This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Need help to configure a Class C network

Hi folks.
So much to learn, so little time.

I'm hoping to replace a SonicWall with Astaro. We have a full class C coming to us via a Cisco Router/T1 (.254).

We have been running everything with a netmask of 255.255.255.0 and relied on the SonicWall to distribute between LAN and DMZ.

Now to Astaro: I have internal configured as .33 with a netmask of 255.255.255.224. A PC has IP of .34 with a gw of .33

The external I've tried at .1 and .251 with netmasks of 224 and 240. A netmask of 255.255.255.0 it won't accept.

Where I'm getting lost is just where on the class C I should I be putting the FW PC and what netmask(s) to use. I'm trying to tests this out with a rather small subnet so as not to disturb existing.

I did manage to ping a PC on the external side, but not the gateway (.254).

I got this far by the example in the FAQ's, which are a great help. Going to take a fresh crack at in AM but thought I'd ask in the meantime in case I'm totally off the deep end.

What I want to achieve is to have a DNS server (.253) outside the firewall, I.e. directly on the router (via a hub) and room for 30 PC's on the LAN (internal) and the rest of the IP's are to be used on several web servers which I plan to put in a DMZ on a 3rd NIC along with our email server.

While I'm tesing the scheme I'm hoping to use Proxy ARP as needed as I don't want to bug the ISP until I have total plan in hand.

Thanks in advance for any light you may be able to provide.

Heinz

This thread was automatically locked due to age.

Parents

0 ollion over 23 years ago

Heinz,

do you need your official addresses in your LAN?
For security reason I would assign private addresses.
To have a DNS server in front of the firewall isn't
a good idea.

I would assign aliases to the firewall's external
interface and then use the DNAT feature. Your
public servers could be in a DMZ using private
addresses as well.

regards
ollion
Cancel
Vote Up 0 Vote Down

Cancel
0 Heinz Wittenbecher over 23 years ago in reply to ollion

I want my users to have direct Telnet/Ftp access to several machines behind the firewall. The users IP's are static so we will be adding them into the rules as allow. In reading more I believe I can do an external-IP/23 --> internal-IP/23 map for each Telnet server.

Still has me stumped a little re the routing, would I just alias all external IP's to the external NIC?

The reason I wanted the DNS outside the firewall was to have one IP between the Cisco router/T1 and our own equipment so that I have a good dividing line between our equipment and the ISP's for monitoring but perhaps I can achieve same by using the Astaro/FW PC.

Re the aliasing of the external interface, can it handle the whole class C? I seem to recall that there was a limitation. More reading :-)

Hoping to give it the acid test tomorrow.

Heinz
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Heinz Wittenbecher over 23 years ago in reply to ollion

I want my users to have direct Telnet/Ftp access to several machines behind the firewall. The users IP's are static so we will be adding them into the rules as allow. In reading more I believe I can do an external-IP/23 --> internal-IP/23 map for each Telnet server.

Still has me stumped a little re the routing, would I just alias all external IP's to the external NIC?

The reason I wanted the DNS outside the firewall was to have one IP between the Cisco router/T1 and our own equipment so that I have a good dividing line between our equipment and the ISP's for monitoring but perhaps I can achieve same by using the Astaro/FW PC.

Re the aliasing of the external interface, can it handle the whole class C? I seem to recall that there was a limitation. More reading :-)

Hoping to give it the acid test tomorrow.

Heinz
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data