Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 2 LAN subnets (let's call them LAN1 and LAN2) which each have a static route directing their traffic over a separate internet line (let's call them WAN1 and WAN2). This is intended to keep the public WiFi users from interfering with our internal corporate network.

There are also some services accessed via WAN1, which is achieved by a NAT loopback rule internally. Herein lies the problem...

Let's say a corporate user connects their iPhone to the WiFi (which puts them on LAN2 and gives them Internet access on WAN2), and wants to get their corporate email via ActiveSync. They type in outlook.company.com as the server, it loops back to the WAN1 IP, and... fail. They can only access WAN2 due to the aforementioned route. What is the proper configuration for a route that will allow LAN2 to access WAN1 only in the case of loopbacking?

Edit: Here are the following routes and NAT entries that are relevant...

Routes:

Source         Dest      Gateway                Interface
LAN1           Any       X1 Default Gateway     X1
LAN2           Any       X2 Default Gateway     X2

NAT:

Source Orig.          Source Trans.        Dest. Orig.        Dest. Trans.
Firewalled Subnets    WAN Interface IP     WAN Interface IP   mail server on LAN1  //for NAT loopback
Any                   Original             WAN Interface IP   mail server on LAN1  //normal NAT from the outside
share|improve this question
1  
Could you include a copy of your routing table (or tables)? Possibly a diagram? –  Pablo Maurin Apr 17 '12 at 21:27
    
The problem seems to be coming from "There are also some services accessed via WAN1, which is achieved by a NAT loopback rule internally" Why do you even have this NAT "loopback rule"? Do your internal DNS records point to an external IP for some reason perhaps? –  jwbensley Apr 17 '12 at 21:35
    
The NAT loopback rule is used to access Outlook Web Access for example. Users can just type in outlook.company.com either internally or externally, and it will work. No need for separate addresses. –  Bigbio2002 Apr 18 '12 at 14:41
add comment

2 Answers

For a somewhat-inefficient but more secure option, consider treating them as completely separate and disconnected networks. Clients on LAN2 have access to items on LAN1 only if the LAN1 systems are accessible from the "real world" via the WAN1 connection. Thus, the iDevice in question would connect to "outlook.company.com" the same way it would if it was at the local coffee shop - by connecting to the real-world OWA server. Before worrying about how much it's going to cost for the marginal increase in network utilization, consider how much it's going to cost in your time spent making it work and making sure it stays secure (and doesn't break if you leave/get hit by a bus/etc.)

This is inefficient because everything is going moving through the WAN connections, but keeping everything segregated from the beginning keeps users from coming to you and saying "I just need this one more wireless connection for a printer/laptop/whatever. Pleeeze (big puppy dog eyes) won't you establish another connection from the public WiFi network to our internal supposedly-firewalled systems?"

Because really, if you have a public wifi network you do have two separate networks or you should. If you need internal Wifi as well, set up separate internal connectivity with better authentication.

share|improve this answer
    
I second this approach. KISS (keep it simple stupid) –  John Homer Apr 17 '12 at 21:35
    
I've tried disabling NAT loopback on LAN2, but it doesn't seem to be working, and the configuration is already quite complicated... –  Bigbio2002 Apr 18 '12 at 14:48
    
OK, are WAN1 and WAN2 coming into the building on the same wire? Same carrier but separate lines? Separate carriers (e.g. fiber and cable modem)? What I'm basically saying is if they're on separate wires/fiber, they should never even go into the same router. If they're coming in on one wire, put that into a switch and separate the WANs - that switch outside both networks is the first point of contact, and from there the connections go into separate routers. LAN2 communications to LAN1 systems are EXTERNAL as if coming from a coffeeshop - whether it's in your building is irrelevant. –  fencepost Apr 18 '12 at 22:56
add comment
up vote 0 down vote accepted

Turns out the issue was the firewall. The LAN2 subnet was completely isolated from LAN1, so I just had to open the same ports that I used for WAN > LAN traffic.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.