>so i created a "internal only" network for my VMs. I'm beginning to
>understand the whole MS switch protocol, however I'm failing to
>understand how I'm going to get my VM's internet access though the
>host OS.
>
>thanks,
>matt

>
> "Steve Jain" <(email address - cut out)> wrote in message
> news:(email address - cut out)...
>> On Mon, 28 Apr 2008 12:53:59 -0700 (PDT), godfather55v
>> <(email address - cut out)> wrote:
>>
>>>so i created a "internal only" network for my VMs. I'm beginning to
>>>understand the whole MS switch protocol, however I'm failing to
>>>understand how I'm going to get my VM's internet access though the
>>>host OS.
>>>
>>>thanks,
>>>matt
>>
>> Internal only doesn't allow for "external" internet connectivity. If
>> you want to access the internet, create an external network attached
>> to an active NIC on the host.
>>
>> --
>> Cheers,
>> Steve Jain, Virtual Machine MVP
>> http://vpc.essjae.com/
>> I do not work for Microsoft.
>
> To add to Steve's reply, I run all of my vms on internal networks (to
> keep them isolated from the physical network). To give them Internet
> access I run one vm as a RRAS router to link these private networks to the
> physical network.
>
> To do that, set up a vm with two NICs, one using the virtual network
> linked to the physical NIC and one using the internal virtual network.
> Configure RRAS as a NAT router. This works even if the host NIC is already
> on a private LAN behind a NAT.
>
> The only problem which can arise is with DNS. (This has nothing really
> to do with virtualization but you need to be aware of it). If you are
> running AD on the internal network you need to set DNS to forward to a
> public DNS service so that it can resolve public URLs as well as handle
> local machine names and AD SRV records.
>
>

> On Mon, 28 Apr 2008 12:53:59 -0700 (PDT), godfather55v
> <(email address - cut out)> wrote:
>
>>so i created a "internal only" network for my VMs. I'm beginning to
>>understand the whole MS switch protocol, however I'm failing to
>>understand how I'm going to get my VM's internet access though the
>>host OS.
>>
>>thanks,
>>matt
>
> Internal only doesn't allow for "external" internet connectivity. If
> you want to access the internet, create an external network attached
> to an active NIC on the host.
>
> --
> Cheers,
> Steve Jain, Virtual Machine MVP
> http://vpc.essjae.com/
> I do not work for Microsoft.

> I'm thinking of doing something similar to get around an issue where we're
> short of addresses in our datacenters.
> What I'd like to do is setup one VM with RRAS and DHCP to hand out private
> class C addresses to virtuals on the private network and NAT everything to
> the public network (actually our internal network in the datacenter) .
> While I can see this working for outbound connections on the virtual, how
> would incoming connections be handled as the virtual would probaly
> register it's class C address with the domain DNS and WINS servers ?
>
> "Bill Grant" <not.available@online> wrote in message
> news:(email address - cut out)...
>>
>> "Steve Jain" <(email address - cut out)> wrote in message
>> news:(email address - cut out)...
>>> On Mon, 28 Apr 2008 12:53:59 -0700 (PDT), godfather55v
>>> <(email address - cut out)> wrote:
>>>
>>>>so i created a "internal only" network for my VMs. I'm beginning to
>>>>understand the whole MS switch protocol, however I'm failing to
>>>>understand how I'm going to get my VM's internet access though the
>>>>host OS.
>>>>
>>>>thanks,
>>>>matt
>>>
>>> Internal only doesn't allow for "external" internet connectivity. If
>>> you want to access the internet, create an external network attached
>>> to an active NIC on the host.
>>>
>>> --
>>> Cheers,
>>> Steve Jain, Virtual Machine MVP
>>> http://vpc.essjae.com/
>>> I do not work for Microsoft.
>>
>> To add to Steve's reply, I run all of my vms on internal networks (to
>> keep them isolated from the physical network). To give them Internet
>> access I run one vm as a RRAS router to link these private networks to
>> the physical network.
>>
>> To do that, set up a vm with two NICs, one using the virtual network
>> linked to the physical NIC and one using the internal virtual network.
>> Configure RRAS as a NAT router. This works even if the host NIC is
>> already on a private LAN behind a NAT.
>>
>> The only problem which can arise is with DNS. (This has nothing really
>> to do with virtualization but you need to be aware of it). If you are
>> running AD on the internal network you need to set DNS to forward to a
>> public DNS service so that it can resolve public URLs as well as handle
>> local machine names and AD SRV records.
>>
>>
>
>

