0

Let's say we have a router with a WAN IP assigned by DHCP: 1.1.1.1/255.255.255.255

The ISP subnet for it's lan interface is 82.5.167.161/255.255.255.248

My firewall behind this router is on WAN IP: 82.5.167.162/255.255.255.248

I setup a one-to-one NAT for a web server on IP: 82.5.167.163

How when an external user access the web server on the IP mentioned, does the router know to send the traffic to the firewall?

2
  • 1
    Sounds like you have your network laid out incorrectly... it hurt my eyes to read this question. Were these supposed to be example IP addresses?
    – CIA
    May 27, 2015 at 19:14
  • They are indeed examples.
    – PnP
    May 27, 2015 at 19:46

1 Answer 1

1

Simplified explanation: The ISP routes traffic for the 82.5.167.160 network to the router, the router is connected to the 82.5.167.160 network on it's LAN interface so it accepts this traffic, it knows that the firewall is also connected to the 82.5.167.160 network (on it's WAN interface), it therefore routes traffic for the 82.5.167.160 network to the firewall, which NAT's it to the appropriate internal host.

As seen in the following pics, the router is directly connected to two networks and the routing table shows routes for those two networks and shows them as directly connected, so a router does and will have routes in it's routing table for networks it is directly connected to.

enter image description here

enter image description here

7
  • Thanks Joe, I understand that, my query is how it knows that 82.5.167.163 exists on that firewall, given there is nothing in the routing to tell it so and the firewall itself doesn't have an interface specifically configured on the .163 address.
    – PnP
    May 27, 2015 at 19:47
  • Sure there is. The router knows that it is directly connected to the 82.5.167.160 network on it's LAN interface and routes all traffic for the 82.5.167.160 network out that interface to the firewall. If you were to look in the router's routing table you would see a directly connected route for the 82.5.167.160 network for the router's LAN interface.
    – joeqwerty
    May 27, 2015 at 19:52
  • In your example, your network is 82.5.167.160 through 82.5.167.167.
    – joeqwerty
    May 27, 2015 at 19:53
  • Thanks joe, the explanation is much appreciated. One final query - what if the subnet provided is shared on both the WAN and LAN. Say as above, but on the WAN of the router 82.5.167.161/255.255.255.255, the LAN interface of the router then has 82.5.167.161/255.255.255.248. Would you need to add static routes on the router to send additional IPs in that range to t he IP of the firewall? There would be some confusion here for the router surely !
    – PnP
    May 27, 2015 at 20:05
  • This is confusing - with the above comment, would you need routes, surely as you mentioned if the subnet exists on the LAN interface it will just route it out that interface?
    – PnP
    May 27, 2015 at 21:26

Not the answer you're looking for? Browse other questions tagged .