1

Below is my home network topology. I currently have 5 static IP addresses, 3 of which are in use by 3 routers. These routers in-turn subnet internal networks and port forward. I use my SSL VPN appliance to remote home from work or on the road. At this point I can remotely administer my Windows Server. I know the network is setup wrong, I was matching existing hardware the best I knew how.

http://storage.jessyhoule.com.s3.amazonaws.com/network_topology.jpg

Ok this said, here is the problem... One of my websites on my Windows Server now needs to be secure (SSL using port 443). However, I'm already port forwarding port 443 to my VPN appliance. Furthermore, if I'm going to have to reconfigure the network, I would really like to be able to use the SSL VPN to remotely administer all machines.

I mentioned this to a friend of mine, who said that what I was looking for was a firewall. Explaining that a firewall would take in multiple static (WAN) IP addresses, and still allow all internal devices to be on the same network. So, basically, I could supply my SSL VPN appliance it's very own static (WAN) IP address routing, and yet have it on the same internal network (192.168.1.x) as all my other devices.

The first question is... Does this sound right? Secondly, would you suggest anything different? And, finally, what is the cheapest way to do this? I am started down the road of downloading/installing untangle and smoothwall to see if they will do the job, hoping they take multiple static (WAN) IP addresses.

Thank you in advance for your answers.

-Jessy Houle

5
  • What model routers do you currently have? Depending on what they are ... you might not have to buy anything new.
    – Zypher
    Jan 3, 2010 at 4:42
  • The router for the two Linux machines are really cheap DLinks and the router for the windows, VPN, and wireless is a Linksys hacked to DDWRT. Jan 3, 2010 at 5:13
  • Comletely off topic, but I am curious: Where did you get these nice icons for your network topology drawing from? Jan 3, 2010 at 5:54
  • @Ludwig They look like the stock Visio icons
    – Zypher
    Jan 3, 2010 at 6:20
  • Yes, MS Visio 2010. Jan 3, 2010 at 9:16

3 Answers 3

1

If you simplify your configuration to the following Modem -> DDWRT -> Optional switch if the DDWRT doesn't have enough ports -> Servers/Clients. You should be able to setup you configuration such that the DDWRT router is listening on all of the public IP's and forwarding to the correct host using iptables.

Sorry, I can't give you the exact commands as I don't work with iptables all that much, and do everything but basic host fire walling using Cisco routers/asa's.

Also you will probably get a better answer on SU - they probably use that type of setup more often, so i'm going to vote to have it moved over.

Ask and ye shall receive (From the DDWRT Website)

2
  • If you can give me an URL or high-level direction on how to implement iptables with DDWRT, I will mark this as answered. Thank you. Jan 4, 2010 at 2:26
  • not to knock DD-WRT (I have two Linksys ethernet bridges in my house running it and love it to death), but depending on what sort of performance/reliability you're looking for, you may want to look at upgrading to a real SOHO firewall like a low end Cisco (they can be had pretty cheap from eBay or greymarket/secondhand vendors) or the likes. I frequently find that passing VPN traffic thru other firewalling devices can really be a PITA. Jan 4, 2010 at 5:02
0

Maybe you are already done. Here you find how to do it with DD-WRT:

http://www.techenclave.com/guides-and-tutorials/multiple-public-ips-one-router-using-100375.html

1
  • Excellent link. Thank you. I will probably do do this when I re-do the network again. Jun 16, 2010 at 16:02
0

You can also consider getting a DrayTek 2950 or 2820N Model, they have dual WAN Ports (so you can plugin two physical internet connections)

They can have multiple Public IP Address bound to each Wan Interface, very easy to use and provides tons of features.

www.draytek.us www.draytek.co.uk

http://www.draytek.co.uk/products/vigor2950.html

DrayTek 2950 provides 200+ concurrent vpn connections without any additional vpn CALs.

Hope this helps

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .