>> |
>> 192.168.1.1 dg blank
>> RRAS
>> 192.168.2.1 dg blank
>> |
>> 192.168.2.x dg 192.168.2.1
>>
>> Any traffic which is not local (ie not in the same IP subnet) is sent
>> to the router. The router can deliver it in the other subnet because it
>> has an interface in that subnet (ie the target machine is local to the
>> router).
>>
>> Usually the setup is not as simple as that. One subnet is usually
>> using some other router, such as an ADSL Internet device as its default
>> gateway. Simply enabling IP routing doesn't do much because the trafffic
>> never gets to the RRAS router. You need extra routing to get the traffic
>> to the correct router. If you are in that situation and can't see what
>> extra routing you need, post a description of how your network is set up.
>>
>> PS. I hope this server is not a DC. Using a DC as a router is not
>> recomended and it may cause you all sorts of odd problems.
>>
>
>

It is planned to use leased line.

Peter

"Bill Grant" <not.available@online> wrote in message
news:%23PWjvK%[email protected]...
> Whatever device you use as a router, it is going to be a single point of
> failure unless you have a very complicated routing setup with multiple
> paths.
>
> How are you planning to connect HQ to a remote site? Leased lines or
> VPN?
>
> "Peter" <[email protected]> wrote in message
> news:[email protected]...
>> Dear Bill,
>>
>> Thank you for your advice.
>>
>> The reason why we consider this option is because our Network Officer
>> says that by using a Windows 2003 Server as a router for connecting
>> machines in headquarter to a remote site.
>>
>> I just wonder whether it is a good idea as the single point of failure
>> will be the Windows 2003 Server and the 2 NIC.
>>
>> Regards,
>> Peter
>>
>>
>> "Bill Grant" <not.available@online> wrote in message
>> news:[email protected]...
>>> It is possible to allow IP routing without using RRAS, but it is
>>> pretty pointless. Simply configure RRAS to be a LAN router from the
>>> wizard and it will do it for you.
>>>
>>> As Jeremy pointed out, all this does is configure the machine so that
>>> it can forward traffic from one subnet to the other. Whether it routes
>>> or not depends on how the two subnets are configured.
>>>
>>> If all you want to do is link these two subnets, the routing is
>>> trivial. You simply make the RRAS router the default gateway for both
>>> subnets. eg
>>>
>>> 192.168.1.x dg 192.168.1.1
>>> |
>>> 192.168.1.1 dg blank
>>> RRAS
>>> 192.168.2.1 dg blank
>>> |
>>> 192.168.2.x dg 192.168.2.1
>>>
>>> Any traffic which is not local (ie not in the same IP subnet) is sent
>>> to the router. The router can deliver it in the other subnet because it
>>> has an interface in that subnet (ie the target machine is local to the
>>> router).
>>>
>>> Usually the setup is not as simple as that. One subnet is usually
>>> using some other router, such as an ADSL Internet device as its default
>>> gateway. Simply enabling IP routing doesn't do much because the trafffic
>>> never gets to the RRAS router. You need extra routing to get the traffic
>>> to the correct router. If you are in that situation and can't see what
>>> extra routing you need, post a description of how your network is set
>>> up.
>>>
>>> PS. I hope this server is not a DC. Using a DC as a router is not
>>> recomended and it may cause you all sorts of odd problems.
>>>
>>
>>
>
>

OK. As I said in a previous post, the important thing about routing is
getting the traffic to the correct router. If this RRAS router is an
additional router in a subnet which currently uses some other device as the
default gateway (ie default router) the traffic for the other site may never
get to the RRAS router unless you add extra routing to the LAN. It only
works automatically if there is only one gateway and it is set as the
default.

Dear Bill,

There is default gateway in headquarter and remote site. However, the
network guy says that in order to get both sites get connected with the new
lease line, he has to remove the default gateway at remote site and make use
of the Windows 2003 Server as router here.

In this way, I believe that machines in remote site will regard the Windows
2003 Server as default gateway while machines here will continue to use the
existing default gateway (CISCO Router).

Is there any adjustment has to be done ?

Regards,
Peter

"Peter" <[email protected]> wrote in message
news:[email protected]...
> There is default gateway in headquarter and remote site. However, the network
> guy says that in order to get both sites get connected with the new lease
> line, he has to remove the default gateway at remote site and make use > of
> the Windows 2003 Server as router here.

It doesn't matter what router is used for the Default Gateway as long as the
router that is used "knows" how to get to everything else. So the network guys
are "partially" correct, but they may have too narrow of a view of it.

The Default Gateway of the hosts on any particular subnet should be the router
that has the most "knowledge" about the rest of the LAN/WAN. That "knowledge"
may or may not be accomplished by Dynamic Routing Protocols between the routers.

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft, or
anyone else associated with me, including my cats.
-----------------------------------------------------

Hi

Could someone please advise me if the following solution is a viable option, to minimise our network traffic and speed up perfomance with regards to our CGI render farm data flow.

The sistuation is a follows.

We have a CGI render farm of 60 Dell quad core blade servers all hosted on the same IP subnet and physical network as our 3d Animators and production office.

