1

We have a leased line which has 8 public IP addresses. This connects to our Draytek 2860 router.

From here we have an internal network which we use for our office computers and another network for our datacentre (which hosts a few customer servers).

We have installed a pfsense firewall which we'd like to use to manage NAT and routing for the datacentre

I would like to create a web server in our datacentre, behind the pfsense firewall on one of the free public static IP addresses I have been assigned. How do I configure this?

I'm thinking I should set up DMZ's for all the IP's I'd like to use within the datacentre on the draytek, then set it up as a 1:1 NAT on my pfsense, but not sure.

I need all outgoing traffic on my internal network, datacentre network and webserver to come from their own dedicated public IP addresses

user1711657
  • 13
  • 2
  • Between the LANs and your WAN, are you doing NAT or Routing on your Draytek? Similarly, are you planning to use pfsense as NAT or Routing? If you're not sure what I mean, consider the path from your webserver in your datacentre to the outside world, and ask how many NAT gateways will traffic pass through? – roaima May 31 '18 at 22:21
  • I need to use NAT on the draytek for my office network, I also need NAT for the webserver and datacenter network. But I dont want to double NAT the webserver and datacenter, which is why I was thinking I should set up a DMZ to the pfsense firewall, then NAT it from there to the webserver / datacenter – user1711657 May 31 '18 at 23:53

1 Answers1

0

You really shouldn't put a public-facing webserver behind even one NAT (a busy webserver is a really quick way to fill up the NAT connections table).

If you're using the Draytek in NAT mode rather than Routing mode, its DMZ feature is really a 1:1 NAT mapping from one of your public IP addresses to a specific internal IP address.

I don't have enough detail of your specific requirements, but assuming a technical solution would be acceptable this is possibly how I would approach the problem.

               +---------+       +---------+       +------------+
               |         | <===> | pfSense | <===> | Datacentre |
               |         |       +---------+       +------------+
               #         |
Internet <===> # Draytek |       +----------------+
               #         | <===> |                |
               |         | <===> | Office network |
               |         | <===> |                |
               +---------+       +----------------+

I've used # to denote the NAT boundary.

  1. Set up a separate LAN on the Draytek for the Datacentre.
  2. Use the pfSense firewall in Routing or Transparent mode rather than NAT (I'm not familiar with pfSense specifically, but I assume this is possible).
  3. Have the Draytek manage routing between the Datacentre and Office network, using its internal firewall as appropriate.
  4. Punch as many of the public IPs as necessary through to the Datacentre LAN, either with specific Port Forwarding or as a DMZ host.

If I've misinterpreted your network topology, please do update your question with a suitable schematic. For example, you might mean your leased line terminates on the Draytek and on pfSense, so they're "side by side". But I didn't think that's what you meant.

roaima
  • 1,567
  • 13
  • 26