At my new workspace I want to setup a network that enables me to deploy my web development work on Dev, Test and Accept servers (VMs) with (controlled) access from outside the network - based on different domains (multiple websites). Also I want to have remote access to my network through VPN.
The challenge however is that we have shared internal network and I won't be able to control the router / firewall myself (network is managed by an external party). An illustrated and well explained request is what they need in order to apply a new configuration.
I have limited knowledge of networking but research convinced me my network setup should be possible. Can someone confirm / comment on my ideas with regards to feasibility / best practices?
- The building with my workspace has a fibre (FTTO) connection with public IP 176.xx.xx.xxx. Network traffic is controlled at the Juniper SSG20 firewall (which I can't control but those have a public web interface running on port 80). The internal network has 192.168.30.0/24 range.
- I have a Netgear Prosafe GS105E switch with VLAN support.
- I have a Dell Server with VMware vSphere Hypervisor server (ESXi) with 5 VM's (running Ubuntu 12.04 Srv):
- (A) VM: Fileserver (only internal access for my local workstation (E)
- (B) VM: Webserver (Dev) should handle dev.domain-1.com
- (C) VM: Webserver (Test) should handle test.domain-1.com
- (D) VM: Webserver (Accept) should handle accept.domain-1.com
- The Dell Server has 3 NICs, I can create virtual switches to handle VLAN routing.
- I have a multifunction printer (F) with eth0 inferface that should only be accessible to me within a VLAN.
- The existing Apple Airport also provides WiFi access on the same subnet, but can I hide my VM's so they can't be accessed by other people in the building (VLAN config I guess).
In essence, my goal is:
- port forwarding (80, 443, 5000, 8080) based on domain
- dev.domain-a.com --> 192.168.1.10 (VM: B)
- dev.domain-b.com --> " " " " "
- test.domain-a.com --> 192.168.1.11 (VM: C)
- test.domain-b.com --> " " " " "
- accept.domain-a.com --> 192.168.1.12 (VM: D)
- limit access to Fileserver (VM: A) from my local workstation only
- be able to access network (and fileserver) through VPN
Relevant questions:
- Do I have to configure a Reverse Proxy at a new ESXi VM to be able to resolve the local machines from outside (how about Pound Reverse Proxy server on Ubuntu)?
- Does the Juniper SSG20 Firewall need to add my local servers / VLAN to a DMZ?
- How can the Juniper SSG20 Firewall still have web access (port 80) if I want to have port forwarding for port 80? Do I have to add a rule into the Reverse Proxy that redirects traffic back to the firewall?
Any thoughts would be very, very helpfull so that I can formulate the request to the external network managing party (through the property manager).
Please see the network layout diagram: