Under Windows, can I use one ethernet adapter for LAN traffic and one for Internet traffic?

[Shasarak]

Let me begin by saying that I am pretty much an absolute newbie to networking, so please try to be gentle.

I have a Windows 10 desktop PC. It has two Ethernet adapters, one built-in (gigabit) and one USB (2.5gbps). The USB adapter is connected to the (only) 2.5gbps port on the router. The gigabit adapter is connected to a gigabit switch; a number of other devices (media players, etc.) are also connected to the switch; the switch is connected to a gigabit port on the router, so those other devices have internet access.

The router is a Virgin "superhub" 5, so it's not exactly high-end. If I could afford it, I would either invest in a decent router, or at least a 2.5gbps ethernet switch; but, either way, that's money I don't really have right now.

Given that the router is a bit weak, I would prefer other devices on the LAN to be able to communicate with the Windows PC directly via the switch, without the router getting involved in LAN-to-LAN traffic; but since the broadband line is a little faster than gigabit speed (it peaks at about 1150mbps while gigabit Ethernet limits it to 950) I would like any internet downloads on the PC to be done via the USB adapter.

So, ideally, I would like the PC to be able to send and receive data to and from other devices on the LAN via its built-in adapter, but have traffic going to or from the Internet go via the USB adapter.

Is there any (not too complicated) way to do this without additional hardware?

 

[ColinTaylor]

Yuck.

Open the command prompt on the desktop PC and post the complete output of this command:

route print

 

[Shasarak]

Yuck.

Open the command prompt on the desktop PC and post the complete output of this command:

route print

Here you go. There are some VPN "adapters" mentioned in here, but they're not active at the moment. (We'll cross that bridge when we come to it!)

C:\>route print
===========================================================================
Interface List
 14...00 ac 5c 52 05 67 ......VPN Client Adapter - VPN #2
 46...00 e0 4c 68 02 67 ......Realtek USB 2.5GbE Family Controller
 19...50 e5 49 ef 1f 46 ......Qualcomm Atheros AR8151 PCI-E Gigabit Ethernet Controller (NDIS 6.30)
 15...00 ff 90 00 de 3d ......TAP-Windows Adapter V9
 16...00 ff 92 08 c6 ee ......TAP-Windows Adapter V9 #2
  1...........................Software Loopback Interface 1
===========================================================================


IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.0.1      192.168.0.2    258
          0.0.0.0          0.0.0.0      192.168.0.1      192.168.0.3    257
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
      192.168.0.0    255.255.255.0         On-link       192.168.0.2    258
      192.168.0.0    255.255.255.0         On-link       192.168.0.3    257
      192.168.0.2  255.255.255.255         On-link       192.168.0.2    258
      192.168.0.3  255.255.255.255         On-link       192.168.0.3    257
    192.168.0.255  255.255.255.255         On-link       192.168.0.2    258
    192.168.0.255  255.255.255.255         On-link       192.168.0.3    257
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link       192.168.0.2    258
        224.0.0.0        240.0.0.0         On-link       192.168.0.3    257
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link       192.168.0.2    258
  255.255.255.255  255.255.255.255         On-link       192.168.0.3    257
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0      192.168.0.1       0
          0.0.0.0          0.0.0.0      192.168.0.1  Default
===========================================================================


IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    331 ::1/128                  On-link
  1    331 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

 

[ColinTaylor]

Thanks. Can you clarify which IP is the gigabit and which is the USB (192.168.0.2, 192.168.0.3).

 

[Shasarak]

Thanks. Can you clarify which IP is the gigabit and which is the USB (192.168.0.2, 192.168.0.3).

.2 is the built-in gigabit adapter, and .3 is the 2.5gbps USB adapter.

 

[ColinTaylor]

My best guess is to go into the gigabit Ethernet adapter's properties for IPv4 > Advanced and set the interface metric to 10. Save it and then disable/enable the adapter.

Check the route print again and then delete the default route for the gigabit adapter.

route delete 0.0.0.0 mask 0.0.0.0 if 19

To make this change permanent I think you have to use the -p parameter.

EDIT: It might be easier/better to use a static configuration on the gigabit adapter and leave the gateway blank in there. So it looks like:

 

[Shasarak]

My best guess is to go into the gigabit Ethernet adapter's properties for IPv4 > Advanced and set the interface metric to 10. Save it and then disable/enable the adapter.

