0

In short

Is it possible to have two seperate networks (seperated by IP addresses and subnet) under one gateway + firewall that is within IP and subnet configuration is on network #1 and still filter inbounding/outbounding traffic to/from network #2?

Details

Gateway + Firewall (m0n0wall software) has internal address 192.168.0.100 with subnet 255.255.255.0

  • Computers have addresses 192.168.0.x with same subnet /24
  • Some devices, are on 192.168.1.x with subnet /24

Internally, from computer with address 192.168.1.Y i can access device, ofcourse.

Question is - is it possible to forward some ports from external IP (out of office) to device with IP 192.168.1.X? Will it work if firewall is on "different network"?

So far i have

  • Forwarded port 443 to 192.168.1.X:443
  • Set up firewall rule to fully trust all ports inbound & outbound to my external IP address.

While trying to connect to Office external IP, port 443

  • In browser i get ERR_TIMED_OUT
  • In office firewall logfile i see that Out of office external IP, port 1560 allowed to 192.168.1.104, port 443 TCP
  • Sometimes I also see Out of office external IP, port 1560 denied to Office external IP, port 443 TCP
  • I don't see any answer from 192.168.1.X in logfile.

If i map 443 to address 192.168.0.X, everything is OK.

What is the problem and how to solve this please?

My suspect is that firewall is not on same subnet. What if i lower subnet number to 255.255.0.0 for firewall to include both networks - will it not break the whole network?

3 Answers 3

1

Internally, from computer with address 192.168.1.Y i can access device, ofcourse.

You haven't given us enough detail:

You have two separate logical networks

  • 192.168.0.0/24
  • 192.168.1.0/24

Your firewall lives in 192.168.0.100. This means that 192.168.1.0 cannot communicate with your firewall without some other part of the picture that I've missed. How does 192.168.1.0/24 communicate with your firewall? Your must either have:

  • a secondary interface on the m0n0wall which also has an address on 192.168.1.0
  • a router in between the two networks
  • have a network bridge or some device doing NAT between the two networks

You'll need to fill us in on what part of the puzzle we're missing here.

7
  • Well, i think that's the problem as 192.168.1.0/24 is not able to communicate with firewall.... right now we access device internally, but we need remote access. Nov 18, 2009 at 14:51
  • The question remains - is there a solution, like set FW subnet to /18 ? Will it not break existing NAt configuration (port forwarding, firewall rules), allowing existing computers within 192.168.0.0/24 to communicate to internet? Nov 18, 2009 at 14:53
  • I'm assuming you're able to access the second subnet internally through a router or layer 3 sitch, correct? Then tell the firewall to use the router or layer 3 switch to get to 192.168.1.0.
    – joeqwerty
    Nov 18, 2009 at 15:00
  • No, I can't access that subnet internally. (Without setting IP like 192.168.1.X). Gateway/firewall is the very first entrance point from the internet (it has assigned public IP address). But internal address is 192.168.0.100. Nov 18, 2009 at 15:05
  • This doesn't make sense. How does a host on 192.168.0.0 get to a host on 192.168.1.0? Through a router or layer 3 switch, right? Is there a physical connection (router or layer 3 switch) between the subnets? If so, then that's how the firewall should get to the other subnet. If there isn't then you'll need to use another interface on the firewall (if it has one) and connect it to the other subnet. If the firewall doesn't have another interface and there's no router or layer 3 switch between the subnets then it's not possible as the traffic can not pass through the air from one to another.
    – joeqwerty
    Nov 18, 2009 at 15:14
0

In short: yes.

Details: please show the output of iptables -L -n, iptables -L -n -t nat, ip route show, and ip addr list.

0

In most cases you need to tell the firewall that you have additional or secondary networks behind it, in addition to the network it's directly attached to. The firewall will also need to know how to route packets to this secondary network as it's on another subnet. You also need to have NAT set up to translate one of your available public ip addresses to the internal address of the server in question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .