Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Below is my home network topology. I currently have 5 static IP addresses, 3 of which are in use by 3 routers. These routers in-turn subnet internal networks and port forward. I use my SSL VPN appliance to remote home from work or on the road. At this point I can remotely administer my Windows Server. I know the network is setup wrong, I was matching existing hardware the best I knew how.

Ok this said, here is the problem... One of my websites on my Windows Server now needs to be secure (SSL using port 443). However, I'm already port forwarding port 443 to my VPN appliance. Furthermore, if I'm going to have to reconfigure the network, I would really like to be able to use the SSL VPN to remotely administer all machines.

I mentioned this to a friend of mine, who said that what I was looking for was a firewall. Explaining that a firewall would take in multiple static (WAN) IP addresses, and still allow all internal devices to be on the same network. So, basically, I could supply my SSL VPN appliance it's very own static (WAN) IP address routing, and yet have it on the same internal network (192.168.1.x) as all my other devices.

The first question is... Does this sound right? Secondly, would you suggest anything different? And, finally, what is the cheapest way to do this? I am started down the road of downloading/installing untangle and smoothwall to see if they will do the job, hoping they take multiple static (WAN) IP addresses.

Thank you in advance for your answers.

-Jessy Houle

share|improve this question
What model routers do you currently have? Depending on what they are ... you might not have to buy anything new. – Zypher Jan 3 '10 at 4:42
The router for the two Linux machines are really cheap DLinks and the router for the windows, VPN, and wireless is a Linksys hacked to DDWRT. – Jessy Houle Jan 3 '10 at 5:13
Comletely off topic, but I am curious: Where did you get these nice icons for your network topology drawing from? – Ludwig Weinzierl Jan 3 '10 at 5:54
@Ludwig They look like the stock Visio icons – Zypher Jan 3 '10 at 6:20
Yes, MS Visio 2010. – Jessy Houle Jan 3 '10 at 9:16
up vote 1 down vote accepted

If you simplify your configuration to the following Modem -> DDWRT -> Optional switch if the DDWRT doesn't have enough ports -> Servers/Clients. You should be able to setup you configuration such that the DDWRT router is listening on all of the public IP's and forwarding to the correct host using iptables.

Sorry, I can't give you the exact commands as I don't work with iptables all that much, and do everything but basic host fire walling using Cisco routers/asa's.

Also you will probably get a better answer on SU - they probably use that type of setup more often, so i'm going to vote to have it moved over.

Ask and ye shall receive (From the DDWRT Website)

share|improve this answer
If you can give me an URL or high-level direction on how to implement iptables with DDWRT, I will mark this as answered. Thank you. – Jessy Houle Jan 4 '10 at 2:26
not to knock DD-WRT (I have two Linksys ethernet bridges in my house running it and love it to death), but depending on what sort of performance/reliability you're looking for, you may want to look at upgrading to a real SOHO firewall like a low end Cisco (they can be had pretty cheap from eBay or greymarket/secondhand vendors) or the likes. I frequently find that passing VPN traffic thru other firewalling devices can really be a PITA. – Greeblesnort Jan 4 '10 at 5:02

Maybe you are already done. Here you find how to do it with DD-WRT:

share|improve this answer
Excellent link. Thank you. I will probably do do this when I re-do the network again. – Jessy Houle Jun 16 '10 at 16:02

You can also consider getting a DrayTek 2950 or 2820N Model, they have dual WAN Ports (so you can plugin two physical internet connections)

They can have multiple Public IP Address bound to each Wan Interface, very easy to use and provides tons of features.

DrayTek 2950 provides 200+ concurrent vpn connections without any additional vpn CALs.

Hope this helps

share|improve this answer
Great suggestion. Thank you! – Jessy Houle Jun 16 '10 at 16:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.