Monday, February 25, 2013

Routing Across VLANs With No Default Gateway On The PC

Its funny how sometimes you run across a client that denies Internet access to only a handful of computers while allowing all the others.  For instance, in this case, I have a customer that denies Internet to employees who work in a warehouse.  Their fix for this was to not have a default gateway on the PC accessible to the warehouse employees , which is a good idea.  However, that threw a wrench into my VLAN project.  Thats ok, these sort of things dont bother me.  I simply do persistent routes.  I really like that you can manipulate routing on any layer 3 capable device, and that does include PCs.
Im going to simulate what I would see at customer site with my own laptop.  This is what the routing table looked like with no default-gateway:
Notice above that I can get to the network without any issues.  That is because of ARP, not because of routing.  You just can not 'route' to a device on the same subnet as you are on.  Therefore, you use ARP.   Now, on the PCs at my client, here is a command I did in DOS to add a route in for a new VLAN I created:
Now, keep in mind, I wanted this permanent, so I put a '-p' at the end of the statement.  So above, I added the network in my routing table on my PC.  This gets me to route my traffic destined to a network to the gateway of  With that said, that is literally the only other network besides that I can get on.  Just those two, and no others.
So, what does the routing table look like after I add the command?
See the first line in the routing table above.  When I do a 'route print', it shows me the above routing table on the PC.  You see that was added into the routing table when I put that last command in.  Thats pretty cool to manipulate a routing table like that.  And you can do that for almost any purpose if you want.
Now I know what you are thinking.  You can easily control this on the firewall or a router.  But, what if you don't have access  to those devices and they are managed by someone else who doesn't play well with other IT folks?  There is always a way if you need to accomplish something. 

No comments:

Post a Comment

Your comment will be reviewed for approval. Thank you for submitting your comments.