Как настроить маршрутизацию между двумя сетями windows server

Настройка маршрутизатора на базе Windows Server 2012 R2

20.11.2014
itpro
Windows Server 2012 R2
комментариев 19

В этой статье посмотрим, как с помощью встроенных средств на базе сервера с Windows Server 2012 R2 организовать простой межсетевой маршрутизатор. И хотя на практике маршрутизаторы на базе компьютеров используются довольно редко (аппаратные маршрутизаторы, как правило, имеют более высокую производительность, надежность и несколько дешевле выделенного компьютера), в тестовых или виртуальных средах, когда нужно срочно настроить маршрутизацию между несколькими подсетями, маршрутизатор на базе Windows Server вполне себе приемлемое решение.

Итак, в роли маршрутизатора будет выступать сервер с ОС Windows Server 2012 R2. Сервер имеет 2 сетевых интерфейса: физических или виртуальных, если сервер запущен на гипервизоре. Каждому интерфейсу сервера назначен выделенный IP адрес из различных подсетей. Для удобства, мы переименовали названия сетевых интерфейсов в Панели управления сетями и общим доступом:

Сетевая карта 1 (сетевая карта подключена во внутреннюю LAN сеть):

Имя: LAN

IP: 10.0.1.1

Сетевая карта 2 (сетевая карта во внешней сети ):

Имя: Internet

IP: 192.168.1.20

Наша задача – организовать маршрутизацию пакетов из локальной подсети 10.0.1.0 во внешнюю подсеть 192.168.1.0 (как правило, такая сеть имеет выход в интернет) через NAT. Такую схему можно реализовать в случае необходимости организации доступа клиентов из внутренней сети в интернет.

Маршрутизация в Windows Server 2012 R2 реализуется на базе роли Remote Access (RRAS). Данная служба появилась еще в Windows Server 2003 и до текущей в версии Windows Server ее интерфейс и процесс настройки практически не изменился.

В первую очередь нужно установить роль Remote Access. Для этого откроем консоль Server Manager, выбираем Manage -> Add Roles and Features, находим и отмечаем роль Remote Access, в ее составе выбираем службу Routing, и, соглашаясь со всеми предложенными по умолчанию компонентами, запускаем ее установку (Install).

После окончания установки открываем консоль Routing and Remote Access (rrasmgmt.msc), щелкаем по имени сервера (с красной стрелкой) и выбираем Configure and Enable Routing and Remote Access.

В открывшемся окне выбираем пункт Network Address Translation (NAT).

На следующей шаге (NAT Internet Connection) нужно выбрать сетевой интерфейс, подключённый ко внешней сети / Интернету (в нашем примере это интерфейс Internet с ip 192.168.1.20). Этот интерфейс будет «публичным интерфейсом» нашего NAT роутера.

Далее будет предложено указать должен ли NAT роутер обеспечить клиентов внутренней сети сервисами DHCP и DNS. Как правило, этот функционал во внутренней сети уже имеется, поэтому в нем мы не нуждаемся.

На этом базовая настройка маршрутизации на Windows Server 2012 R2 завершена. Сервер уже должен выполнять маршрутизацию пакетов между двумя подключенными сетями и выполнять трансляцию сетевых адресов (NAT).

Чтобы в этом убедиться, в консоли RRAS откройте свойства сервера. На вкладке General показано, что IPv4 маршрутизация включена (т.е. пакеты IPv4 будут пересылаться с одной сетевой карты на другую).

Проверить работу маршрутизации можно, указав на клиентском компьютере во внутренней сети (к которой подключен интерфейс сервера LAN) в качестве шлюза IP-адрес сервера (10.0.1.1), и выполнить ping или трассировку маршрута к ресурсу, расположенному во внешней сети или интернете. Эти попытки должны быть успешными.

В нашем случае на сервере осуществялется статическая маршрутизация. Если нужно добавить новый маршрут, щелкните ПКМ по Static Routes, выберите пункт меню New static route и создайте новое статическое правило маршрутизации.

Introduction:

In CCNA, we have learned about IP Routing and routing protocols. Routing is the process of transferring data from one network to another by selecting the best path from all available paths.

We can use a device called router to route traffic between two subnets or networks. For small networks, we can use a Windows server 2019, to perform the IP forwarding and LAN routing.

In this post, we will learn the steps to configure LAN Routing in Windows Server 2019.

Understand the Test Lab for LAN Routing:

Note: For this guide, we will use the test lab created in VirtualBox.

• WS2K19-DC01: Domain Controller with DNS. (172.18.72.5/24)
• WS2K19-SRV02: Server 2019 with 2 NICs (NIC-1 with IP 172.18.72.1/24 and NIC-2 with 192.168.72.1/24)
• WS10-1903: Windows 10 client machine. (192.168.72.5/24)

Look at the below image for complete IP configuration details for all VMs.

Before we start configuration, check ping from Windows 10 machine to Domain Controller. (Ping 172.18.72.5)

Install LAN Routing service on Windows Server 2019:

The LAN routing role service is part of the Remote Access server role. Let’s install the Remote Access server role on the WS2K19-SRV02 server. Open Server Manager Console.

