Just solved a particularily troublesome issue that wasn’t obvious at first but makes sense now.
Intro
We have multiple Internet connections from multiple providers; this displays what they’re plugged into on our Sonicwall 4060:
The WiBand connection is from a wireless ISP, connecting to a basestation about 1.5KM away.
Problem
There is a client of ours across the street who is trying to access a website who’s DNS entry refers to the X3 interface provided by a Shaw IP address. They receive a strange “Oops, we could not reach that website” error page within Internet Explorer.
I did an nslookup to make sure the DNS A record for the site was still correct, which it was. I used our external dial-up line to ensure that the site was up and available, which it was.
Based on this, I suggested to my company contact dealing with the client that perhaps they are using a custom DNS provider who has an incorrect A record for our site, who is providing that custom error page. I then forget about the issue.
The next day I get a call from the client’s IT department that the problem still exists. We run through some DNS troubleshooting, and determine that site is getting the right IP, but still getting the custom error page.
I decide to check the error logs on my firewall, and the only thing of note is an “IP Spoof Detected” error. After asking what the source IP is from the problem site, it is confirmed that its the same IP as the ‘spoof’.
The client site has this IP address (close enough):
192.168.146.9/255.255.255.192
Alarm bells start going off as I realize this is very similar to our WiBand IP on X2. Our IP for that link is (changed for privacy):
192.168.146.26/255.255.255.192
Turns out the client across the street from us is also using WiBand for an ISP, and we’re connecting to the same basestation, in the same subnet.
The HTTP request is coming in on X3, but the response can’t leave X3 destined for the client IP, since that range is on X2. So our firewall drops the packet.
Solution
Our current work-around is a static route that forces the return traffic out the correct interface. It looks a little like this:
Source Destination Service Gateway Interface
Any Client IP HTTP(all) Shaw Gateway IP X3
I had the gateway on this route originally set to OUR Shaw IP, but this was incorrect.
I suppose next step is to find out why WiBand has us on the same subnet, and whether they could use VLAN’s or something else to segregate us. It’s a little disappointing that we will be the guinea pigs for this, as I would have thought an ISP would have resolved these type of issues by now.
