Questions[private-ip](server)

We are setting up an internal program, on an internal server that uses the private 172.30.x.x subnet... when we ping the address 172.30.138.2, it routes across the internet:

C:\>tracert 172.30.138.2
Tracing route to 172.30.138.2 over a maximum of 30 hops

  1     6 ms     1 ms     1 ms  xxxx.xxxxxxxxxxxxxxx.org [192.168.28.1]
  2     *        *        *     Request timed out.
  3    12 ms    13 ms     9 ms  xxxxxxxxxxx.xxxxxx.xx.xxx.xxxxxxx.net [68.85.xx.xx]
  4    15 ms    11 ms    55 ms  te-7-3-ar01.salisbury.md.bad.comcast.net [68.87.xx.xx]
  5    13 ms    14 ms    18 ms  xe-11-0-3-0-ar04.capitolhghts.md.bad.comcast.net [68.85.xx.xx]
  6    19 ms    18 ms    14 ms  te-1-0-0-4-cr01.denver.co.ibone.comcast.net [68.86.xx.xx]
  7    28 ms    30 ms    30 ms  pos-4-12-0-0-cr01.atlanta.ga.ibone.comcast.net [68.86.xx.xx]
  8    30 ms    43 ms    30 ms  68.86.xx.xx
  9    30 ms    29 ms    31 ms  172.30.138.2

Trace complete.

This has a number of us confused. If we had a VPN setup, it wouldn't show up as being routed across the internet. If it hit an internet server, Private IP's (such as 192.168) shouldn't get routed.

What would let a private IP address get routed across servers? would the fact that it's all comcast mean that they have their routers setup wrong?

I'm working on a network where I can't obtain a public IP address or set up VPN access. Is there a way that I can communicate with a local server remotely by using an intermediary in the cloud that both local server and remote client make an outbound requests to? If the local server would be making a request every few seconds to a public intermediary (EC2) to see if a remote client is waiting to speak with it, then the fact that it doesn't have a public IP wouldn't matter. At that point, I could also make a request from a client at a remote location and somehow ssh into the server through the public intermediary. This way both the client and server are initiating with an outbound request, which can originate from a private IP, without any modifications to either local network. Any bright ideas?

I'm trying to understand what this output from traceroute means. I changed the IP addresses for privacy but retained the public/private IP range distinction.

traceroute.db -e -n 10.1.1.9
traceroute to (10.1.1.9), 30 hops max, 60 byte packets
 1  10.0.0.1  0.596 ms  0.588 ms  0.577 ms
 2  10.0.0.2  1.032 ms  1.029 ms  1.084 ms
 3  10.0.0.3  3.360 ms  3.355 ms  3.338 ms
 4  23.0.0.4  3.974 ms  4.592 ms  4.584 ms
 5  23.0.0.5  13.442 ms  13.445 ms  13.434 ms
 6  45.0.0.6  13.195 ms  12.924 ms  12.913 ms
 7  67.0.0.7  52.088 ms  51.683 ms  52.040 ms
 8  10.1.1.8  46.878 ms  44.575 ms  44.815 ms
 9  10.1.1.9  45.932 ms  45.603 ms  45.593 ms

The first 10.0.* range is inside my organisation. The last 10.1.* range is another site of my organisation. The intermediate addresses belong to various ISPs. I expect that there is some kind of VPN between the two sites, but I don't know much about our network topology.

What I don't understand is how the route can go from a private address through public addresses back into private addresses. Searching led me to Public IPs on MPLS Traceroute, which gives a possible explanation: MPLS. Is MPLS the only possible or most likely explanation? Otherwise what does this tell me about our network infrastructure?

Bonus question for my edification: in this scenario, who is generating the ICMP TTL exceeded packets and if relevant mangling their source and destination addresses?

Essentially I have two physical servers (Both identical, both ESXi hosts, each with 2xdual gbit nics) in a private rack in a data center. They will both be running a variety of db/web/storage server guests and each has a large redundant storage array for backing up the other's vm's for redundancy. Each machine has two uplinks (one from each NIC) to the datacenter's switch and the remaining two (again, one from each NIC) connecting them together directly, without a switch, for 3 reasons: data transport security between machines, independence from the datacenter network equipment and speed.

My question is this: How can I configure these hosts so that a guest web server on ESXi host 1 to connect to the DB server on ESXi host 2 over their private connection? Specifically what needs to be configured on the ESXi servers in order to add a new virtual NIC and assign a private IP address for internal communication with other guests.

If you need any additional detail I will be monitoring the thread closely to make updates.

Thank you!

I'd have a network like this currently. Basically, It's two Xenservers connected to our colocation provider's switch via one ethernet cable per server. Each server currently has a second ethernet card which storage is attached to (iSCSI). Each of the VMs (and Xen hosts) have a public IP. All the VMs communicate with each other via their public IP.

What I'd like to setup is a situation like this where each VM has at least a private address and only public facing servers would have a public IP. As well, storage would be connected to the switch instead of directly attached. As the private network would be inaccessible to the outside world, I'd like VPN so I can connect to and administer the private network.

That said I don't know very much about networking (in terms of setting this all up)

So the questions are:
1) How do I virtually network multiple VMs (on seperate hosts) together (for the private network)?
2) How do I set up virtual networking in Xen center?
3) would it be preferable to get a switch that supports VLaning and segment the network that way?

I'd be grateful to hear any advice the community has on these matters. Thanks in advance.