Check the route print again and then delete the default route for the gigabit adapter.

route delete 0.0.0.0 mask 0.0.0.0 if 19

To make this change permanent I think you have to use the -p parameter.

EDIT: It might be easier/better to use a static configuration on the gigabit adapter and leave the gateway blank in there.

So, as far as I can tell, doing the route delete command seems to have the same effect as manually removing the gateway setting on the gigabit adapter - if I run the command and then check the adapter's properties, the gateway value has been cleared. I assume you were expecting that?

I googled the "Metric" value to see what it does. If I understand correctly, a lower number means a higher priority; so, if this were going to work, I would have thought I would need to set the gigabit adapter to Metric 1, and the USB adapter to Metric 10 (or higher than 1, anyway) - that way the machine would use the gigabit adapter when it can, but fall back to USB when it can't (e.g. when it needs a network that has a gateway set).

But even I'm wrong about that, this approach doesn't seem to work. If I remove the gateway setting (via either method) and then (from another device on the LAN) I ping 192.168.0.2, then I get no response - it's as if that adapter has been deactivated entirely by removing its gateway setting.

Ideally what I need to do is filter the way the routing is done by IP address range; so, for example, anything between 192.169.0.4 and 192.168.0.10 needs to go through the gigabit adapter, while everything else goes through USB; but I don't understand nearly enough about how the "route" command works to make it do that!

 

[ColinTaylor]

So, as far as I can tell, doing the route delete command seems to have the same effect as manually removing the gateway setting on the gigabit adapter - if I run the command and then check the adapter's properties, the gateway value has been cleared. I assume you were expecting that?

Correct. I was initially experimenting from the command line, but later realised the same could be achieved entirely through the GUI.

I googled the "Metric" value to see what it does. If I understand correctly, a lower number means a higher priority; so, if this were going to work, I would have thought I would need to set the gigabit adapter to Metric 1, and the USB adapter to Metric 10 (or higher than 1, anyway) - that way the machine would use the gigabit adapter when it can, but fall back to USB when it can't (e.g. when it needs a network that has a gateway set).

The default metrics shown in your output were 258 and 257. So all you really needed to do was change the 258 number to something lower than 257. The way the metric number is calculated is rather obscure, but setting an adapter to a value of 10 or 20 to achieve priority is quite common.

But even I'm wrong about that, this approach doesn't seem to work. If I remove the gateway setting (via either method) and then (from another device on the LAN) I ping 192.168.0.2, then I get no response - it's as if that adapter has been deactivated entirely by removing its gateway setting.

I tried to recreate your setup as best I could and it worked for me. I suggest you try one more time to verify. Use the GUI method only then reboot the PC just to make sure. Then try pinging another client on the LAN from the PC. Then do the ping in the opposite direction. If it doesn't work post the output of the route print command.

EDIT: I've just tested this again and it worked... eventually. After the reboot I could ping a client on the LAN via one interface and hosts on the internet via the other interface. However, I did notice that the LAN client could not ping back to the PC adapter IP that didn't have a default gateway (the same as you experienced). I went ahead and setup a shared directory on the dual-host PC. From the LAN client I could access the share by either of the PC's IP addresses. I then did the ping again and this time it was working. So maybe it just took some time for the ARP entries to circulate the network.

 

[Shasarak]

"Try going away and leaving it for a few hours to see if anything changes spontaneously" is not a strategy that had occurred to me.

I will give that another go and report back tomorrow!

 

[Shasarak]

However, I did notice that the LAN client could not ping back to the PC adapter IP that didn't have a default gateway (the same as you experienced).

This is roughly what I'm seeing at the moment. With the gateway setting removed on the gigabit adapter, gigabit adapter set to Metric 10 and USB adapater set to Metric 20, the PC can still access the Internet via USB, and can still access other devices on the network via the gigabit adapter - for example, I can launch Putty and create an SSH session on a Linux device on the LAN. But at the moment other devices on the LAN cannot find 192.168.0.2 (the gigabit adapter's address). So, even though I am controlling that Linux device via the 192.168.0.2 interface (verified by unplugging the network cable from the USB adaptor!) if I ask the Linux device to ping 192.168.0.2, it can't find it. And nothing else "incoming" works either - devices can't run iperf3 with 192.168.0.2 as the server, and can't access any SMB shares on 192.168.0.2 either. I'll leave everything switched on overnight, and maybe that will somehow make a difference! Will report again tomorrow....

 

[Shasarak]

I've just tested this again and it worked... eventually. After the reboot I could ping a client on the LAN via one interface and hosts on the internet via the other interface. However, I did notice that the LAN client could not ping back to the PC adapter IP that didn't have a default gateway (the same as you experienced). I went ahead and setup a shared directory on the dual-host PC. From the LAN client I could access the share by either of the PC's IP addresses. I then did the ping again and this time it was working. So maybe it just took some time for the ARP entries to circulate the network.

Okay, so this still isn't working for me. I've figured out why: once I remove the gateway setting from the gigabit adapter, Windows no longer recognises it as accessing the same network, and relabels the "new" one as "public" rather than "private"; so, in order for other devices on the LAN to be able to see it, I have to make the computer discoverable on public networks - which I'm not very keen on doing, as it seems like a security risk.

Could we approach this from the other end? Instead of blocking everything except the LAN on the gigabit adapter, could we somehow block only the LAN addresses on the USB adapter, while allowing the gigabit adapter to route to anything, but with a higher metric cost?

 

[ColinTaylor]

That's interesting, I did mess around with the private/public settings on my PC at one point so maybe that's why it starting working. The problem I found was that the GUI option to change that disappeared. Is it worth trying to set the adapter to private using the registry?

We're not really blocking anything, just defining priorities. We can't really block the LAN on the USB adapter because we still need access to the router as the gateway device. I'll have to ponder this some more.

 

[Shasarak]

We can't really block the LAN on the USB adapter because we still need access to the router as the gateway device.

If I understand correctly, you can't really block anything using the route command, you can only enable routes; but then the question becomes, could we enable (say) everything below 192.168.0.0 and everything above 192.168.0.255, and then add one more route to enable access to 192.168.0.1 specifically? How many routes would be required to do that?

 

[ColinTaylor]

If I understand correctly, you can't really block anything using the route command, you can only enable routes; but then the question becomes, could we enable (say) everything below 192.168.0.0 and everything above 192.168.0.255, and then add one more route to enable access to 192.168.0.1 specifically? How many routes would be required to do that?

No. I did think about something along those lines, and even tried a few experiments. It won't work because fundamentally you have one network (192.168.0.0/24) which is defined on the router and you're plugging two network interfaces into the same network (albeit with one connection going via a switch). Routing "routes" between two or more different networks, which you don't have.

 

[Shasarak]

It won't work because fundamentally you have one network (192.168.0.0/24) which is defined on the router and you're plugging two network interfaces into the same network

We-ell... for any given IP address, only one adapter will ever be talking to it. The gigabit adapter deals with IP addresses between 192.168.0.4 and 192.168.0.255; the USB adapter deals with everything either above or below that range (including the gateway, which is 192.168.0.1). There's no overlap. So it kind of is two separate networks, albeit with rather awkwardly chosen IP address ranges.

 

[ColinTaylor]

Just because you're using different IP addresses for different devices doesn't mean they're on different networks. Like I said, all of your devices are part of the 192.168.0.0/24 network defined on your router. However, I may have found a solution but I can't test it at the moment. So try this;

Go back to your original setup as per post #3. This should already work for 2 out of the 3 scenarios you want. PC traffic will go to the internet via USB. Traffic initiated from the LAN can go to the PC via its gigabit adapter (192.168.0.2). Now setup an explicit route to a server on your LAN (e.g. 192.168.0.100) going via the gigabit adapter:

route add 192.168.0.100 mask 255.255.255.255 192.168.0.2

Now do a route print and test the connectivity to the server at 192.168.0.100.

 

[Shasarak]

Is it worth trying to set the adapter to private using the registry?

As such, this didn't help, because the "unidentified network" doesn't create a registry entry. But studying the rest of that page did allow me to make some progress! It's possible to use the Group Policy Editor to set unidentified networks to be treated as private.

Of course it's not that easy, because I'm running Windows 10 Home, meaning I don't have a Group Policy Editor application. But if I install PolicyPlus from https://github.com/Fleex255/PolicyPlus and, at launch, agree to download all missing administrative templates, then also run
FOR %F IN ("%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~*.mum") DO ( DISM /Online /NoRestart /Add-Package:"%F" )
and
FOR %F IN ("%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~*.mum") DO ( DISM /Online /NoRestart /Add-Package:"%F" )
that enables GPEDIT.msc

Then I can use GPEDIT to set all unidentified networks to be classed as private - see https://www.isunshare.com/windows-10/change-network-from-public-to-private-in-windows-10.html#way3

(Not entirely sure about the security implications of this...?)

