Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on a network project in witch I have to design our network to provide two different exit points. The points are differentiated by the path through the corporate network. One of them travels through some monitoring hardware the other does not. We have a Watchguard Firebox in use as our gateway. Currently the network side provides the unmonitored exit point. I was wondering if i hooked the option port to our lan at a point that would force traffic through the monitored path, would it cause any problems? Access to the unmonitored gateway port would be restricted by ip. That would force all others not authorized to point to the monitored gateway port.

I thought with the above design i might be able to get away with not having to buy another firebox to achieve the design I want.

Thanks, D

share|improve this question
up vote 0 down vote accepted

This should be achievable (although I've never tried it). I'm not clear on your use of the term "network side". All of the ports on the firewall are "network sides", designed to be connected to different "networks", such as the trusted network, optional network, external network, etc.

Assign a valid ip address to the optional port and set the DG gateway to be the ip address of the optional interface on the clients that should go out through the optional interface.

The optional interface is typically meant to be used as a DMZ network, but it's not restricted to that use.


My bad. I didn't specify enough detail in my answer. You can do this but it will require putting the optional interface and the clients that should use the optional interface as their DG on a different subnet from the trusted interface.

share|improve this answer
I was afraid of that. What I actually need is one subnet with two gateways. I will end up with two modems and two gateways. One gateway will have security devices inspecting the traffic that travels its route and the other will not. I half expected I would have to buy another router to accomplish that setup but I thought I'd ask if I could do it with just one. – Donovan Mar 16 '11 at 4:20
Oh and I was using the Watchguard terminology there. Sorry. LAN = Network Side, WAN = external side – Donovan Mar 16 '11 at 4:25

I was wondering if i hooked the option port to our lan at a point that would force traffic through the monitored path, would it cause any problems?

You wont be able to assign the optional port an IP address on your LAN, it will need to be on a separate subnet. I think the only way around that is to make them a bridge interface with a primary and secondary IP, although that would mean both physical connections listening on both addresses and would mean you cannot firewall between the two ports, and might depend on the version of software your Firebox is running.

I don't clearly follow what you mean by forcing through different exits - it sounds like you want two separate networks but without having to make two separate networks, and that makes it sound like a bit of a bodge solution. Have two separate networks and you can assign the different gateways by DHCP.

share|improve this answer
After tinkering with the Firebox's settings I found I can't even set packet filtering rules on the option port like I can with the network port. Even if I could get it setup not having filter rules kills the setup. Bummer. – Donovan Mar 16 '11 at 4:23
Which Watchguard model and firmware version do you have? – TessellatingHeckler Mar 16 '11 at 20:57
Its an older X10e with the 10.2.8 firmware. – Donovan Mar 17 '11 at 0:21
OK. If you have a current LiveSecurity license you can upgrade it to version 11.x, which should give you the full policy manager with appropriate rules. If you haven't, buying a year's LiveSecurity will cost quite a bit and may not be worth it. – TessellatingHeckler Mar 17 '11 at 21:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.