1

I have a project in mind and I'd love to hear some ideas on some open source solutions with COTS hardware.

I have a few 24 and/or 48 port managed layer2 switches with customers potentially on each port (though its usually about 20-30). Right now the switch has a bridged network and backhaul the traffic to our core to a centralized DHCP server. I need to move them to a NAT solution and, while doing this, I'd like to protect the customers on each port from the customer traffic on the other ports. I also need to be able to port forward from the public side of the firewall/nat box to specific hardware on the inside of the nat machine (easy enough, I know).

My first thoughts are to build an appliance-like box (the fewer moving parts the better) that can do filtering and NAT with rfc1918 an address range being handed out via a DHCP server on the appliance. A caching DNS server on the appliance would be a plus since we backhaul everything to the core. I'd like to run FreeBSD but I'm open.

Now, to try to limit the broadcast traffic thats visible I was thinking of doing each port on the switch as a different vlan and have the switch do trunking to the private NIC on the FreeBSD/appliance. I'd probably need to do some magic on the freebsd NIC to get this working but it should.

We have the parts to build these systems. So, does this make sense? Are there any other solutions out there that we don't have to spend money on but can use our parts to create something? Are there any good distros that could do this already (monowall)?? I may or may not admin this solution so a secure web configuration and management tool would be a plus in the other admins' minds.

Thoughts?

1 Answer 1

4

I think you should try pfSense. It's FreeBSD based and fork of m0n0wall

2
  • 1
    +1 for the easy solutions. FreeBSD doesn't require any "magic" to trunk vlans, just set the switch port to tagged for each of the vlans, then run ifconfig vlan create vlan ## vlandev nic0 (where ## is the vlan number, and nic0 is the NIC that's connected to the switch); then configure the vlan devices as you want, you can bridge them or set them all up individually, or there are other ways too.
    – Chris S
    Dec 28, 2010 at 14:51
  • I just started to play with it now. Very cool. Thanks for the suggesting.
    – Adeodatus
    Dec 28, 2010 at 21:56

Not the answer you're looking for? Browse other questions tagged .