Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my company we have a relatively small network. Than we have 2 different WAN (via ADSL and SHDSL) connection behind 2 different hardware firewalls (Zyxel and SonicWall). Those are connected to our network switch. Common users are supposed to use ADSL connection, while helpdesk and some other guys have to use SHDSL connection ('cause they often upload stuff to external servers). Proxy and content filtering on both routers are available in trial version and then one has to buy it and this sucks. Also the NAT and other kind of network management is a nightmare, 'cause sometimes people just switch their gateway without any permission. The MAC-based routing, blacklists etc are good options, but we would have to create/edit those rules twice (in the worst case), because we have to routes/firewalls.

So I decided to build a new Debian box with DHCP\DNS\Squid\DansGuardian\IPTables services. This PC has 3 Gigabit NICs and theoretically can handle 2 WAN connections + one connection to our switch.

Everybody will have to set this box as gateway, so it will manage NAT, proxy and content filter for both groups of users. Then I would like to build some sort of MAC-based list (IPTables routes?) that will help me to forcibly route the users that are supposed to use ADSL conenction to ADSL router.

My question: is is this set up is kind of setup is possible? are the software solutions I am going to use are suitable for this setup? am I missing something?

OPTIONAL: I would like to set up a VPN server on this PC, is it possible with current hardware(3 network adapters)/software configuration or some incompatibilities may arise?

P.S. I will probably use IP for user identification with a MAC-IP binding enabled on DHCP.

share|improve this question
As I don't know if it is an option for you, I'd suggest using pfSense for this "requirement" It is pretty easy to configure and manage, and enables the ability to create firewall rules depending on multiple rules. And also routing traffic to specific gateways, if you wish to do so. Maybe you could use the captive portal or the sqid proxy server to authenticate users and apply specific firewall rules to them? As I am currently not at home I can just comment, and not "answer" directly :) – Daywalker Aug 22 '13 at 13:32
I've already heard of pfSense distro, but not sure if it has all the features I need: DNS server\DHCP server\Proxy and optionally VPN. P.S. I have a LDAP server for user authentication, so I can use that. I think that pfSense (as any other modern application) already has some sort of LDAP authentication plugin. – Salaros Aug 22 '13 at 14:04
pfSense would meet all these requirements (DNS,DHCP,VPN,Proxy(extra package), LDAP Auth). I just could not figure out at home if you could create user based routing FW policy as I don't use any kind of authentication at home :) (sry). But I'd suggest to just give it a try or wait for another (real) answer. – Daywalker Aug 23 '13 at 6:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.