This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Confused setting up Astaro LAN <-> WAN

Well I think I'm having a blond moment here. It looks like I am not very smart in configuring and implementing my Astaro Virtual Appliance in to my network. I think I will have to reconsidder some settings and so on.

What is the problem? Well I want to start a new network (Domain and IP-configuration) to replace the current setup.

The current situation is this.
Internet(WAN)  ADSL Modem/Router  Local(LAN)
IP= w.x.y.z  82.x.y.z WAN-side / 192.168.64.64 LAN-side  192.168.64.z
This is a LAN with a few NAT rules implemented in the Router and a small QoS setting running. I have a mail server and a server which host VPN/RDP (which is not very stable at the moment) running localy.

Now I am busy setting up a new server running VMWare ESXi 4.x with an Astaro Virtual, a Win2003/mail/ftp/rdp and a dmz/download system setup. But somthing is not going as planned.
First of all I am confused how to setup the whole IP routing and eth0 and eth1 configuration. I think I am running around in circles and starting to get IP conflicts and wrong routings. My idea is using the router as is, create a new IP-subnet, with the Astaro as main component for security and VPN login (using the Remote Access via IPSec
Configuring ASG and Client).

The setup would in my point of view be something like this:
Internet w.x.y.z  WAN-IP 82.x.y.z / LAN-IP 192.168.64.64 (Draytek Router)  Astaro Firewall + DMZ 192.168.64.254 (routerside) / 192.168.87.254 (newLANside)  LAN 192.168.87.z
But now I am looking at the Astaro and think I am doing something wrong. The eth0 Internal NIC has at this moment the IP 192.168.64.254 and the eth1 External NIC has IP 192.168.87.254. But the GW is at this moment 192.168.64.64. This might be the problem, but I am not having the smart-moment.
The server I set up can connect to the Internet when using an IP in the 192.168.64.z range, but not with the IP 192.168.87.z

I am allready confused by the text above now. I could have a little help.
I have two attachments which show the now used LAN setting of the Router and the settings in Astaro.
NOTE: the settings in te router give a 2nd IP for routing 192.168.0.1 which is NOT used. NAT IP is used.
The manual of the Astaro does not help me that much to get a bit smarter.

This thread was automatically locked due to age.

Parents

0 HMaster over 14 years ago

Before I am going to bridge my router, I prefer to set up Astaro first next to the running routerconfig because there is still a Mailserver and VPN running in my "old" network. Maybe I am doing stupid things, but I try to master the learning curve. :-)

When you take a look at the router-config, should I change the 2nd IP for Routing to an IP like 198.168.64.253/24 ??
So that I put in the External NIC the GW address to 192.168.64.253/24 and set it to Default?
For now, I am setting up an External network with some kind of DMZ like part which my "old" network is running. (correct???)

In the Internal network I have the right thing by using: 192.168.87.254/24 as main IP and not setting any kind of GW IP (blank) for this part? This is what in my thinking is not working? Because it looks like I am not connecting to the "Outside". But when you say it is correct for now I am happy.

I am moving on to the next part. Having a Masquering set like INTERNAL --> EXTERNAL. Feels like too basic to me.
Should I use a Static Bridge setup GATEWAY Route like INTERAL (Network 192.168.87.0) --> EXTERNAL (Gateway 192.168.64.523 (new IP) ??? Or is this wrong?

The Packet-rules come next. With port 80 / 25 / 21 / .... and so on inbound
Same as the part of connecting the Astaro to the Active Directry and DNS/DHCP/forwarders.

I feel myself not very smart though.
Cancel
Vote Up 0 Vote Down

Cancel
0 TheDrew over 14 years ago in reply to HMaster

When you take a look at the router-config, should I change the 2nd IP for Routing to an IP like 198.168.64.253/24 ??
So that I put in the External NIC the GW address to 192.168.64.253/24 and set it to Default?
For now, I am setting up an External network with some kind of DMZ like part which my "old" network is running. (correct???)

As i stated in an earlier reply, your default gateway must be your DSL Modem's IP address otherwise routing will remain broken.

As far as the DMZ, I'm assuming the 'old' network is the 192.168.64.x network? Generally speaking the Astaro needs the DMZ to be a separate network from the external or internal interfaces.

In the Internal network I have the right thing by using: 192.168.87.254/24 as main IP and not setting any kind of GW IP (blank) for this part? This is what in my thinking is not working? Because it looks like I am not connecting to the "Outside". But when you say it is correct for now I am happy.

Generally speaking the default gateway should always be on the external side, in this case your DSL Modem/Router. So far so good.

I am moving on to the next part. Having a Masquering set like INTERNAL --> EXTERNAL. Feels like too basic to me.
Should I use a Static Bridge setup GATEWAY Route like INTERAL (Network 192.168.87.0) --> EXTERNAL (Gateway 192.168.64.523 (new IP) ??? Or is this wrong?

It's as easy as the first part. [:)]

The Packet-rules come next. With port 80 / 25 / 21 / .... and so on inbound
Same as the part of connecting the Astaro to the Active Directry and DNS/DHCP/forwarders.

Packet filter rules here will depend on what IP address's those servers use. I assume the DSL modem was doing port forwarding of specific ports in the old setup?

If the servers are still on that 192.168.64.x network then Astaro can't really protect them as it won't even see the traffic. If however they are on the 192.168.87.x (internal) network, then you need to setup specific Destination NAT (DNAT) rules for each port/service you want.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 TheDrew over 14 years ago in reply to HMaster

When you take a look at the router-config, should I change the 2nd IP for Routing to an IP like 198.168.64.253/24 ??
So that I put in the External NIC the GW address to 192.168.64.253/24 and set it to Default?
For now, I am setting up an External network with some kind of DMZ like part which my "old" network is running. (correct???)

As i stated in an earlier reply, your default gateway must be your DSL Modem's IP address otherwise routing will remain broken.

As far as the DMZ, I'm assuming the 'old' network is the 192.168.64.x network? Generally speaking the Astaro needs the DMZ to be a separate network from the external or internal interfaces.

In the Internal network I have the right thing by using: 192.168.87.254/24 as main IP and not setting any kind of GW IP (blank) for this part? This is what in my thinking is not working? Because it looks like I am not connecting to the "Outside". But when you say it is correct for now I am happy.

Generally speaking the default gateway should always be on the external side, in this case your DSL Modem/Router. So far so good.

I am moving on to the next part. Having a Masquering set like INTERNAL --> EXTERNAL. Feels like too basic to me.
Should I use a Static Bridge setup GATEWAY Route like INTERAL (Network 192.168.87.0) --> EXTERNAL (Gateway 192.168.64.523 (new IP) ??? Or is this wrong?

It's as easy as the first part. [:)]

The Packet-rules come next. With port 80 / 25 / 21 / .... and so on inbound
Same as the part of connecting the Astaro to the Active Directry and DNS/DHCP/forwarders.

Packet filter rules here will depend on what IP address's those servers use. I assume the DSL modem was doing port forwarding of specific ports in the old setup?

If the servers are still on that 192.168.64.x network then Astaro can't really protect them as it won't even see the traffic. If however they are on the 192.168.87.x (internal) network, then you need to setup specific Destination NAT (DNAT) rules for each port/service you want.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data