1. Click on Manage and select Add Role and Features.

2. On the Before you begin page, click Next.

3. Select Role-based or feature-based installation and click Next.

4. Select a server from the server pool on which you want to install the Remote Access Service role, click Next.

5. On select server roles page, select the Remote Access Service checkbox. Click Next.

6. On select features, click Next.

7. Read overview information about Remote Access Services and click Next.

8. On Select Role Service console, select the Routing checkbox to install the LAN Routing role service.

9. Click the Add Features button to add the required feature for LAN Routing. Click Next to continue.

10. Click Next.

11. Click Install and complete the installation process.

12. Click Close to finish the installation.

Configure and Enable LAN Routing on Windows Server 2019:

To enable and configure LAN routing, open the Remote and Routing Access console using the Server Manager console.

13. Click on Tools and select Remote and Routing Access.

14. Select and right-click on the local server name and then select Configure and Enable Routing and Remote Access.

15. On the welcome page, read the description, and click Next.

16. On the Configuration page, select custom configuration. Click Next.

17. On the Custom Configuration page, select the LAN Routing feature and click Next.

18. Click Finish.

19. When the service message box displays, click Start Service to start the Routing and Remote Access service.

Verify the LAN Routing Configuration:

We have enabled and configured LAN routing on our software router (Windows Server 2019). Now, it’s time to test our LAN Routing configuration.

Before you proceed, make sure the Windows firewall on the router (WS2K19-SRV02) allows the ICMP packet for the ping to pass successfully. Even we can temporarily close the Windows Firewall for testing purposes.

Read this post on how to Create ICMP exception rule in Windows Firewall to allow ping.

Next, move on to Windows 10 machine. Open Command prompt.

First, run the below command: ping 172.18.72.5

This time you must be able to receive ICMP reply from Domain Controller as we have LAN routing place.

Second, run the below command: tracert 172.18.72.5

As we see the result, the packet will be first delivered to Router and then to Domain Controller.

In this post, we have learned a step by step guide to enable and configure LAN Routing in Windows Server 2019.

Introduction

In this article I’m setting up a 3 way router with Windows Server 2016, which will be performing LAN routing between two subnets and NAT for both subnets. This setup will replace the gateway I had in my Hyper-V virtual lab. So, basically, I needed to add a new subnet to my virtual lab (10.0.0.32/27) and I needed both subnets to communicate and both to have internet access. I could have done this by adding a router between both subnets, but for that I would need to add a new virtual machine, which would be consuming additional resources from my Hyper-V server. This way, I’ll have a solution that will grow with the virtual lab. In case I need to add a new subnet to the lab, I just have to add a new interface to the router and all subnets will be automatically routed between each other. Perfect!

My virtual lab

Let’s start

First things first

You will need a machine with Windows Server 2016 installed, for which you can find a guide here, with three network cards attached to it, as per the diagram above.

Adding the Remote Access role

• Open “Server Manager”. Click on the start button and find “Server Manager”.
• Click on “Add roles and features”.

• Click “Next” until you reach the “Select server roles” window. Check the “Remote Access” box and click “Next”.

• Click “Next” until you reach the “Select role services” window.
• Select “Routing”

• Click on “Add Features”

• Note that “DirectAccess and VPN (RAS)” are selected by default. No need to make any changes. Press “Next”.

• Click on “Install” on the “Confirmation” window and wait for the role to be installed.

Configuring the Remote Access Role

• Press the “Start” button and find the “Routing and Remote Access” console. Open it.

• Right-click on the (local) server and select “Configure and Enable Routing and Remote Access”

• Press “Next” at the welcome window of the “Routing and Remote Access Server Setup Wizard”.
• On the “Configuration” window, select “Network address translation (NAT)” and press “Next”.

• Select the public interface that you are using to connect to the internet. Press “Next”.
• Select the interface that will have access to internet. Select the first interface and press “Next”. We’ll deal with the second interface later.

• Click on “Finish” to close the setup wizard. If a pop-up window comes up warning about firewall ports for VPN connections, you can safely ignore this warning as we are not setting up any VPN access. Just press “OK” and wait for the “Routing and Remote” access service to start.

Adding the second NAT interface

So, during the Routing and Remote Access setup wizard, we’ve configured NAT for one of the subnets, but if we want (and we do!) to provide internet access to another subnet, we must configure NAT for the second (n) interface.

• On the “Routing and Remote Access” console, under IPv4, right-click “NAT” and select “New Interface…”

• Select the interface for the second subnet and press “OK”.

• Select “Private interface connected to private network” and click “OK”

And this ends setting up the server. Now it’s time to test if all is working as it should!

Checking the configuration

In the “Routing and Remote Access” console, under IPv4, right-click “Static Routes” and choose “Show IP Routing Table…”. A new window, with the known routes to this computer, will pop-up. Analyzing that window (please always remember that this IP Routing table is regarding my setup, which is the one described in the diagram on the top of the page), you will see that we have:

1 – A gateway! All traffic that the router doesn’t know where to direct it, will direct it to the gateway.