>
> "Steve Jain" <(email address - cut out)> wrote in message
> news:(email address - cut out)...
>> On Mon, 28 Apr 2008 12:53:59 -0700 (PDT), godfather55v
>> <(email address - cut out)> wrote:
>>
>>>so i created a "internal only" network for my VMs. I'm beginning to
>>>understand the whole MS switch protocol, however I'm failing to
>>>understand how I'm going to get my VM's internet access though the
>>>host OS.
>>>
>>>thanks,
>>>matt
>>
>> Internal only doesn't allow for "external" internet connectivity. If
>> you want to access the internet, create an external network attached
>> to an active NIC on the host.
>>
>> --
>> Cheers,
>> Steve Jain, Virtual Machine MVP
>> http://vpc.essjae.com/
>> I do not work for Microsoft.
>
> To add to Steve's reply, I run all of my vms on internal networks (to
> keep them isolated from the physical network). To give them Internet
> access I run one vm as a RRAS router to link these private networks to the
> physical network.
>
> To do that, set up a vm with two NICs, one using the virtual network
> linked to the physical NIC and one using the internal virtual network.
> Configure RRAS as a NAT router. This works even if the host NIC is already
> on a private LAN behind a NAT.
>
> The only problem which can arise is with DNS. (This has nothing really
> to do with virtualization but you need to be aware of it). If you are
> running AD on the internal network you need to set DNS to forward to a
> public DNS service so that it can resolve public URLs as well as handle
> local machine names and AD SRV records.
>
>

> Handle it just exactly as you would handle a split DNS between public and
> internal networks with the same DNS name. But if your hosts are needing to
> be joined to a domain on the main internal datacenter network, that will
> cause issues.
>
> --
> Charlie.
> http://msmvps.com/blogs/xperts64
> http://mvp.support.microsoft.com/profile/charlie.russel
>
>
> "IanR" <(email address - cut out)> wrote in message
> news:%23L$(email address - cut out)...
>> I'm thinking of doing something similar to get around an issue where
>> we're short of addresses in our datacenters.
>> What I'd like to do is setup one VM with RRAS and DHCP to hand out
>> private class C addresses to virtuals on the private network and NAT
>> everything to the public network (actually our internal network in the
>> datacenter) . While I can see this working for outbound connections on
>> the virtual, how would incoming connections be handled as the virtual
>> would probaly register it's class C address with the domain DNS and WINS
>> servers ?
>>
>> "Bill Grant" <not.available@online> wrote in message
>> news:(email address - cut out)...
>>>
>>> "Steve Jain" <(email address - cut out)> wrote in message
>>> news:(email address - cut out)...
>>>> On Mon, 28 Apr 2008 12:53:59 -0700 (PDT), godfather55v
>>>> <(email address - cut out)> wrote:
>>>>
>>>>>so i created a "internal only" network for my VMs. I'm beginning to
>>>>>understand the whole MS switch protocol, however I'm failing to
>>>>>understand how I'm going to get my VM's internet access though the
>>>>>host OS.
>>>>>
>>>>>thanks,
>>>>>matt
>>>>
>>>> Internal only doesn't allow for "external" internet connectivity. If
>>>> you want to access the internet, create an external network attached
>>>> to an active NIC on the host.
>>>>
>>>> --
>>>> Cheers,
>>>> Steve Jain, Virtual Machine MVP
>>>> http://vpc.essjae.com/
>>>> I do not work for Microsoft.
>>>
>>> To add to Steve's reply, I run all of my vms on internal networks (to
>>> keep them isolated from the physical network). To give them Internet
>>> access I run one vm as a RRAS router to link these private networks to
>>> the physical network.
>>>
>>> To do that, set up a vm with two NICs, one using the virtual network
>>> linked to the physical NIC and one using the internal virtual network.
>>> Configure RRAS as a NAT router. This works even if the host NIC is
>>> already on a private LAN behind a NAT.
>>>
>>> The only problem which can arise is with DNS. (This has nothing
>>> really to do with virtualization but you need to be aware of it). If you
>>> are running AD on the internal network you need to set DNS to forward to
>>> a public DNS service so that it can resolve public URLs as well as
>>> handle local machine names and AD SRV records.
>>>
>>>
>>
>>
>

