up vote 1 down vote favorite
1
share [g+] share [fb]

I'm working with a company with the following network - AT&T DSL internet access through a Netopia 3347NWG router serving DHCP to about 25 workstations; 192.168.1.0/24.

They're getting a Netscreen firewall that is supposed to come pre-configured with a visible outside IP address, let's call it 72.2.34.50 which is would be an outside ip given us by AT&T.

Is it possible to set up the Netopia to allow traffic to 72.2.34.50 to pass through directly to the Netscreen interface using the 1 DSL line? The AT&T technical support couldn't seem to help but I expect I never made it to their A team.

Clarification: I'll have 2 outside IPs coming to the netopia. One (72.2.34.50) will be going exclusively to the netscreen while the netopia will handle everything else. I'll need the netopia to continue the DHCP duties as well.

Thanks,

link|improve this question
100% accept rate
feedback

2 Answers

up vote 2 down vote accepted

Yes. Use the IP Passthrough feature of your Netopia modem. http://www.netopia.com/support/hardware/technotes/CQG%5F022.html

You'll need to set up DHCP on the Netscreen firewall instead of the Netopia modem though. Everything should be "behind" the Netscreen and nothing should be talking directly through the modem except the Netscreen.

EDIT: In light of new information, take a look at the Netopia's "IP Maps" ability which can allow multiple external IPs to exist on the WAN interface and forward to a single LAN IP. For instance, if your two WAN IPs are 1.1.1.10 and 1.1.1.20 and you want the .20 address to forward to the Netscreen, you will need to give the Netscreen a static address on the LAN (192.168.1.2 for example) and then forward all WAN traffic destined for 1.1.1.20 to 192.168.1.2.

Make sure your Netopia router as the correct firmware however. Take a look at the following document for more information: http://www.netopia.com/support/hardware/technotes/CQG%5F024.html

link|improve this answer
I like to do the DSL/PPPoE authentication credentials in the firewall as well so I can swap DSL modems when needed (and trust me, you will, if the AT&T ones are anything like the garbage my clients seem to get with their ISPs). – gravyface Nov 24 '09 at 15:13
Very good point. I've had to swap DSL modems (ActionTec m1000 on Qwest lines) and usually keep an identically configured one in the office for that reason. m1000s can't export config files and don't support bridging with predictable results. Bad Qwest, bad!! =) – WesleyDavid Nov 24 '09 at 16:04
Thanks for the responses but just to clarify; this netscreen device is hooked to a single machine and will be tunneling out. Nothing else can be connected to it. It's part of a certain state's bureau of investigation. Neither the netscreen or the workstation on the other side of it can be accessible from the rest of the network. – Jeff Nov 24 '09 at 17:17
Ah ha. That is an entirely different matter. So you have multiple external static IPs; for example 1.1.1.10 and 1.1.1.20 - the .10 address is what the office would use for normal traffic, but you then want .20 to be solely forwarded to the netscreen firewall which in turn only protects one machine. I was under the impression that the netscreen would be the office's new firewall. In that case, could you rephrase the question to clarify the situation? Make sure to mention that you want two public IPs to come to the one router but traffic bound for one of them to exclusively go to the netscreen. – WesleyDavid Nov 24 '09 at 17:29
thanks, I added the clarification - I think :-) – Jeff Nov 24 '09 at 19:41
feedback
up vote 1 down vote

If you're going to use the Netscreen to do your NAT, DHCP, etc once it comes in your best option is to change the Netopia to bridge mode.

In bridge mode you will be required to configure your PPoE settings on the Netscreen, support should be able to help you with that.

http://www.netopia.com/support/technotes/hardware/CQG%5F020.html

link|improve this answer
Very good point about bridging. I thought about mentioning it, but didn't because of my poor experience with SOHO modems and bridging as I detailed in the comment I left in my own answer. – WesleyDavid Nov 24 '09 at 16:05
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.