Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 9 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 6383 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

PPPoE DMZ Bridge.

Chris Burns1

 Hi All.

 

Having a bit of a nightmare getting the XG firewall to operate as my Router/Firewall.

 

I currently have Plusnet as one of my Providers which give me 5 Static IP addresses. Currently, the Cisco RV320 allow me to use one of my IP addresses as the router address (PPPoE assigned btw.) The rest I can send to my DMZ so I can assign the IP addresses directly to the servers. (The servers cannot be NAT assigned and port forwarded without a lot of work).

 

With my current setup, I use access rules to port restrict inbound and outbound to the DMZ servers, despite them having public IP addresses.

On the LAN zone, where my clients live, the Cisco operates just as normal with NATTED subnets. and obviously, firewall protected.

 

 

Example (Not live IP addresses :-) )

-------------------------------------------------------------------------------------------------------------------------

 

Internet(85.45.20.49/29)---->Sophos XG Router(.49)-----DMZ----->.Server(.50)

                                                   |                                               .Server1(.51)

                                                   |                                               .Server2(.52)

                                                   |

                                                   ------------LAN------->PC(192.168.1.2/24)

 

------------------------------------------------------------------------------------------------------------------------------

Now I am assuming I need to set up a bridge between WAN and DMZ, except when I do that I kill the PPPoE connection that my WAN port is using.

 

So my ask is this. Can i simulate the above with SOPHOS? I don't want to assign another public IP address to the DMZ interface as that would mean I would lose two public IP addresses to the one router, and the RV320 currently doesn't need to, so I am hoping I can do the same here.

I did take a long look around the website, but not many people have the same need as me. :-(

 

PS. I know people are going to ask why I need so many IP's, but I do a lot with VOIP and systems/services that are very picky about NAT and IP addresses.

 

Thanks in advance for anyone who can help me solve this pain point.



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    a /29 gives you 8 addresses of which 6 are usable, so you could assign one to your DMZ interface and still have your 5 available for servers.

    Ian

  • 0 in reply to rfcat_vk

    Hi Ian,

    Thanks for the suggestion. I was trying to avoid losing another public IP to the router as that would only leave me 4 left for the servers.

    X.X.X.48/29

    .48 - RESERVERD/UNUSEABLE

    .49 - Router External Interface

    .50 - Router DMZ Interface - ( This is what i am trying to avoid :-( )

    .51 - Server1

    .52 - Server2

    .53 - Server3

    .54 - Server0

    .55 - RESERVED/UNUSABLE

  • 0 in reply to Chris Burns1

    Hi Chris,

    thinking about this, it does not make sense network routing wise. Are you sure your provider didn't give you the /29 for internal use and provide your external link with a /32 or /31 address?

    Ian

  • 0 in reply to rfcat_vk

    Hi Ian.

     

    My thoughts too. I wouldn't know how to set the route table up if we did it like that. Which is why i think the Cisco sets up a bridge between the WAN and DMZ.

     

    Regarding your question, yup. I am sure it is setup that way. The Cisco was clever, by using this option below. (shared WAN/DMZ)

     

    I am glad i am not the only one who is perplexed by this :-)

     

    Thanks for your input.

     

    Chris

  • 0 in reply to Chris Burns1

    Hi Chris,

    you wouldn't need routing tables in the XG just firewall rules without a NAT, but without it being in bridge mode the XG would not handle the same /29 on both sides. I have never played with a bridged XG, but now have a spare and will try it out, trouble is no PPPoE connections anymore, so it would be setup but not tested.

    Ian

     

    If you plug a laptop into the ADSL router and set it up for PPPoE what address do you see assigned?

  • 0 in reply to rfcat_vk

    Hi Ian,

     

    Thanks for trying.. 

     

    I am pulling the XG apart to try and get it to work too. If I can't get it to work I may have to admit defeat and NAT the addresses, but ideally I'd like to try and get it working without NAT..

    If I find a fix I'll let you know.

     

    Chris

Reply
  • 0 in reply to rfcat_vk

    Hi Ian,

     

    Thanks for trying.. 

     

    I am pulling the XG apart to try and get it to work too. If I can't get it to work I may have to admit defeat and NAT the addresses, but ideally I'd like to try and get it working without NAT..

    If I find a fix I'll let you know.

     

    Chris

Children