how to defeat WLAN/LAN isolation?

greybeard · 10-25-2008, 06:17 PM

I have a brand new Draytek 2820n router. My ISP has provided a
subnet range and I want to have three computers with static IP addresses all visible externally. Two of these connect wireless (WLAN); the other connects via standard ethernet (LAN).

Standard setup seems fine - all computers can access the internet. However, WLAN computers are isolated from the LAN client. WLAN computers can ping each other and can ping and be pinged from the internet. LAN computer can ping and be pinged from the internet. But the LAN computer cannot ping nor be pinged from the WLAN computers.

The router has a setting for this (sometimes desired) behaviour, which has been switched off.

Has anyone seen this behaviour before, or have any advice? I'm running out of ideas for things to try (and Draytek tech support seem baffled too).

Many thanks.

**johnwill** · 10-26-2008, 02:40 PM

Well, this clearly appears to be a router issue. One question. If you connect one of the wireless computers with a wired connection, does it then see the other wired computer but not the wireless ones?

Let's see this for one of the working wired computers and also for one of the working wireless computers.

Hold the Windows key and press R, then type CMD to open a command prompt:

In the command prompt window that opens, type type the following commands, one at a time, followed by the Enter key:

Note that there is a space before the -n or the /ALL, but there is NOT a space after the - or / in the following commands.

NBTSTAT -n

IPCONFIG /ALL

Right click in the command window and choose Select All, then hit Enter.
Paste the results in a message here.

If you are on a machine with no network connection, use a floppy, USB disk, or a CD-RW disk to transfer a text file with the information to allow pasting it here.

greybeard · 10-26-2008, 07:50 PM

Johnwill - thanks, good call! Moving one of the WLAN computers to a LAN connection suddenly turns this "obvious router problem" into a not so obvious problem:

I now have one WLAN computer (Win XP) and two LAN computers (WinXP and Mac OS X). The two Win XP computers can happily ping each other, and anywhere else, but can't ping (or be pinged by) the Mac.

Next test - move the Mac onto the WLAN (disconnect ethernet, turn on airport). No difference in behaviour! All computers have full internet access, the Win XP computers ping each other fine, but the Mac is unable to ping or be pinged by the Win XP computers.

This can't be a firewalling issue (can it?) because the Mac can ping and be pinged by other internet computers. Though I haven't tried pinging the Mac from a remote WinXP computer - only from OS X and Solaris 9. Same logic goes for the WinXP computers, which can ping and be pinged by OS X and Solaris 9 computers elsewhere.

Any ideas? Would it still be helpful to see the ifconfig and netstat outputs? (I presume NBTSTAT is a windows equivalent of netstat)? It no longer looks like a routing issue - more like a compatibility issue.

Thanks.

**johnwill** · 10-27-2008, 01:31 PM

I'm somewhat confused about the Mac and PC not being able to see each other.

On the Mac, open a terminal window and type:

ifconfig -a

Copy/paste the results here.

For one of the XP machines, please do this.

Hold the Windows key and press R, then type CMD to open a command prompt:

In the command prompt window that opens, type type the following commands, one at a time, followed by the Enter key:

Note that there is a space before the -n or the /ALL, but there is NOT a space after the - or / in the following commands.

NBTSTAT -n

IPCONFIG /ALL

Right click in the command window and choose Select All, then hit Enter to copy the contents to the clipboard.
Paste the results in a message here.

If you are on a machine with no network connection, use a floppy, USB disk, or a CD-RW disk to transfer a text file with the information to allow pasting it here.

greybeard · 10-27-2008, 02:12 PM

OK - here's the data:

======================================
Running Mac OS X Server 10.5.5

betelgeuse:~ admin$ ifconfig -a
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
inet6 fe80::21f:5bff:fe3b:7244%en0 prefixlen 64 scopeid 0x4
inet 62.49.101.215 netmask 0xfffffff8 broadcast 62.49.101.215
ether 00:1f:5b:3b:72:44
media: autoselect (1000baseT <full-duplex,flow-control>) status: active
supported media: autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full-duplex> 10baseT/UTP <full-duplex,hw-loopback> 10baseT/UTP <full-duplex,flow-control> 100baseTX <half-duplex> 100baseTX <full-duplex> 100baseTX <full-duplex,hw-loopback> 100baseTX <full-duplex,flow-control> 1000baseT <full-duplex> 1000baseT <full-duplex,hw-loopback> 1000baseT <full-duplex,flow-control>
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 00:1f:5b:3b:72:45
media: autoselect status: inactive
supported media: autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full-duplex> 10baseT/UTP <full-duplex,hw-loopback> 10baseT/UTP <full-duplex,flow-control> 100baseTX <half-duplex> 100baseTX <full-duplex> 100baseTX <full-duplex,hw-loopback> 100baseTX <full-duplex,flow-control> 1000baseT <full-duplex> 1000baseT <full-duplex,hw-loopback> 1000baseT <full-duplex,flow-control>
en2: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 00:1d:4f:ff:14:bd
media: autoselect (<unknown type>) status: inactive
supported media: autoselect
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
lladdr 00:21:e9:ff:fe:cf:4f:40
media: autoselect <full-duplex> status: inactive
supported media: autoselect <full-duplex>
betelgeuse:~ admin$

========================================
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\blah>nbtstat -n

Wireless Network Connection:
Node IpAddress: [62.49.101.212] Scope Id: []

NetBIOS Local Name Table

Name Type Status
---------------------------------------------
TEACUP <00> UNIQUE Registered
TEACUP <20> UNIQUE Registered
CLAREMONT <00> GROUP Registered
CLAREMONT <1E> GROUP Registered
CLAREMONT <1D> UNIQUE Registered
..__MSBROWSE__.<01> GROUP Registered

C:\Documents and Settings\blah>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : teacup
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : Yes

Ethernet adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/Wireless 2200BG Network
Connection
Physical Address. . . . . . . . . : 00-0E-35-56-42-A9
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 62.49.101.212
Subnet Mask . . . . . . . . . . . : 255.255.255.248
Default Gateway . . . . . . . . . : 62.49.101.209
DNS Servers . . . . . . . . . . . : 158.152.1.58
158.152.1.43

C:\Documents and Settings\blah>
=========================
DATA ENDS

Thanks.

10-25-2008, 06:17 PM	#1 (permalink)
greybeard Registered User Join Date: Oct 2008 Posts: 3 OS: Mac OS X	how to defeat WLAN/LAN isolation? I have a brand new Draytek 2820n router. My ISP has provided a subnet range and I want to have three computers with static IP addresses all visible externally. Two of these connect wireless (WLAN); the other connects via standard ethernet (LAN). Standard setup seems fine - all computers can access the internet. However, WLAN computers are isolated from the LAN client. WLAN computers can ping each other and can ping and be pinged from the internet. LAN computer can ping and be pinged from the internet. But the LAN computer cannot ping nor be pinged from the WLAN computers. The router has a setting for this (sometimes desired) behaviour, which has been switched off. Has anyone seen this behaviour before, or have any advice? I'm running out of ideas for things to try (and Draytek tech support seem baffled too). Many thanks.

10-26-2008, 02:40 PM	#2 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,679 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	Re: how to defeat WLAN/LAN isolation? Well, this clearly appears to be a router issue. One question. If you connect one of the wireless computers with a wired connection, does it then see the other wired computer but not the wireless ones? Let's see this for one of the working wired computers and also for one of the working wireless computers. Hold the Windows key and press R, then type CMD to open a command prompt: In the command prompt window that opens, type type the following commands, one at a time, followed by the Enter key: Note that there is a space before the -n or the /ALL, but there is NOT* a space after the - or / in the following commands.* NBTSTAT -n IPCONFIG /ALL Right click in the command window and choose Select All, then hit Enter. Paste the results in a message here. If you are on a machine with no network connection, use a floppy, USB disk, or a CD-RW disk to transfer a text file with the information to allow pasting it here. __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience

10-26-2008, 07:50 PM	#3 (permalink)
greybeard Registered User Join Date: Oct 2008 Posts: 3 OS: Mac OS X	Re: how to defeat WLAN/LAN isolation? Johnwill - thanks, good call! Moving one of the WLAN computers to a LAN connection suddenly turns this "obvious router problem" into a not so obvious problem: I now have one WLAN computer (Win XP) and two LAN computers (WinXP and Mac OS X). The two Win XP computers can happily ping each other, and anywhere else, but can't ping (or be pinged by) the Mac. Next test - move the Mac onto the WLAN (disconnect ethernet, turn on airport). No difference in behaviour! All computers have full internet access, the Win XP computers ping each other fine, but the Mac is unable to ping or be pinged by the Win XP computers. This can't be a firewalling issue (can it?) because the Mac can ping and be pinged by other internet computers. Though I haven't tried pinging the Mac from a remote WinXP computer - only from OS X and Solaris 9. Same logic goes for the WinXP computers, which can ping and be pinged by OS X and Solaris 9 computers elsewhere. Any ideas? Would it still be helpful to see the ifconfig and netstat outputs? (I presume NBTSTAT is a windows equivalent of netstat)? It no longer looks like a routing issue - more like a compatibility issue. Thanks.