The current physical LAN is running at 100mb. I am looking to optimise our data through put on our render farm, by creating a seperate physical network / subnet and upgrading the render farm to a gig network.
I want to keep the network seperate to reduce network traffic and optimse data flow.

Is it safe to asssume, that if I install a Win2k3 Server with 2 NIC's one attached to each network and configured as a router, will the users still be able to submit data to the gig renderfarm network and will this reduce and optimse my traffic?

Sure, You can setup the server as router. This how to may help.

How to setup VPNIf your VPN client cannot find servers or cannot ping
computernmae, you may need to add DNS and WINS into your VPN server. For
example, to add DNS and WINS ...
www.howtonetworking.com/Windows/vpnsetup.htm


--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com
"GarethHughes" <[email protected]> wrote in message
news:[email protected]...
>
> Hi
>
> Could someone please advise me if the following solution is a viable
> option, to minimise our network traffic and speed up perfomance with
> regards to our CGI render farm data flow.
>
> The sistuation is a follows.
>
> We have a CGI render farm of 60 Dell quad core blade servers all hosted
> on the same IP subnet and physical network as our 3d Animators and
> production office.
>
> The current physical LAN is running at 100mb. I am looking to optimise
> our data through put on our render farm, by creating a seperate physical
> network / subnet and upgrading the render farm to a gig network.
> I want to keep the network seperate to reduce network traffic and
> optimse data flow.
>
> Is it safe to asssume, that if I install a Win2k3 Server with 2 NIC's
> one attached to each network and configured as a router, will the users
> still be able to submit data to the gig renderfarm network and will this
> reduce and optimse my traffic?
>
>
> --
> GarethHughes
> ------------------------------------------------------------------------
> GarethHughes's Profile:
> http://forums.techarena.in/members/garethhughes.htm
> View this thread: http://forums.techarena.in/server-networking/738480.htm
>
> http://forums.techarena.in
>

"GarethHughes" <[email protected]> wrote in message
news:[email protected]...
>
> Hi
>
> Could someone please advise me if the following solution is a viable
> option, to minimise our network traffic and speed up perfomance with
> regards to our CGI render farm data flow.
>
> The sistuation is a follows.
>
> We have a CGI render farm of 60 Dell quad core blade servers all hosted
> on the same IP subnet and physical network as our 3d Animators and
> production office.
>
> The current physical LAN is running at 100mb. I am looking to optimise
> our data through put on our render farm, by creating a seperate physical
> network / subnet and upgrading the render farm to a gig network.
> I want to keep the network seperate to reduce network traffic and
> optimse data flow.
>
> Is it safe to asssume, that if I install a Win2k3 Server with 2 NIC's
> one attached to each network and configured as a router, will the users
> still be able to submit data to the gig renderfarm network and will this
> reduce and optimse my traffic?
>
>
> --
> GarethHughes
> ------------------------------------------------------------------------
> GarethHughes's Profile:
> http://forums.techarena.in/members/garethhughes.htm
> View this thread: http://forums.techarena.in/server-networking/738480.htm
>
> http://forums.techarena.in
>

You can certainly use Windows Server as a LAN router between two LAN
segments, and these two segments can be of different types. The server
network will run at IGb and the other at 100Mb.

Just installing RRAS and enabling LAN routing will probably not get
routing working. It only works automatically if the router is the default
gateway for both networks. If one network is connected to the Internet and
all machines use the Internet router as the default gateway, no traffic will
ever go to the internal router.

There are a couple of options. If the LAN machines need to initiate
connections to the servers (but not vice versa) you can use NAT. If you need
full interaction (ie the servers can initiate connections to the other
machines) you use standard LAN routing plus static routes. eg

NAT setup

Internet
|
gateway router
10.1.1.254
|
servers
10.1.1.x dg 10.1.1.254
|
10.1.1.250 dg 10.1.1.254
RRAS/NAT
192.168.31.254 dg blank
|
LAN machines
192.168.31.x dg 192.168.31.x


Fully routed setup

Internet
|
gateway router {static route 192.168.31.0 255.255.255.0 10.1.1.250}
10.1.1.254
|
servers
10.1.1.x dg 10.1.1.254
|
10.1.1.250 dg 10.1.1.254
RRAS
192.168.31.254 dg blank
|
LAN machines
192.168.31.x dg 192.168.31.254

The NAT method works because all traffic from the inner subnet is using
the NAT router's 10.1.1 address in the outer subnet (because of address
translation in NAT).

In the second case the traffic from the inner subnet is using the
192.168. IP address, so the gateway router must know how to reach the inner
subnet (via the NAT router).

Hi,
i dont see the clear advantage if all traffic passes the wire to / and from
the router to the switch.

first you should know how the serverfarm itself operates ? especially do
they communicate with each other ?

jk

Hi am new here and just saw the post above and hoped someone might be able to help even after all of these years since the previous post!

Sorry for brining this one back up from the past hope that is ok!

I have the setup as described by Bill Grant:

Internet
|
gateway router
10.1.1.254
|
servers
10.1.1.x dg 10.1.1.254
|
10.1.1.250 dg 10.1.1.254
RRAS/NAT
192.168.31.254 dg blank
|
LAN machines
192.168.31.x dg 192.168.31.x


But I can only get one thing to work at a time, by that I mean.