> If they are all using reserved private IP addresses (like 10.x.x.x or
> 192.168.x.x) you do not need to use NAT. You can use normal IP routing.
> You only need to use NAT to connect a private LAN to a public LAN (because
> the Internet routers drop private addresses by design). You can use NAT
> for a private to private link to simplify the routing, but it is a
> restricted setup because NAT is a one-way address translation process. It
> is designed that way. It is not suitable for domain computing.
>
> You basically ignore the fact that you are running on a virtual
> network. Look at your overall network topology and devise a networking
> scheme for it. The networking software still works the same way. It
> doesn't know or care about physical or virtual networks.
>
> Without NAT you do need some extra routing on your network. Machines in
> the 10. network will need to know how to reach the 192.168.x networks, but
> that is just standard LAN networking.
>
> "IanR" <(email address - cut out)> wrote in message
> news:(email address - cut out)...
>> They'll be joined to the domain. They could be put in their own workgroup
>> but I don't see that making any difference.
>> I'm looking for a way for any host on the domain to be able to see and
>> connect to the virtuals on the private network and vice versa.
>>
>> The domain is on a class A network 10.x
>> The virtual host has a static 10.x address
>> The RRAS virtual has one interface connected to the virtual host's 10.x
>> nic and one interface connected to the private virtual network, say
>> 192.168.2.x
>> The virtuals will be on the virtual private network 192.168.2.x
>>
>> I assume that a virtual, say HostA can see any host on the 10.x network,
>> say HostB, via RRAS/NAT. I'd like to have HostB be able to see and
>> connect to HostA transparently by using the host name of HostA.
>>
>> I would then like to extend that further by having another virtual host
>> configured similarly but using, say a private class C of 192.168.3.x and
>> so forth.
>>
>> Essentially I'm looking for each virtual host to manage it's own pool of
>> private addresses for it's virtuals and have the virtuals participate in
>> the domain as if they were on the domain network (10.x). Not sure if this
>> possible but unforetunately due to some bad planning and DHCP not being
>> available in the datacenter, there are a limited number of class A
>> addresses left and those that are, aren't guarenteed to be on the same
>> subnet. We don't control the datacenters so we're limited to what options
>> we have.
>>
>>
>> "Charlie Russel - MVP" <(email address - cut out)> wrote in message
>> news:(email address - cut out)...
>>> Handle it just exactly as you would handle a split DNS between public
>>> and internal networks with the same DNS name. But if your hosts are
>>> needing to be joined to a domain on the main internal datacenter
>>> network, that will cause issues.
>>>
>>> --
>>> Charlie.
>>> http://msmvps.com/blogs/xperts64
>>> http://mvp.support.microsoft.com/profile/charlie.russel
>>>
>>>
>>> "IanR" <(email address - cut out)> wrote in message
>>> news:%23L$(email address - cut out)...
>>>> I'm thinking of doing something similar to get around an issue where
>>>> we're short of addresses in our datacenters.
>>>> What I'd like to do is setup one VM with RRAS and DHCP to hand out
>>>> private class C addresses to virtuals on the private network and NAT
>>>> everything to the public network (actually our internal network in the
>>>> datacenter) . While I can see this working for outbound connections on
>>>> the virtual, how would incoming connections be handled as the virtual
>>>> would probaly register it's class C address with the domain DNS and
>>>> WINS servers ?
>>>>
>>>> "Bill Grant" <not.available@online> wrote in message
>>>> news:(email address - cut out)...
>>>>>
>>>>> "Steve Jain" <(email address - cut out)> wrote in message
>>>>> news:(email address - cut out)...
>>>>>> On Mon, 28 Apr 2008 12:53:59 -0700 (PDT), godfather55v
>>>>>> <(email address - cut out)> wrote:
>>>>>>
>>>>>>>so i created a "internal only" network for my VMs. I'm beginning to
>>>>>>>understand the whole MS switch protocol, however I'm failing to
>>>>>>>understand how I'm going to get my VM's internet access though the
>>>>>>>host OS.
>>>>>>>
>>>>>>>thanks,
>>>>>>>matt
>>>>>>
>>>>>> Internal only doesn't allow for "external" internet connectivity. If
>>>>>> you want to access the internet, create an external network attached
>>>>>> to an active NIC on the host.
>>>>>>
>>>>>> --
>>>>>> Cheers,
>>>>>> Steve Jain, Virtual Machine MVP
>>>>>> http://vpc.essjae.com/
>>>>>> I do not work for Microsoft.
>>>>>
>>>>> To add to Steve's reply, I run all of my vms on internal networks
>>>>> (to keep them isolated from the physical network). To give them
>>>>> Internet access I run one vm as a RRAS router to link these private
>>>>> networks to the physical network.
>>>>>
>>>>> To do that, set up a vm with two NICs, one using the virtual
>>>>> network linked to the physical NIC and one using the internal virtual
>>>>> network. Configure RRAS as a NAT router. This works even if the host
>>>>> NIC is already on a private LAN behind a NAT.
>>>>>
>>>>> The only problem which can arise is with DNS. (This has nothing
>>>>> really to do with virtualization but you need to be aware of it). If
>>>>> you are running AD on the internal network you need to set DNS to
>>>>> forward to a public DNS service so that it can resolve public URLs as
>>>>> well as handle local machine names and AD SRV records.
>>>>>
>>>>>
>>>>
>>>>
>>>
>>
>>
>