10-27-2008, 01:31 PM	#4 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,679 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	Re: how to defeat WLAN/LAN isolation? I'm somewhat confused about the Mac and PC not being able to see each other. On the Mac, open a terminal window and type: ifconfig -a Copy/paste the results here. For one of the XP machines, please do this. Hold the Windows key and press R, then type CMD to open a command prompt: In the command prompt window that opens, type type the following commands, one at a time, followed by the Enter key: Note that there is a space before the -n or the /ALL, but there is NOT* a space after the - or / in the following commands.* NBTSTAT -n IPCONFIG /ALL Right click in the command window and choose Select All, then hit Enter to copy the contents to the clipboard. Paste the results in a message here. If you are on a machine with no network connection, use a floppy, USB disk, or a CD-RW disk to transfer a text file with the information to allow pasting it here. __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience

10-27-2008, 02:12 PM	#5 (permalink)
greybeard Registered User Join Date: Oct 2008 Posts: 3 OS: Mac OS X	Re: how to defeat WLAN/LAN isolation? OK - here's the data: ====================================== Running Mac OS X Server 10.5.5 betelgeuse:~ admin$ ifconfig -a lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 inet 127.0.0.1 netmask 0xff000000 inet6 ::1 prefixlen 128 gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280 stf0: flags=0<> mtu 1280 en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 inet6 fe80::21f:5bff:fe3b:7244%en0 prefixlen 64 scopeid 0x4 inet 62.49.101.215 netmask 0xfffffff8 broadcast 62.49.101.215 ether 00:1f:5b:3b:72:44 media: autoselect (1000baseT <full-duplex,flow-control>) status: active supported media: autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full-duplex> 10baseT/UTP <full-duplex,hw-loopback> 10baseT/UTP <full-duplex,flow-control> 100baseTX <half-duplex> 100baseTX <full-duplex> 100baseTX <full-duplex,hw-loopback> 100baseTX <full-duplex,flow-control> 1000baseT <full-duplex> 1000baseT <full-duplex,hw-loopback> 1000baseT <full-duplex,flow-control> en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 ether 00:1f:5b:3b:72:45 media: autoselect status: inactive supported media: autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full-duplex> 10baseT/UTP <full-duplex,hw-loopback> 10baseT/UTP <full-duplex,flow-control> 100baseTX <half-duplex> 100baseTX <full-duplex> 100baseTX <full-duplex,hw-loopback> 100baseTX <full-duplex,flow-control> 1000baseT <full-duplex> 1000baseT <full-duplex,hw-loopback> 1000baseT <full-duplex,flow-control> en2: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 ether 00:1d:4f:ff:14:bd media: autoselect (<unknown type>) status: inactive supported media: autoselect fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078 lladdr 00:21:e9:ff:fe:cf:4f:40 media: autoselect <full-duplex> status: inactive supported media: autoselect <full-duplex> betelgeuse:~ admin$ ======================================== Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\Documents and Settings\blah>nbtstat -n Wireless Network Connection: Node IpAddress: [62.49.101.212] Scope Id: [] NetBIOS Local Name Table Name Type Status --------------------------------------------- TEACUP <00> UNIQUE Registered TEACUP <20> UNIQUE Registered CLAREMONT <00> GROUP Registered CLAREMONT <1E> GROUP Registered CLAREMONT <1D> UNIQUE Registered ..__MSBROWSE__.<01> GROUP Registered C:\Documents and Settings\blah>ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : teacup Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Unknown IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : Yes Ethernet adapter Wireless Network Connection: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Intel(R) PRO/Wireless 2200BG Network Connection Physical Address. . . . . . . . . : 00-0E-35-56-42-A9 Dhcp Enabled. . . . . . . . . . . : No IP Address. . . . . . . . . . . . : 62.49.101.212 Subnet Mask . . . . . . . . . . . : 255.255.255.248 Default Gateway . . . . . . . . . : 62.49.101.209 DNS Servers . . . . . . . . . . . : 158.152.1.58 158.152.1.43 C:\Documents and Settings\blah> ========================= DATA ENDS Thanks.