Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

At my new workspace I want to setup a network that enables me to deploy my web development work on Dev, Test and Accept servers (VMs) with (controlled) access from outside the network - based on different domains (multiple websites). Also I want to have remote access to my network through VPN.

The challenge however is that we have shared internal network and I won't be able to control the router / firewall myself (network is managed by an external party). An illustrated and well explained request is what they need in order to apply a new configuration.

I have limited knowledge of networking but research convinced me my network setup should be possible. Can someone confirm / comment on my ideas with regards to feasibility / best practices?

  1. The building with my workspace has a fibre (FTTO) connection with public IP 176.xx.xx.xxx. Network traffic is controlled at the Juniper SSG20 firewall (which I can't control but those have a public web interface running on port 80). The internal network has 192.168.30.0/24 range.
  2. I have a Netgear Prosafe GS105E switch with VLAN support.
  3. I have a Dell Server with VMware vSphere Hypervisor server (ESXi) with 5 VM's (running Ubuntu 12.04 Srv):
    • (A) VM: Fileserver (only internal access for my local workstation (E)
    • (B) VM: Webserver (Dev) should handle dev.domain-1.com
    • (C) VM: Webserver (Test) should handle test.domain-1.com
    • (D) VM: Webserver (Accept) should handle accept.domain-1.com
    • The Dell Server has 3 NICs, I can create virtual switches to handle VLAN routing.
  4. I have a multifunction printer (F) with eth0 inferface that should only be accessible to me within a VLAN.
  5. The existing Apple Airport also provides WiFi access on the same subnet, but can I hide my VM's so they can't be accessed by other people in the building (VLAN config I guess).

In essence, my goal is:

  • port forwarding (80, 443, 5000, 8080) based on domain
  • dev.domain-a.com --> 192.168.1.10 (VM: B)
  • dev.domain-b.com --> " " " " "
  • test.domain-a.com --> 192.168.1.11 (VM: C)
  • test.domain-b.com --> " " " " "
  • accept.domain-a.com --> 192.168.1.12 (VM: D)
  • limit access to Fileserver (VM: A) from my local workstation only
  • be able to access network (and fileserver) through VPN

Relevant questions:

  • Do I have to configure a Reverse Proxy at a new ESXi VM to be able to resolve the local machines from outside (how about Pound Reverse Proxy server on Ubuntu)?
  • Does the Juniper SSG20 Firewall need to add my local servers / VLAN to a DMZ?
  • How can the Juniper SSG20 Firewall still have web access (port 80) if I want to have port forwarding for port 80? Do I have to add a rule into the Reverse Proxy that redirects traffic back to the firewall?

Any thoughts would be very, very helpfull so that I can formulate the request to the external network managing party (through the property manager).

Please see the network layout diagram: http://onbeperktmedia.nl/upload/network_scheme_oldschoolproj.png

share|improve this question

closed as too broad by MadHatter, Nathan C, mdpc, Lucas Kauffman, Bryan Jul 23 '13 at 12:04

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
There are too many subquestions here. Please review your post and concentrate on one specific problem at a time. Canvassing for opinions is not what StackExchange is for. –  Deer Hunter Jul 22 '13 at 13:15
    
His question is actually pretty well thought out, especially considering the lack of networking experience. Assuming he only needs the "Relevant Questions" answered and the rest is just details to support what he's trying to accomplish it looks like he's done the relevant research. –  TheCleaner Jul 22 '13 at 13:20
    
Thanks, I tried to layout my goals and summarize the actual challenge in the 'related questions' section. Indeed, my knowledge of networking is very limited so I tried to give more detailed info to illustrate my questions. By no means I try to gather only opinions, I'm actually looking for feasible approaches, such as TheCleaner answered. –  Cyppher Jul 22 '13 at 20:34

1 Answer 1

up vote 2 down vote accepted

Do I have to configure a Reverse Proxy at a new ESXi VM to be able to resolve the local machines from outside (how about Pound Reverse Proxy server on Ubuntu)?

No reverse proxies are needed based on your requirements/goals list. All you really need are dedicated internet/WAN IPs and some basic NAT/MIP rules on the SSG20 setup. You can lock down this access via firewall rules on the SSG20 if you want (like which client IPs can come in, etc.)

Does the Juniper SSG20 Firewall need to add my local servers / VLAN to a DMZ?

No, but you do need to have MULTIPLE external IP addresses available to do straight NATing (on the Juniper it would be a static NAT, which they call a MIP/mappedIP). In that scenario you would have a single external IP for each internal VM (dev/test/accept) to easily do external to internal translations.

Otherwise, you'll need to PAT or what Juniper calls a VIP on the SSG and listen on different ports. Meaning if you wanted just a single external IP, then you'd need to do something like normal port listening on dev and then increment something like 81/444/5001/8081 for test and so on. Then in the SSG20 it would map externalIP:81 to 192.168.1.11:80 but that's really a PITA vs just getting a few additional external IPs from the provider.

How can the Juniper SSG20 Firewall still have web access (port 80) if I want to have port forwarding for port 80?

I'm assuming you mean external access to the SSG20's admin webui? Personally, that shouldn't be open anyway...security hole especially over just http. The admin/responsible party should lock it down to a different listening port over https and limit it to their incoming client IP ranges. But again, I go back to Multiple external IPs. If you have dedicated IPs for your VMs, then you can still (albeit not recommended) let them keep the normal external WAN IP and port 80 open on the Juniper SSG20.

Do I have to add a rule into the Reverse Proxy that redirects traffic back to the firewall?

No, this is unnecessary. All you need is to make sure that the VMs can route out to the Juniper (normal internet traffic). If they can already, then they are done. You don't even need to get fancy with the vmware networking unless you require that each VM be segmented and can't send each other traffic, but you can do this within the VM's OS just as easily.

share|improve this answer
    
@Cyppher - If you are unable to use any additional external IP addresses, and are unable to use different ports, then you are in the situation of needing a reverse proxy. Like TheCleaner says, either more external IPs or different ports would be simpler (can be done in the Juniper firewall), but you're right that a reverse proxy would be necessary if those options are not possible. –  Paul Kroon Jul 22 '13 at 19:57
    
Thanks, It didn't occur to me that binding dedicated IP addresses to the actual (virtual) servers could be the desired solution, I will try that first by requesting another set of IPv4 addresses. If the ISP (or the property manager) won't cooperate, then I will fall back to the reverse proxy server. I guess then I have to redirect network targeted to the webUI (port 80) of the Juniper back to that interface, correct? –  Cyppher Jul 22 '13 at 20:40
    
@Cyppher - Yes, you'd have to have a rule to specify the traffic that should be directed back to the Juniper for that. The Juniper device will basically be routing all of this traffic to the reverse proxy, and the proxy will decide what traffic gets routed back to the Juniper directly. –  Paul Kroon Jul 27 '13 at 12:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.