• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

How to implement Static Routing with Dual Layer Firewalls?

Scheduled Pinned Locked Moved NAT
4 Posts 2 Posters 460 Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M
    MrPatrick
    last edited by Jan 2, 2021, 1:02 AM

    Welcome All,
    Although I have a lot of experience with computers, networking with static routes through devices I am fairly weak with. Due to requirements, there are two firewalls in use, an outer and an inner. Static routes are to be used. I do have the understanding of placing a signal static route through one firewall, but not with two, along with a DMZ.

    Using example IPs:
    IP from the Outside: 100.100.100.99
    IP for Internal Network Switch: 192.168.1.72
    A Server separate from the Switch: 172.20.1.2

    Outer Firewall:
    WAN (Facing to Outside): 100.100.100.100
    LAN (Facing to Inner FW): 10.10.10.1

    Inner Firewall:
    WAN (Facing the Outer FW LAN): 10.10.10.2
    LAN1 (Facing the internal Network): 192.168.1.73
    LAN2 (Facing the internal Server): 172.20.1.1

    DMZ:
    IP: 10.10.10.3

    Thus:

    1. The route would be from the Outside IP to the Outer Firewall WAN,
    2. Which goes to the Outer Firewall LAN, which goes to both the DMZ and Inner Firewall WAN
    3. With the Inner Firewall, uses both LAN1 and LAN2:
      --- LAN1 to the Network Switch
      --- LAN2 to the Internal Server
    4. And of course reverse direction

    Normally, with just one firewall and the network switch, would be to disable NAT and then apply the Static Route from the WAN and LAN sides, but I am not certain how to does in such a complex manner as above.

    N 1 Reply Last reply Jan 2, 2021, 10:53 AM Reply Quote 0
    • N
      NogBadTheBad @MrPatrick
      last edited by NogBadTheBad Jan 2, 2021, 10:58 AM Jan 2, 2021, 10:53 AM

      @mrpatrick

      On your outer firewall define your routes for your inner firewall subnets pointing to 10.10.10.2

      On your inner firewall disable outbound nat and set the default route to 10.10.10.1

      If you're feeling brave install ffr and set up OSPF between the two devices, this would be preferable if there are loads of subnets behind your inner firewall.

      Screenshot 2021-01-02 at 10.51.15.png

      Andy

      1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

      M 1 Reply Last reply Jan 3, 2021, 12:54 AM Reply Quote 1
      • M
        MrPatrick @NogBadTheBad
        last edited by Jan 3, 2021, 12:54 AM

        @nogbadthebad
        Thanks for the reply and insight.
        Question, would the Outter FW have its NAT disabled as well?
        Will put this into tests on Monday and post of the outcomes.

        N 1 Reply Last reply Jan 3, 2021, 8:36 AM Reply Quote 0
        • N
          NogBadTheBad @MrPatrick
          last edited by Jan 3, 2021, 8:36 AM

          @mrpatrick

          If the outer firewall connects to the internet it would need to NAT local addresses.

          Andy

          1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

          1 Reply Last reply Reply Quote 0
          1 out of 4
          • First post
            1/4
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
            This community forum collects and processes your personal information.
            consent.not_received