Everything is now more or less working: other devices on the LAN can now ping 192.168.0.2, and access file shares using that address; and the PC uses the gigabit adapter to access the LAN, but the USB adapter to access the Internet.

One slight oddity is that if I run iperf3 server on the PC, an iperf3 client on another device on the LAN aiming at 192.168.0.2 still can't see the iperf3 server... but that might be something specific to iperf3. I think everything is probably working well enough now!

 

[Shasarak]

Go back to your original setup as per post #3. This should already work for 2 out of the 3 scenarios you want. PC traffic will go to the internet via USB. Traffic initiated from the LAN can go to the PC via its gigabit adapter (192.168.0.2). Now setup an explicit route to a server on your LAN (e.g. 192.168.0.100) going via the gigabit adapter:

route add 192.168.0.100 mask 255.255.255.255 192.168.0.2

Now do a route print and test the connectivity to the server at 192.168.0.100.

I haven't had a chance to check this yet, but this sounds like it's going to fall foul of Metric problems. In order for the PC to use the USB adapter preferentially for Internet traffic, the USB adapter has to have a lower metric than the gigabit adapter. In order for the PC to use the newly added route as a way to access the LAN, that route would have to have a lower metric than the USB adapter's default routing. But (having tried something similar to this a few days ago) there doesn't seem to be any way to force the metric of the route to be the correct value; it just defaults to the higher value associated with the gigabit adapter, even if I specify a lower value in the route add command.

 

[ColinTaylor]

Using an explicit route to a single host rather than an entire network should resolve the metric problem (for that one host). That's the reason for the test.

 

[Shasarak]

Using an explicit route to a single host rather than an entire network should resolve the metric problem (for that one host). That's the reason for the test.

Ah, yes, you're right - I could swear I had tried almost exactly that before, and it messed up the metric values; but it seems to be giving them sensible values now - see all the entries with Metric 21 here:

C:\WINDOWS\system32>route print
===========================================================================
Interface List
 19...00 e0 4c 68 02 67 ......Realtek USB 2.5GbE Family Controller
 17...50 e5 49 ef 1f 46 ......Qualcomm Atheros AR8151 PCI-E Gigabit Ethernet Controller (NDIS 6.30)
 12...00 ff 6a 94 62 62 ......TAP-Surfshark Windows Adapter V9
  1...........................Software Loopback Interface 1
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.0.1      192.168.0.3    266
          0.0.0.0          0.0.0.0      192.168.0.1      192.168.0.2    276
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
      192.168.0.0    255.255.255.0         On-link       192.168.0.3    266
      192.168.0.0    255.255.255.0         On-link       192.168.0.2    276
      192.168.0.2  255.255.255.255         On-link       192.168.0.2    276
      192.168.0.3  255.255.255.255         On-link       192.168.0.3    266
      192.168.0.4  255.255.255.255         On-link       192.168.0.2     21
      192.168.0.5  255.255.255.255         On-link       192.168.0.2     21
      192.168.0.6  255.255.255.255         On-link       192.168.0.2     21
      192.168.0.7  255.255.255.255         On-link       192.168.0.2     21
      192.168.0.8  255.255.255.255         On-link       192.168.0.2     21
      192.168.0.9  255.255.255.255         On-link       192.168.0.2     21
     192.168.0.10  255.255.255.255         On-link       192.168.0.2     21
    192.168.0.255  255.255.255.255         On-link       192.168.0.3    266
    192.168.0.255  255.255.255.255         On-link       192.168.0.2    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link       192.168.0.3    266
        224.0.0.0        240.0.0.0         On-link       192.168.0.2    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link       192.168.0.3    266
  255.255.255.255  255.255.255.255         On-link       192.168.0.2    276
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0      192.168.0.1  Default
          0.0.0.0          0.0.0.0      192.168.0.1  Default
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    331 ::1/128                  On-link
  1    331 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

That's working correctly, yay! Even iperf3 works.

(Just got to remember to redo those routes with the /p option to make them persistent).