Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In short

Is it possible to have two seperate networks (seperated by IP addresses and subnet) under one gateway + firewall that is within IP and subnet configuration is on network #1 and still filter inbounding/outbounding traffic to/from network #2?


Gateway + Firewall (m0n0wall software) has internal address with subnet

  • Computers have addresses 192.168.0.x with same subnet /24
  • Some devices, are on 192.168.1.x with subnet /24

Internally, from computer with address 192.168.1.Y i can access device, ofcourse.

Question is - is it possible to forward some ports from external IP (out of office) to device with IP 192.168.1.X? Will it work if firewall is on "different network"?

So far i have

  • Forwarded port 443 to 192.168.1.X:443
  • Set up firewall rule to fully trust all ports inbound & outbound to my external IP address.

While trying to connect to Office external IP, port 443

  • In browser i get ERR_TIMED_OUT
  • In office firewall logfile i see that Out of office external IP, port 1560 allowed to, port 443 TCP
  • Sometimes I also see Out of office external IP, port 1560 denied to Office external IP, port 443 TCP
  • I don't see any answer from 192.168.1.X in logfile.

If i map 443 to address 192.168.0.X, everything is OK.

What is the problem and how to solve this please?

My suspect is that firewall is not on same subnet. What if i lower subnet number to for firewall to include both networks - will it not break the whole network?

share|improve this question
up vote 1 down vote accepted

Internally, from computer with address 192.168.1.Y i can access device, ofcourse.

You haven't given us enough detail:

You have two separate logical networks


Your firewall lives in This means that cannot communicate with your firewall without some other part of the picture that I've missed. How does communicate with your firewall? Your must either have:

  • a secondary interface on the m0n0wall which also has an address on
  • a router in between the two networks
  • have a network bridge or some device doing NAT between the two networks

You'll need to fill us in on what part of the puzzle we're missing here.

share|improve this answer
Well, i think that's the problem as is not able to communicate with firewall.... right now we access device internally, but we need remote access. – Janis Veinbergs Nov 18 '09 at 14:51
The question remains - is there a solution, like set FW subnet to /18 ? Will it not break existing NAt configuration (port forwarding, firewall rules), allowing existing computers within to communicate to internet? – Janis Veinbergs Nov 18 '09 at 14:53
I'm assuming you're able to access the second subnet internally through a router or layer 3 sitch, correct? Then tell the firewall to use the router or layer 3 switch to get to – joeqwerty Nov 18 '09 at 15:00
No, I can't access that subnet internally. (Without setting IP like 192.168.1.X). Gateway/firewall is the very first entrance point from the internet (it has assigned public IP address). But internal address is – Janis Veinbergs Nov 18 '09 at 15:05
This doesn't make sense. How does a host on get to a host on Through a router or layer 3 switch, right? Is there a physical connection (router or layer 3 switch) between the subnets? If so, then that's how the firewall should get to the other subnet. If there isn't then you'll need to use another interface on the firewall (if it has one) and connect it to the other subnet. If the firewall doesn't have another interface and there's no router or layer 3 switch between the subnets then it's not possible as the traffic can not pass through the air from one to another. – joeqwerty Nov 18 '09 at 15:14

In short: yes.

Details: please show the output of iptables -L -n, iptables -L -n -t nat, ip route show, and ip addr list.

share|improve this answer

In most cases you need to tell the firewall that you have additional or secondary networks behind it, in addition to the network it's directly attached to. The firewall will also need to know how to route packets to this secondary network as it's on another subnet. You also need to have NAT set up to translate one of your available public ip addresses to the internal address of the server in question.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.