Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to set up a basic lab for a one-time project.

This is what I was thinking:

computer ->Router -> firewall e0 -> switch 1 -> DMZ (just a web server for now)
                     firewall e1 -> switch 2 -> inner network (office comps)

Now this is NOT going to be connected to the Internet in any way, it is going to be all within the same LAN. I usually go with and but that's probably not that important.

My questions:

First of all, will this setup even work? it doesn't need to be great. All I want to do is to do some scans on target machines, and set a couple new rules on the firewall. I'm worried about the comp to router connection, I just need it to connect to the network and I don't have another switch. I suppose I could always disconnect things and move them around to show another scenario.

Secondly, what special configurations( RIP, trunking, etc...) might I need to do for this setup?

I do have another router if needed but only one crossover cable, I do have a serial cord for the routers if I need that.

share|improve this question

migrated from Apr 24 '12 at 18:07

This question came from our site for information security professionals.

If all the workstations/test machines are in the same subnet its gonna work just fine. I suggest you turn on the DHCP server just to make it more easy for you test machine to get an IP and a default Gateway.

If not, you need to configure a static route or a routing protocol.

Depending on how old are your equipement, crossover cables are no longer required, modern switch and routers are quite clever enough to detect the equipement connected to them.

share|improve this answer

You need at least 3 ports on your router, because you have 3 subnets.

(ignoring the firewalls for a minute) You don't need any kind of dynamic routing because you only have 3 subnets directly connected to your router. You only need to share routes when you have multiple routers. Your machines on each subnet should use the IP address of the router for the interface on their subnet for the default gateway (upstream gateway).

If you transparently firewall (firewall don't have IP addresses) you only have 3 subnets. If you don't want to have a bridging firewall you need to have additional subnets and then you need to inform your router than "subnet dmz" is reachable out interface X and vice-versa.

Once you start segmenting at layer 3 (IPs and subnets), you possibly make DHCP much more complicated because it relies on broadcasting within a subnet.

share|improve this answer

The set up is valid, however with a set up this size I would recommend just sticking with static routes on routers and firewalls. If you plan to do some scans pay attention to natting on that firewall. Chances are you will not want to nat at all.

As for RIP, it's not needed but if you want to learn a routing protocol use OSPF or EGRP.

You could play with trunking or should I say VLANS if you just want to learn but a network of this size will not benefit greatly from the layer 2 optimization that VLAN's can provide. Not to mention it seems you only have one or no devices connected on your switches in these diagrams.

Most modern day devices do not require a crossover nowadays but if you run across some older devices such as these it is quite possible you may need to create the cross over cables.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.