HSDPA and LAN

Hi folks,

I'm on a company LAN with very restricted internet policies. I also have a
mobile phone with a HSDPA connection. I have set this up to connect and the
connection is working fine.

If I use either the local area connection or the phone connection,
everything works as expected. With the former I get all access to local
servers, the Intranet, and restricted access to the Internet. With the latter
I get unrestricted access to the Internet but no local access.

If I activate BOTH though, it behaves erratically. Sometimes I don't get
internet access. Sometimes I don't get local access. Sometimes I don't get
ANY access. The moment I disable one of the two connections, it reverts back
to normal behaviour for the remaining connection.

I guess, ignoramus as I am, that this must have something to do with
Routing? Would anyone have the patience to help a complete n00b out?

Steve
Mon Apr 14 10:21:43 PDT 2008

On Mon, 14 Apr 2008 07:34:01 -0700, Rozeboosje
<Rozeboosje@discussions.microsoft.com> wrote:

>Hi folks,
>
>I'm on a company LAN with very restricted internet policies. I also have a
>mobile phone with a HSDPA connection. I have set this up to connect and the
>connection is working fine.
>
>If I use either the local area connection or the phone connection,
>everything works as expected. With the former I get all access to local
>servers, the Intranet, and restricted access to the Internet. With the latter
>I get unrestricted access to the Internet but no local access.
>
>If I activate BOTH though, it behaves erratically. Sometimes I don't get
>internet access. Sometimes I don't get local access. Sometimes I don't get
>ANY access. The moment I disable one of the two connections, it reverts back
>to normal behaviour for the remaining connection.
>
>I guess, ignoramus as I am, that this must have something to do with
>Routing? Would anyone have the patience to help a complete n00b out?

I recommend that you consult with the company's IT department about
this.

First, ask them whether you're permitted to connect your computer to
the Internet using your mobile phone. Many companies don't allow
that, because an Internet connection that doesn't use the company's
firewall could be a security risk to the whole company network.

If it's OK to use your mobile phone's Internet connection, the IT
department should be able to help you get everything to work.
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

John
Mon Apr 14 13:24:39 PDT 2008

=?Utf-8?B?Um96ZWJvb3NqZQ==?= <Rozeboosje@discussions.microsoft.com>
wrote in news:383A8202-EF03-4CFE-B8EE-4B5EAB68B84D@microsoft.com:

> Hi folks,
>
> I'm on a company LAN with very restricted internet policies. I
> also have a mobile phone with a HSDPA connection. I have set this
> up to connect and the connection is working fine.
>
> If I use either the local area connection or the phone connection,
> everything works as expected. With the former I get all access to
> local servers, the Intranet, and restricted access to the
> Internet. With the latter I get unrestricted access to the
> Internet but no local access.
>
> If I activate BOTH though, it behaves erratically. Sometimes I
> don't get internet access. Sometimes I don't get local access.
> Sometimes I don't get ANY access. The moment I disable one of the
> two connections, it reverts back to normal behaviour for the
> remaining connection.
>
> I guess, ignoramus as I am, that this must have something to do
> with Routing? Would anyone have the patience to help a complete
> n00b out?

Each connection has its default gateway. If they have the same
priority (metric) then it is a coin flip as to which gateway is
used. The default configuration is not smart enough to know which
IP addresses are internal company addresses and which are not. You
can probably get this to work by modifying the routing table. Check
the article:

"Making Sense of Windows Routing Tables"
<www.windowsnetworking.com/articles_tutorials/Making-Sense-Windows-Routing-Tables.html>

Note that having simultaneous access to public and private networks
can be viewed as a security risk. You should make sure you have
permission to do this.

HTH,
John

Rozeboosje
Tue Apr 15 02:16:00 PDT 2008

Hello Steve,

I'll respond to yourself and John in a reply to John. Thanks

Rozeboosje
Tue Apr 15 02:21:03 PDT 2008

Hello John, hello Steve,

If the IT department here would be receptive to requests for open internet
access I wouldn't have to ask this question. Instead, they have blocked
pretty much every port I can think of, and filtered out half the web sites
besides. As an IT professional that makes my job much more difficult than
necessary. You know yourself how much information is out there on the Web.
Frankly, I'm amazed that I can even see THIS page through the company
firewall.

