Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to figure out how OSPF establishes routes when used on a network with firewalls.

Say I have four routers (A, B, C, and D) and two firewalls (F1 and F2), arranged like so:

(LocalA) A - F1 - B - C - F2 - D (LocalD)

Say F1 blocks all traffic from LocalA except that which is coming from or destined for LocalD. F2 does likewise for LocalD, effectively allowing them to communicate only with each other. If OSPF were enabled on all routers, B and C would know about each other. B and C would, however, not know about either A or D (I'm assuming). The question is, would A and D know about each other?

And by "know about each other," I mean would one be reachable from the other based on the routing tables that OSPF sets up.

Obviously this question betrays a general lack of understanding about how OSPF works, but bear with me.

share|improve this question
There are various methods for allowing OSPF and other dynamic routing protocols through firewalls if necessary or even participate in the routing. I'm guessing this is just a learning exercise, but you'd have to be more specific about the types of firewalls in question. – TheCleaner Oct 16 '13 at 18:42
I'm using Linux firewalls (So IPTables). I'm essentially trying to accomplish the above scenario, where B can route to C, and A can route to D (but thats it) only using OSPF and firewall rules in the stated places, if that context helps clarify at all. – exxodus7 Oct 16 '13 at 18:46
How do A and D establish connectivity with each other in the first place? – joeqwerty Oct 16 '13 at 18:50

OSPF is entirely built upon areas. The only way for the routers to see one another is to be placed on the same area ID. It doesn't operate the same way as say, RIP, where you tell the router what networks it is working with.

Edit I should have also specified that the firewalls will need to route the network over the forward facing IP address.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.