LAN machines (192.168.x.x) have internet access and can access 10.x.x.x machines BUT... 10.x.x.x machines cannot access 192.168.x.x machines

or

10.x.x.x machines can access 192.168.x.x machines BUT 192.168.x.x machines don't have internet access.

I have altered settings and either end up with nothing or the above, would someone be able to point me in the direction so I can get both (machines on either side of the router can access internet and all machines?

Many many thanks...

Richard

P.s. I have even added a 3rd NIC to set that for NAT and to be honest it worked for a bit then when I rebooted a sever on the 192.168.x.x LAN it stopped!

Hi Tappers,

Can you try to go to wireless connection properties and check the TCP/IP properties cause it sounds like could be a DNS issue. Are IP and DNS servers both chosen to select automatically? If not, try that.

Hi Zachary,

Thanks for the reply.

I do not think it is wireless as it is in a virutal environment to setup a test network for development testing etc.

The addresses on the 192.168.x.x network are static as I have only setup one server for this environment so far and wanted to utilise an existing Server 2003 server for the routing if possible.

I will check on the DNS side of things though.

I am giving this reply here, because it matches to the query. I had used this steps to configure my server as router. For that you will need to first start RRAS. You can found that under Administrative Tools. Right click on the server to the left side and choose configure. Then click on Enable Routing And Remote Access. Follow the screen wizard.You can choose Custom Configuration to add your settings. Choose Lan Routing and then finish the process.

Tablita,

Thanks for the reply.

I have done exactly that and I still can't get it to work!

I am really unsure what I am going wrong, especially as I have just setup a Vyatta router for another environment and it works perfectly.

but I really would prefer to be able to use the Win Server box for this one.

My brain is now in stubborn mode and I just want to find out what I am missing a I have tried it before and never got it fully working.

Thanks again.

Just tried this setup again with Windows box to find massive inconsistencies.

I have disabled RRAS each time thinking that that would wipe the config but I am not convinced this is the case!

Now I am completely unable to get it back to having any sort of connectivity between the networks with the Windows as a router. Yet Vyatta works pretty much instantly every time!

I really want to understand this and getting working but I cannot see where I am going wrong.

Everything I have found on the web just says enable RRAS, select custom, choose LAN Routing option.

I feel at this point there must be a different version of Windows that that works on as it doesn't on Server 2003 Standard but am sure that is just frustration as I am desperate to get this working.

Am going to try and erase Server 2003 and re-install to see if that helps!

I also fear that I have made so many changes to the current setup I don't know which way is up.

Any help would be greatly appreciated.

Many thanks

Have you tried searching this forums for some similar kind of topics made, check suggestions given in this following threads - http://forums.techarena.in/windows-s...lp/1173953.htm
http://forums.techarena.in/windows-s...elp/693865.htm
http://forums.techarena.in/windows-s...elp/680394.htm

Thanks Janos

I have seen some of those posts and there are similarities in my setup especially where Bill Grant replies with

Internet
|
gateway
192.168.1.1 {static route 192.168.5.0 255.255.255.0 192.168.1.122}
|
LAN clients
192.168.1.x dg 192.168.1.1
|
192.168.1.122 dg 192.168.1.1
RRAS
192.168.5.12 dg blank
|
clients
192.168.5.x dg 192.168.5.12


The intersting item I note here is the the addition of a static route on the internet router/gateway. The problem here is I am with (what I believe to be!) the counrtys crappest ISP in existance for many reasons but also because they don't let you change your broadband router for (again what I believe to be) no reason other than to be as difficult as possible! Meaning I cannot add the static route to my router at the internet / gateway end.

Part of me would wonder if that was what was causing the problem but....

Why does the Vyatta setup work?

To me there is something that I am not doing that is not contained within the forums or Windows RRAS has bugs and doesn't work fully and that would therefore explain the inconsistent results even when definately doing the same tasks resulting in a system that sometimes works and sometimes doesn't.

Thanks again for all of the assistance but I fear I am getting to the stage that I just believe RRAS doesn't fully work in every situation even when the routes are correct and everything it setup correctly it doesn't work which is sad.

Setup new server 2003 with RRAS and 2 nics and now I have it working for both sides I can access each servers.

Only thing now would be how to enable internet access for 192.168.x.x lan?

any ideas?

Can you go to “My Network Places” properties, and then select your connection.After that right click and select Advanced tab, and check “Allow other network users to connect through this computer" internet connection” and uncheck below two options. Now press “OK” button. This will give you a message stating that IP address of present working PC will be set to “192.168.0.1”, click OK.

Thanks Super Cop,

My only issue with your suggestion is that I want to have a dc to provide DHCP in the 192.168.x.x lan.

Also, I couldn't find the options to uncheck below, I thought that was more for XP Professional and Windows 7 rather than Server 2003 or have I got it wrong?

Many thanks

Bill Grant, if you are still around...

THANK YOU SO MUCH!!!

I've been over so many books and materials and they never explain the exact details on how to set that up. You've solved years of pain thanks!