LAN and WiFi on separate networks, not communicating

H3llR4iser

Ok folks, this is probably a relatively simple issue whose solution will either be "you need to change this setting" or "can't be done with SOHO equipment".

Situation: I am connected with Magnet's "Pure Fibre" or something similarly named; In a nutshell, there is an "uplink" network cable coming up to the apartment from the outside, which connects to an 8-port switch. From the switch, 7 network cables depart and each goes to one RJ-45 socket in the wall, in the different rooms. A fairly straightforward network, in other words.

The gateway is somewhere outside and I have no control whatsoever over it. Each device plugged in one of the RJ-45 sockets gets a (partially public) IP address through DCHP (again, no control over it).

Problem: I need WiFi, other than the wired LAN access. I have a couple of routers - one (Technicolor) sent to me by Magnet, which is kinda bad and doesn't allow to modify some parameters; another one is a SOHO grade TP-Link. Both have a WAN port; Once connected, they do exactly their job as routers and create another network, on a different IP class (192.168.0.X) and use the apartment's wired network for Internet access. It all works ok...only, my wired PCs can't communicate with anything connected via Wi-Fi and vice versa; In other words, the router is isolating the "outside" (sockets) network from the "inside" one.

Question: Is there any quick/reliable way I can set up some proper routing to make the two networks communicate? Am I better off simply using one of my routers to gain more direct control of the network (connecting the uplink form Magnet directly to the WAN port), or maybe just setting it up as an AP?

Thanks

ItHurtsWhenIP

Turn off DHCP on the TP Link, configure it to pick up a dynamic IP from the apartments router and then plug a cable from one of the RJ-45s into a LAN port on it. Set-up your wi-fi and everything should see each other on that subnet. Oh and I had left mine in Router mode.

I had a LinkSys ADSL router doing this on my FWA connection for the last 8 years and it worked well. I've just splurged and replaced it with an Archer C9 in the last few days.

Alun

Many routers have a setting somewhere in the wireless settings called "AP Isolation" or something similar which will, as the name implies, prevent WiFi and LAN clients seeing each other.

Which TP-Link router is it exactly?

Alun

Quick question, after re-reading your post, are you plugging your wired clients into the router or the switch? If they're in the switch then, yes you'll have problems, so just plug them into the router instead.

BTW that setting I mentioned is almost always off by default, so probably not the cause anyway.

ItHurtsWhenIP

Alun wrote: »

Quick question, after re-reading your post, are you plugging your wired clients into the router or the switch? If they're in the switch then, yes you'll have problems, so just plug them into the router instead.

BTW that setting I mentioned is almost always off by default, so probably not the cause anyway.

He hasn't access to the router (or gateway as s/he calls it). They're all plugged into the switch.

Alun

The router I was referring to was his own that he's using to provide wireless access.

I don't know if this is the case here, but ISTR that there are Magnet products (FTTB?) installed in some apartment complexes whereby you get public IP's from the Ethernet cable that comes into each apartment, so this so-called "gateway" could be anything, maybe just a fibre to Ethernet interface where the fibre enters the building. The DHCP server would be somewhere in Magnet's own network in this case.

If it is public IP's that he's getting, he may be better off connecting the WAN port of his own router to the incoming connection, and connecting the wall outlets to the router's LAN ports, as he'll then be getting both the protection of the router's firewall and NAT. If he needs all 7 wall outlets connecting then he can connect the switch he has to the router to expand the number of available ports.

If however the "gateway" really is a router, then that's clearly not a great solution as he'll be double NAT'ing, so your suggestion of repurposing one of his routers as an AP would be the best bet.

ItHurtsWhenIP

Alun wrote: »

...
If it is public IP's that he's getting, he may be better off connecting the WAN port of his own router to the incoming connection, and connecting the wall outlets to the router's LAN ports, as he'll then be getting both the protection of the router's firewall and NAT. If he needs all 7 wall outlets connecting then he can connect the switch he has to the router to expand the number of available ports.
...

Actually that is a good idea regardless, but I suppose it depends on whether the placement of wireless router is as he needs it.

ED E

I'm pretty sure he's using the hard points around the premises that would normally be used for the local ethernet LAN and trying to use them for his LAN, but Magnet have configured them all as WAN access points on their switch in the basement(or wherever).

H3llR4iser you need to use only one ethernet jack in the wall, if you use two you have to send traffic over the internet and back which is a much more complex network setup (you'd end up with multiple VPN links and a clogged connection at the host). If you want wired access for some devices you need to run your own CAT5/6 cables or use homeplugs (not always great in an apartment).

Alun

ED E wrote: »

I'm pretty sure he's using the hard points around the premises that would normally be used for the local ethernet LAN and trying to use them for his LAN, but Magnet have configured them all as WAN access points on their switch in the basement(or wherever).

I got the impression there was one Ethernet connection coming in to his apartment and the 7 wall jacks were connected through an 8 port switch, again in his apartment, but we really need clarification on this, along with an example of the IP addresses he's getting at the moment to determine what the best course of action is.

Cuddlesworth

Alun wrote: »

I got the impression there was one Ethernet connection coming into his apartment and the 7 wall jacks were connected through an 8 port switch, again in his apartment, but we really need clarification on this, along with an example of the IP addresses he's getting at the moment to determine what the best course of action is.

More like the attached tbh

Alun

Attachments seem to be borked after the recent DDOS, so I can't see that unfortunately.

ED E

Oh, re-reading it could be either way.