So do I have permission? No. But you guys don't need to worry about that; I
am well aware that whatever information from you I would use, it is my own
responsibility to use it wisely. Or unwisely.

John,

I looked at the page you posted, and while it makes sense on some level, it
doesn't help me decide how to resolve my problem. I'm just too ignorant in
this area to understand it well enough to use it :-(

Steve
Tue Apr 15 03:10:41 PDT 2008

On Tue, 15 Apr 2008 02:21:03 -0700, Rozeboosje
<Rozeboosje@discussions.microsoft.com> wrote:

>Hello John, hello Steve,
>
>If the IT department here would be receptive to requests for open internet
>access I wouldn't have to ask this question. Instead, they have blocked
>pretty much every port I can think of, and filtered out half the web sites
>besides. As an IT professional that makes my job much more difficult than
>necessary. You know yourself how much information is out there on the Web.
>Frankly, I'm amazed that I can even see THIS page through the company
>firewall.
>
>So do I have permission? No. But you guys don't need to worry about that; I
>am well aware that whatever information from you I would use, it is my own
>responsibility to use it wisely. Or unwisely.

The IT department has reasons for blocking access, such as maintaining
the security of the network and the company's computers.

No, I'm not worried. It's your job, not mine. But I'm not going to
help you violate your company's policies.

I assume that you're aware of the possible consequences of doing that.
At many companies, it's cause for immediate termination.
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

Rozeboosje
Tue Apr 15 07:59:00 PDT 2008

"Steve Winograd" wrote:

> No, I'm not worried. It's your job, not mine. But I'm not going to
> help you violate your company's policies.

Steve, please relax.

You know what Gandhi said about laws: they're just like people. There are
good people and bad people. There are good laws and bad laws. There are good
company policies and there are bad ones. And the bad ones must be opposed and
undermined. Please allow me to worry about potential consequences.

Nor am I planning to do anything that is truly illegal such as company
espionage. I just want some control over my work environment.

When I arrived here a short while ago I found the network crawling with
viruses and my machine compromised. And all that despite all this draconian
internet nannying that is going on.

Since then I have gained control over my own PC, and I have enabled
Microsoft Update, made sure it was fully up to date (suddenly it stopped
crashing every five minutes, what a surprise) and ensuring the AntiVirus
software was fully up to date. I now have a stable PC, as opposed to most of
my colleagues.

All I want to do is extend this control to how I access the web. Company
policies be damned, but without ANY intent to do anything that could actually
be detrimental to this company, like sitting there like some sort of a dunce
with a PC that is out of my control spewing viruses all over this network -
like many of my colleagues.

I honestly don't know what to think of the IT department here, but I know
that one of the servers here has had the perlovga virus on it for months,
even though I've looked up the removal instructions and they seem pretty
straightforward.

So I would appreciate it if you could leave concerns about how this may
affect me to me, and you could help me out with the actual technical detail
of this problem I am having. If it helps, imagine that I have spoken to the
IT department here and their response was that if I could work out how to do
this I'd be welcome to but they were unable to help me. For all I know that
is the actual response I would get in any case. Ok? I am, however, determined
to crack this nut.

I could go about it like a bull in a china shop, breaking the FSM-knows-what
while I'm trying to get the access I want, or with expert help like yours do
this properly so that I don't cause real damage. It would be greatly
appreciated.

Steve
Tue Apr 15 09:34:43 PDT 2008

On Tue, 15 Apr 2008 07:59:00 -0700, Rozeboosje
<Rozeboosje@discussions.microsoft.com> wrote:

>"Steve Winograd" wrote:
>
>> No, I'm not worried. It's your job, not mine. But I'm not going to
>> help you violate your company's policies.
>
>You know what Gandhi said about laws: they're just like people. There are
>good people and bad people. There are good laws and bad laws. There are good
>company policies and there are bad ones. And the bad ones must be opposed and
>undermined. Please allow me to worry about potential consequences.
>
>Nor am I planning to do anything that is truly illegal such as company
>espionage. I just want some control over my work environment.
>
>When I arrived here a short while ago I found the network crawling with
>viruses and my machine compromised. And all that despite all this draconian
>internet nannying that is going on.
>
>Since then I have gained control over my own PC, and I have enabled
>Microsoft Update, made sure it was fully up to date (suddenly it stopped
>crashing every five minutes, what a surprise) and ensuring the AntiVirus
>software was fully up to date. I now have a stable PC, as opposed to most of
>my colleagues.
>
>All I want to do is extend this control to how I access the web. Company
>policies be damned, but without ANY intent to do anything that could actually
>be detrimental to this company, like sitting there like some sort of a dunce
>with a PC that is out of my control spewing viruses all over this network -
>like many of my colleagues.
>
>I honestly don't know what to think of the IT department here, but I know
>that one of the servers here has had the perlovga virus on it for months,
>even though I've looked up the removal instructions and they seem pretty
>straightforward.
>
>So I would appreciate it if you could leave concerns about how this may
>affect me to me, and you could help me out with the actual technical detail
>of this problem I am having. If it helps, imagine that I have spoken to the
>IT department here and their response was that if I could work out how to do
>this I'd be welcome to but they were unable to help me. For all I know that
>is the actual response I would get in any case. Ok? I am, however, determined
>to crack this nut.
>
>I could go about it like a bull in a china shop, breaking the FSM-knows-what
>while I'm trying to get the access I want, or with expert help like yours do
>this properly so that I don't cause real damage. It would be greatly
>appreciated.

>Steve, please relax.

I'm completely relaxed, thanks. :-)

I sympathize with your unhappiness about things at work.

IMHO, there's no proper way to do what you want to do.

If you want to fight your company, violate its policies, endanger the
company network, and put your job in jeopardy, that's your choice.

But I won't help you do it.
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

John
Tue Apr 15 15:05:07 PDT 2008

=?Utf-8?B?Um96ZWJvb3NqZQ==?= <Rozeboosje@discussions.microsoft.com>
wrote in news:3DE11469-5807-49A6-A80F-55367C3A4629@microsoft.com:

> As an IT professional that makes my job much more difficult than
> necessary.

> I looked at the page you posted, and while it makes sense on some
> level, it doesn't help me decide how to resolve my problem. I'm
> just too ignorant in this area to understand it well enough to use
> it :-(

As an IT professional, it would be in your best interest to learn about
routing tables. After all, it is pretty basic IT knowledge, you have
the motivation, and it's too much to explain in a newsgroup. Try
Googling...

-- John

Rozeboosje
Wed Apr 16 01:26:01 PDT 2008

"Steve Winograd" wrote:

> IMHO, there's no proper way to do what you want to do.

Thanks - at least that is SOME information. In that case I'll be happy to
proceed by simply switching connections if and when necessary. After all,
it's not like I need this ALL the time. Now why couldn't you just have said
that right away rather than lecturing me on how to be a good little peon?

Always - ALWAYS question authority.

Rozeboosje
Wed Apr 16 01:31:00 PDT 2008

"John Wunderlich" wrote:

> Try Googling...

Yeah, well, I'm not THAT much of a n00b, LOL. I did google it, and I have
fiddled about with the route command, trying to add/delete routes and
changing their metrics, but I'm not getting anywhere fast. Either internet
access ceases completely, or the network access breaks down. One or the other
always stops working. Then I have to disable the connections and enable one
of them, which restores things to normal for that connection.

If you agree with Steve that this cannot be done, then that's OK. At least I
know I can stop trying to bash my head against that brick wall, and just be
content with switching the connections if and when necessary. It's clumsy but
it works. I would have loved to have set up Outlook to monitor my personal
e-mails through POP3 but I guess I can live with a Web Mail client.

Steve
Wed Apr 16 09:26:54 PDT 2008

On Wed, 16 Apr 2008 01:26:01 -0700, Rozeboosje
<Rozeboosje@discussions.microsoft.com> wrote:

>"Steve Winograd" wrote:
>
>> IMHO, there's no proper way to do what you want to do.
>
>Thanks - at least that is SOME information. In that case I'll be happy to
>proceed by simply switching connections if and when necessary. After all,
>it's not like I need this ALL the time. Now why couldn't you just have said
>that right away rather than lecturing me on how to be a good little peon?
>
>Always - ALWAYS question authority.

I didn't mean that what you want to do is technically impossible.

I meant that there's no ethical way to do what you want. You might not
care about that, but I do.
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

Rozeboosje
Thu Apr 17 01:19:01 PDT 2008

"Steve Winograd" wrote:

> I meant that there's no ethical way to do what you want. You might not
> care about that, but I do.

Do not presume to think that you are an authority on ethics, Steve. I could
teach you a thing or two on ethics and morality. You present yourself as an
authority on Networking and the Web. Please stick to that role, and leave
ethical and moral considerations up to people who know what they are talking
about.

Steve
Thu Apr 17 11:22:19 PDT 2008

On Thu, 17 Apr 2008 01:19:01 -0700, Rozeboosje
<Rozeboosje@discussions.microsoft.com> wrote:

>"Steve Winograd" wrote:
>
>> I meant that there's no ethical way to do what you want. You might not
>> care about that, but I do.
>
>Do not presume to think that you are an authority on ethics, Steve. I could
>teach you a thing or two on ethics and morality. You present yourself as an
>authority on Networking and the Web. Please stick to that role, and leave
>ethical and moral considerations up to people who know what they are talking
>about.

I'm not going to debate ethics and morality with you. Your stated
intention to violate your company's network security policy, and the
contempt that you've expressed for your company's policies and the
people who implement them, speak for themselves.

?Never try to teach a pig to sing; it wastes your time, and it annoys
the pig.? -- Will Rogers
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

Rozeboosje
Fri Apr 18 01:12:01 PDT 2008

"Steve Winograd" wrote:

> I'm not going to debate ethics and morality with you. Your stated
> intention to violate your company's network security policy, and the
> contempt that you've expressed for your company's policies and the
> people who implement them, speak for themselves.

And yet here you are posting comment after comment berating me, insulting
me, condescending to me and arrogating to yourself a level of authority that
is way beyond what you are able to handle. Why is that, Steve?

Rozeboosje
Wed May 07 08:49:01 PDT 2008

"Steve Winograd" wrote:

> I'm sorry if you find what I say insulting. That's not my intention.

Yeah, right.

Anyway, Steve, in the end it wasn't all that difficult, really. This is what
I did:

1) I created a few persistent routes to our internal range of IP Addresses
with nice high priority metrics.
2) I added entries in the HOSTS files for the servers I connect to.

Then - and I'm going to automate this - I will do the following when I log in:

3) Establish the current IP addresses for machines I need to connect to that
have dynamic IP addresses.
4) Connect to my HSDPA connection
5) Run IPConfig to find out what the default gateways are today
6) Remove route 0.0.0.0
7) Add route 0.0.0.0 back in but ensuring that the route through my HSDPA
gateway gets a better metric

And Bob's your uncle.

Rozeboosje
Wed May 07 08:50:04 PDT 2008

"John Wunderlich" wrote:

> As an IT professional, it would be in your best interest to learn about
> routing tables. After all, it is pretty basic IT knowledge, you have
> the motivation, and it's too much to explain in a newsgroup. Try
> Googling...

Yup. That helped. (grin)

Rozeboosje
Thu May 08 01:01:04 PDT 2008

"Rozeboosje" wrote:

> 6) Remove route 0.0.0.0
> 7) Add route 0.0.0.0 back in but ensuring that the route through my HSDPA
> gateway gets a better metric

Also, I set a lower default metric on my HSDPA connection which makes it
more likely that its gateway will be selected as the default gateway, in
which case it would be unnecessary to do the above.