2- Traffic for the network (subnet) 10.0.0.0 with a netmask of 255.255.255.224 (/27) will be directed to the interface S01, which is the interface connected to that subnet.

3- Traffic for the network 10.0.0.32 with a netmask of 255.255.255.224 will be directed to the interface S02, which is the interface connected to that subnet.

Testing the LAN Routing and NAT

NOTE: for all to work properly, ideally you should have a DHCP assigning IP addresses on each subnet and also a DNS server for your client computers to be able to resolve names and browse the internet.

Having said that, from one of the computer clients connected to S01, you should be able to ping S02. This is the IP config I have at one of my servers in S01. You’ll see that the gateway for this subnet is the IP of the router (10.0.0.30).

If you ping an IP address in the S02 subnet, this should be the result:

And if you try and browse the internet, voilá!

And the sames goes from a computer on subnet S02:

If you run into any issues, ie, not pinging from one subnet to the other, disable the router firewall and try again. That should do it. Or, instead of disabling the firewall completely, add – or enable – rules to allow traffic between both subnets. In my case, I disabled the firewall completely because this is a lab environment, with no direct connection to the internet.

As always, if you found this article useful, share it with your friends.

If you have any questions or suggestions, please leave your comment.

And… Thank you for reading!

You May Also Like

HOWTO: DIY Raspberry Pi HiFi network streamer – DigiHat + Volumio

Delegate Control in Active Directory – Managing Computer Objects

Install and configure rsync – daemon

6 thoughts on “ LAN Routing and NAT with Windows Server 2016 ”

I have setup the same in windows server 2016. all the settings are fine.
I have two different forests
abc.local and xyz.local
abc has 192.168.0.0 IP range
Xyz has 10.10.10.0 range..

the scenario is when i ping from any abc forest machine to xyz machine it pings fine and so is the case from xyz to abc all good.
the router machine has three network cards one external which is internet facing and other two are both for abc and xyz forest respectively.

router machine is able to open and ping internet websites
but none of the machines in abc or xyz forests are able to ping internet websites. on the contrary when i ping google.com from abc or xyz forest windows 7 machines it does not ping but if i ping IP address of google it is pinging absolutely fine. this has baffled me completely. i dont know why is this happening also web browser is not able to open internet website neither by IP address nor by website name. but internet is fine in router machine and its flawless. Please help

Hi Sorabh,
thank you for reading and leaving your comment.
What are your network configurations both on the servers and the client machines?
Best regards,
Pedro

Hey, in order for it to work, you need to add forwarders in your DNS server – set it to forward google DNS servers for example 8.8.8.8 and 8.8.4.4.

Your problem occurs because you redirect the traffic of your LAN clients to your gateway. The client needs to know which IP stands behind the URL and if you didn’t add forwarders in the DNS server then it will be unable to find the IP with whom it wants to contact.

Add a DNS role for your server, then: DNS Manager -> Right click on the servername.domain -> Properties -> Forwarders -> Edit -> Type in the IP of google’s DNS IP’s and hit Apply to all… then it should work.

Hi,
I followed your article to installed RRAS on server 2016 on a standalone physical computer with 2 NICs (internal NIC static IP 10.0.0.1 and external NIC IP 192.168.0.178 which connect to my home’s router (192.168.0.1).
I configured “Custom configuration–>Lan routing” service only, the service started normally. However the router seems doesn’t works. I can ping between two NICs (“ping -S 10.0.0.1 192.168.0.178” successful and “ping -S 192.168.0.178 10.0.0.1” also successful) but “ping -S 10.0.0.1 192.168.0.1” failed.
If I configure NAT instead of “Lan routing”, I can successfully ping internet from 10.0.0.1.
In addition, “ping -S 192.168.0.178 192.168.0.1” without issue.
Any suggestions are appreciated!
Thank you.

Leave a Reply Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Как настроить windows server 2008r2 чтобы была маршрутизация между двумя разными сетями?

Если правильно понял, то схема такая ХОСТ1 -192.168.0.1/24- СЕРВЕР -192.168.1.0/24- ХОСТ2.

На сервере 2 сетевухи с настройками 192.168.0.10 255.255.255.0 и 192.168.1.10 255.255.255.0 (без шлюзов).
На ХОСТ1 настройки 192.168.0.100 255.255.255.0 шлюз 192.168.0.10.
На ХОСТ2 настройки 192.168.1.100 255.255.255.0 шлюз 192.168.1.10.

На сервере установлена роль «Службы политики сети и доступа»-> «Служба удаленного доступа» + «Маршрутизация»
В «Администрировании — Маршрутизация и удаленный доступ» выбираем «Настроить и включить маршрутизацию и удаленный доступ» — «Особая конфигурация» — «Маршрутизация локальной сети»
После этого ХОСТ1 с ХОСТ2 пингуется обоюдно. Проверено на стенде из виртуалок.