Its either
A: Each hardpoint is WAN
B: One point is WAN and he's switching instead of Routing/NAT

MarkR

What's happening is that the lan side and wan side of the router in your appartment can't be on the same network. They'll be on 192.168.1.x, and the other on 192.168.0.x.

If you need your devices to talk to each other internally, take it out of the wan port of the tp-link, and put it in one of the wan ports. Set it to receive ip addresses automatically, and you should be fine.

MarkR

What's happening is that the lan side and wan side of the router in your apartment can't be on the same network. They'll be on 192.168.1.x, and the other on 192.168.0.x.

If you need your devices to talk to each other internally, take it out of the wan port of the tp-link, and put it in one of the wan ports. Set it to receive ip addresses automatically, and you should be fine.

H3llR4iser

Hi folks,

Sorry I had very little time to reply - and then the post-DDOS performance issues don't help.

ED E nailed it on the head - the way Magnet set the properties up (the whole building is a Magnet-only affair) is that the uplink comes directly into a switch; As a result, each and every LAN port in the apartment is indeed a WAN connection. Anything you connect to them gets a web-exposed IP address (something like 83.29.x.x, but I'm sure I've seen different ranges).

Now, I'm not entirely happy with having no control over it, so initially I took out the network switch in the box and replaced it with my own router - I will never need all 7 LAN sockets at the same time, 4 should be enough (and still, I could just patch one port from the router back into the switch et voila', all 7 ports available again).

Problem - the box is placed in a frankly silly location: in the little laundry/immersion room, which is essentially as far as possible from the living room. The WiFi signal is still decent - good for the phone and laptops, but unfortunately I have a Google Chromecast which has...how to say, simply horrid reception. Netflix would not allow HD playing and often stop to buffer even in SD.

Ultimately, what I did is a bit convoluted but functional - in the living room, one corner has two RJ45 sockets side by side. So:

- Disconnected the uplink from the switch (the apartment-provided one);
- PAtched through the uplink directly to one of the living room sockets (let's call it #6) using an RJ-45 joiner;
- Installed router (TP-Link) in the living room; WAN port connected to socket #6 (the uplink from Magnet);
- LAN port #1 of the router connected to the second living room socket, let's call it #7;
- Back in the Magnet "switchbox", all the LAN sockets except for #6 are connected in the switch;

This way, my router controls the internal network, providing DHCP, WiFi and what not. It'll stay like this for now - I didn't subscribe to the phone service, although I recently realized that this makes the apartment's alarm pretty useless. So I guess there'll be round 2 once I get the phone activated (which yes, travels on the same uplink network cable - there is some small "converter" apparatus in the switch box for that).

H3llR4iser

Hi folks,

Sorry I had very little time to reply - and then the post-DDOS performance issues don't help.

ED E nailed it on the head - the way Magnet set the properties up (the whole building is a Magnet-only affair) is that the uplink comes directly into a switch; As a result, each and every LAN port in the apartment is indeed a WAN connection. Anything you connect to them gets a web-exposed IP address (something like 83.29.x.x, but I'm sure I've seen different ranges).

Now, I'm not entirely happy with having no control over it, so initially I took out the network switch in the box and replaced it with my own router - I will never need all 7 LAN sockets at the same time, 4 should be enough (and still, I could just patch one port from the router back into the switch et voila', all 7 ports available again).

Problem - the box is placed in a frankly silly location: in the little laundry/immersion room, which is essentially as far as possible from the living room. The WiFi signal is still decent - good for the phone and laptops, but unfortunately I have a Google Chromecast which has...how to say, simply horrid reception. Netflix would not allow HD playing and often stop to buffer even in SD.

Ultimately, what I did is a bit convoluted but functional - in the living room, one corner has two RJ45 sockets side by side. So:

- Disconnected the uplink from the switch (the apartment-provided one);
- PAtched through the uplink directly to one of the living room sockets (let's call it #6) using an RJ-45 joiner;
- Installed router (TP-Link) in the living room; WAN port connected to socket #6 (the uplink from Magnet);
- LAN port #1 of the router connected to the second living room socket, let's call it #7;
- Back in the Magnet "switchbox", all the LAN sockets except for #6 are connected in the switch;

This way, my router controls the internal network, providing DHCP, WiFi and what not. It'll stay like this for now - I didn't subscribe to the phone service, although I recently realized that this makes the apartment's alarm pretty useless. So I guess there'll be round 2 once I get the phone activated (which yes, travels on the same uplink network cable - there is some small "converter" apparatus in the switch box for that).

ED E

Good work getting around the existing setup to have something usable.

They may be running FE on the network cables and "stealing" a pair for phone signals. Depending on how theyve done it that might be a little awkward. Or it might just be VOIP.

BTW the chromecast actually isnt terrible, its just that it only supports 2.4Ghz and in an apartment block thats useless. In areas with less 2.4Ghz noise they perform pretty wel (Mines going through 3x 6" concrete blocks just fine).

mass_debater

ED E wrote: »

Good work getting around the existing setup to have something usable.

They may be running FE on the network cables and "stealing" a pair for phone signals. Depending on how theyve done it that might be a little awkward. Or it might just be VOIP.

BTW the chromecast actually isnt terrible, its just that it only supports 2.4Ghz and in an apartment block thats useless. In areas with less 2.4Ghz noise they perform pretty wel (Mines going through 3x 6" concrete blocks just fine).

Fyi. The latest Chromecast is dual band