> They'll be joined to the domain. They could be put in their own workgroup
> but I don't see that making any difference.
> I'm looking for a way for any host on the domain to be able to see and
> connect to the virtuals on the private network and vice versa.
>
> The domain is on a class A network 10.x
> The virtual host has a static 10.x address
> The RRAS virtual has one interface connected to the virtual host's 10.x
> nic and one interface connected to the private virtual network, say
> 192.168.2.x
> The virtuals will be on the virtual private network 192.168.2.x
>
> I assume that a virtual, say HostA can see any host on the 10.x network,
> say HostB, via RRAS/NAT. I'd like to have HostB be able to see and connect
> to HostA transparently by using the host name of HostA.
>
> I would then like to extend that further by having another virtual host
> configured similarly but using, say a private class C of 192.168.3.x and
> so forth.
>
> Essentially I'm looking for each virtual host to manage it's own pool of
> private addresses for it's virtuals and have the virtuals participate in
> the domain as if they were on the domain network (10.x). Not sure if this
> possible but unforetunately due to some bad planning and DHCP not being
> available in the datacenter, there are a limited number of class A
> addresses left and those that are, aren't guarenteed to be on the same
> subnet. We don't control the datacenters so we're limited to what options
> we have.
>
>
> "Charlie Russel - MVP" <(email address - cut out)> wrote in message
> news:(email address - cut out)...
>> Handle it just exactly as you would handle a split DNS between public and
>> internal networks with the same DNS name. But if your hosts are needing
>> to be joined to a domain on the main internal datacenter network, that
>> will cause issues.
>>
>> --
>> Charlie.
>> http://msmvps.com/blogs/xperts64
>> http://mvp.support.microsoft.com/profile/charlie.russel
>>
>>
>> "IanR" <(email address - cut out)> wrote in message
>> news:%23L$(email address - cut out)...
>>> I'm thinking of doing something similar to get around an issue where
>>> we're short of addresses in our datacenters.
>>> What I'd like to do is setup one VM with RRAS and DHCP to hand out
>>> private class C addresses to virtuals on the private network and NAT
>>> everything to the public network (actually our internal network in the
>>> datacenter) . While I can see this working for outbound connections on
>>> the virtual, how would incoming connections be handled as the virtual
>>> would probaly register it's class C address with the domain DNS and WINS
>>> servers ?
>>>
>>> "Bill Grant" <not.available@online> wrote in message
>>> news:(email address - cut out)...
>>>>
>>>> "Steve Jain" <(email address - cut out)> wrote in message
>>>> news:(email address - cut out)...
>>>>> On Mon, 28 Apr 2008 12:53:59 -0700 (PDT), godfather55v
>>>>> <(email address - cut out)> wrote:
>>>>>
>>>>>>so i created a "internal only" network for my VMs. I'm beginning to
>>>>>>understand the whole MS switch protocol, however I'm failing to
>>>>>>understand how I'm going to get my VM's internet access though the
>>>>>>host OS.
>>>>>>
>>>>>>thanks,
>>>>>>matt
>>>>>
>>>>> Internal only doesn't allow for "external" internet connectivity. If
>>>>> you want to access the internet, create an external network attached
>>>>> to an active NIC on the host.
>>>>>
>>>>> --
>>>>> Cheers,
>>>>> Steve Jain, Virtual Machine MVP
>>>>> http://vpc.essjae.com/
>>>>> I do not work for Microsoft.
>>>>
>>>> To add to Steve's reply, I run all of my vms on internal networks
>>>> (to keep them isolated from the physical network). To give them
>>>> Internet access I run one vm as a RRAS router to link these private
>>>> networks to the physical network.
>>>>
>>>> To do that, set up a vm with two NICs, one using the virtual network
>>>> linked to the physical NIC and one using the internal virtual network.
>>>> Configure RRAS as a NAT router. This works even if the host NIC is
>>>> already on a private LAN behind a NAT.
>>>>
>>>> The only problem which can arise is with DNS. (This has nothing
>>>> really to do with virtualization but you need to be aware of it). If
>>>> you are running AD on the internal network you need to set DNS to
>>>> forward to a public DNS service so that it can resolve public URLs as
>>>> well as handle local machine names and AD SRV records.
>>>>
>>>>
>>>
>>>
>>
>
>

> That means that the actual class C address 192.168.x.x will be visible on
> the domain which I don't think the datacenters will allow. Correct ? It
> also means that any other areas using a solution like this could
> potentially use the same class C addresses and conflict with each other.
> We don't control the class A 10.x network so we wouldn't be able to get
> any routing done. Changes at that level here are measured in months. We'd
> have to wait for something like a yearly technology review just to get the
> suggestion in. In order to get this passed I have to get the 192.168.x.x
> hosts appearing on the domain as a 10.x address or addresses. Routing
> might be an issue as each server on the domain gets a class A address but
> not of our choosing so it can be on any subnet. The only guarantee is
> that's in a particular datacenter of which we have several. I can propose
> something like pre-allocating private class B addresses to a particular
> class A subnet and have static routes created. Ie. 172.16.1.x gets routed
> to 10.10.10.x and any virtual host on that subnet can have virtuals using
> 172.16.1.x but again that may take months to get looked at if approved at
> all. That's why I was hoping to use something like RRAS/NAT to get around
> this.
>

> An interesting problem. Unfortunately NAT is not the answer for a network
> using Active Directory.
>
> I agree with you about there being a lack of forthought in the
> planning. There should be no way that you are running short of IP
> addresses on the class A network. A class A network can handle over 16
> million hosts!
>
> I will get back to you if have any suggestions.
>
>
> "IanR" <(email address - cut out)> wrote in message
> news:(email address - cut out)...
>> That means that the actual class C address 192.168.x.x will be visible on
>> the domain which I don't think the datacenters will allow. Correct ? It
>> also means that any other areas using a solution like this could
>> potentially use the same class C addresses and conflict with each other.
>> We don't control the class A 10.x network so we wouldn't be able to get
>> any routing done. Changes at that level here are measured in months. We'd
>> have to wait for something like a yearly technology review just to get
>> the suggestion in. In order to get this passed I have to get the
>> 192.168.x.x hosts appearing on the domain as a 10.x address or addresses.
>> Routing might be an issue as each server on the domain gets a class A
>> address but not of our choosing so it can be on any subnet. The only
>> guarantee is that's in a particular datacenter of which we have several.
>> I can propose something like pre-allocating private class B addresses to
>> a particular class A subnet and have static routes created. Ie.
>> 172.16.1.x gets routed to 10.10.10.x and any virtual host on that subnet
>> can have virtuals using 172.16.1.x but again that may take months to get
>> looked at if approved at all. That's why I was hoping to use something
>> like RRAS/NAT to get around this.
>>
>