Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In short

Is it possible to have two seperate networks (seperated by IP addresses and subnet) under one gateway + firewall that is within IP and subnet configuration is on network #1 and still filter inbounding/outbounding traffic to/from network #2?

Details

Gateway + Firewall (m0n0wall software) has internal address 192.168.0.100 with subnet 255.255.255.0

  • Computers have addresses 192.168.0.x with same subnet /24
  • Some devices, are on 192.168.1.x with subnet /24

Internally, from computer with address 192.168.1.Y i can access device, ofcourse.

Question is - is it possible to forward some ports from external IP (out of office) to device with IP 192.168.1.X? Will it work if firewall is on "different network"?

So far i have

  • Forwarded port 443 to 192.168.1.X:443
  • Set up firewall rule to fully trust all ports inbound & outbound to my external IP address.

While trying to connect to Office external IP, port 443

  • In browser i get ERR_TIMED_OUT
  • In office firewall logfile i see that Out of office external IP, port 1560 allowed to 192.168.1.104, port 443 TCP
  • Sometimes I also see Out of office external IP, port 1560 denied to Office external IP, port 443 TCP
  • I don't see any answer from 192.168.1.X in logfile.

If i map 443 to address 192.168.0.X, everything is OK.

What is the problem and how to solve this please?

My suspect is that firewall is not on same subnet. What if i lower subnet number to 255.255.0.0 for firewall to include both networks - will it not break the whole network?

share|improve this question
add comment

3 Answers 3

up vote 1 down vote accepted

Internally, from computer with address 192.168.1.Y i can access device, ofcourse.

You haven't given us enough detail:

You have two separate logical networks

  • 192.168.0.0/24
  • 192.168.1.0/24

Your firewall lives in 192.168.0.100. This means that 192.168.1.0 cannot communicate with your firewall without some other part of the picture that I've missed. How does 192.168.1.0/24 communicate with your firewall? Your must either have:

  • a secondary interface on the m0n0wall which also has an address on 192.168.1.0
  • a router in between the two networks
  • have a network bridge or some device doing NAT between the two networks

You'll need to fill us in on what part of the puzzle we're missing here.

share|improve this answer
    
Well, i think that's the problem as 192.168.1.0/24 is not able to communicate with firewall.... right now we access device internally, but we need remote access. –  Janis Veinbergs Nov 18 '09 at 14:51
    
The question remains - is there a solution, like set FW subnet to /18 ? Will it not break existing NAt configuration (port forwarding, firewall rules), allowing existing computers within 192.168.0.0/24 to communicate to internet? –  Janis Veinbergs Nov 18 '09 at 14:53
    
I'm assuming you're able to access the second subnet internally through a router or layer 3 sitch, correct? Then tell the firewall to use the router or layer 3 switch to get to 192.168.1.0. –  joeqwerty Nov 18 '09 at 15:00
    
No, I can't access that subnet internally. (Without setting IP like 192.168.1.X). Gateway/firewall is the very first entrance point from the internet (it has assigned public IP address). But internal address is 192.168.0.100. –  Janis Veinbergs Nov 18 '09 at 15:05
    
This doesn't make sense. How does a host on 192.168.0.0 get to a host on 192.168.1.0? Through a router or layer 3 switch, right? Is there a physical connection (router or layer 3 switch) between the subnets? If so, then that's how the firewall should get to the other subnet. If there isn't then you'll need to use another interface on the firewall (if it has one) and connect it to the other subnet. If the firewall doesn't have another interface and there's no router or layer 3 switch between the subnets then it's not possible as the traffic can not pass through the air from one to another. –  joeqwerty Nov 18 '09 at 15:14
show 2 more comments

In short: yes.

Details: please show the output of iptables -L -n, iptables -L -n -t nat, ip route show, and ip addr list.

share|improve this answer
add comment

In most cases you need to tell the firewall that you have additional or secondary networks behind it, in addition to the network it's directly attached to. The firewall will also need to know how to route packets to this secondary network as it's on another subnet. You also need to have NAT set up to translate one of your available public ip addresses to the internal address of the server in question.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.