Welcome to the Sophos User Bulletin Board.
If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Reply
 
LinkBack Thread Tools Display Modes
ScottG's Avatar
Senior Member
Join Date: Mar 2007
Location: New Jersey
Posts: 189
#1 (permalink)  
Old 04-01-2009, 01:11 AM
Default Setup WiFi DMZ

I want to setup a DMZ on my 3rd NIC port. I need to have a wifi DMZ for my TiVo to connect to the internet. I had this working okay by plugging my linksys wifi into the astaro DMZ port and I setup DHCP on Astaro. DHCP was disabled on the linksys. The problem with this setup is my kid's friends would come over with their iTouch and other toys and automatically connect to the DMZ and use up my 10 Astaro licenses. To get around this, I turned off DHCP on the astaro and turned it on in the linksys, but I can't get it to work. Here's my setup:

Interface: External WAN - goes to my cable modem
Type: Cable Modem (DHCP)

Interface: Internal (my main home LAN and works great)
Type: Ethernet Standard
Address: 192.168.116.6
Default GW: unchecked
Default GW IP: 0.0.0.0

Interface: DMZ1 (this is the one I am trying to get working)
Type: Ethernet Standard
Address: 192.168.117.1
Default GW: unchecked
Default GW IP: 0.0.0.0

Astaro DHCP on DMZ1
Range Start: 192.168.117.2
Range End: 192.168.117.2
DNS Server 1: 192.168.117.1
Default GW: 192.168.117.1
Wins Type: B-Node

I set this DHCP up in Astaro with a range of 1 because the linksys assumes the "router" is going to give it an IP. Just like it would if the Linksys was connected to a cable modem. I don't know if this is the right approach.

I have a cable going from the Astaro DMZ port to the Linksys Internet port.
Assigned Linksys IP: 192.168.117.7
On the Linksys I have DHCP enabled: 192.168.117.10 - 192.168.117.20

The linksys is getting the IP 192.168.117.2 (which normally would be a WAN IP) and default gateway from Astaro, but I can't connect to the internet. I tried changing the default gateway in the DMZ1 from 192.168.117.1 to 192.168.116.6 (same as the other interface), but this didn't work. I don't even know if you can jump across subnets like this.

What am I doing wrong?
Reply With Quote
Moderator
Join Date: Jul 2001
Location: southern California
Posts: 12,063
#2 (permalink)  
Old 04-01-2009, 08:37 PM
Default

Did you setup a Masquerading rule on firewall for the DMZ?
e.g. DMZ->EXTERNAL

And packetfilter rules to allow traffic out?

Barry
__________________
http://BlogSec.net
http://JobOyster.com
http://DealBert.net
IT Consultant specializing in high-performance Web Infrastructure and Security.
Astaro End-user since v1.x
  • ASL 9.2x, HP DL360G5 - FW, IPS, VPNs
  • ASL 9.2x, 2 Dell 1950's as WAF/proxy w HA
  • UTM 9.1x, Atom n270, 2GB RAM, 2 Intel GigE
    Netgear GS108T gigE switch & Astaro AP30 Access Point with 4 VLANs.
    60/60mbit FiOS internet.
  • Pending - UTM 9.2x, i5-4670, 4GB RAM, 2 Intel GigE
    Needs new NIC drivers before deploying
Reply With Quote
ScottG's Avatar
Senior Member
Join Date: Mar 2007
Location: New Jersey
Posts: 189
#3 (permalink)  
Old 04-01-2009, 10:07 PM
Default

Yes, I have two rules. First isolates DMZ from my LAN, 2nd lets DMZ out to the internet

Deny: DMZ1 (Network) > ANY > Internal (Network)
Allow: DMZ1 (Network) > Any > Any
Reply With Quote
Moderator
Join Date: Jul 2001
Location: southern California
Posts: 12,063
#4 (permalink)  
Old 04-02-2009, 12:07 AM
Default

And masquerading?

Can you ping the firewall from the WiFi LAN?

Barry
__________________
http://BlogSec.net
http://JobOyster.com
http://DealBert.net
IT Consultant specializing in high-performance Web Infrastructure and Security.
Astaro End-user since v1.x
  • ASL 9.2x, HP DL360G5 - FW, IPS, VPNs
  • ASL 9.2x, 2 Dell 1950's as WAF/proxy w HA
  • UTM 9.1x, Atom n270, 2GB RAM, 2 Intel GigE
    Netgear GS108T gigE switch & Astaro AP30 Access Point with 4 VLANs.
    60/60mbit FiOS internet.
  • Pending - UTM 9.2x, i5-4670, 4GB RAM, 2 Intel GigE
    Needs new NIC drivers before deploying
Reply With Quote
ScottG's Avatar
Senior Member
Join Date: Mar 2007
Location: New Jersey
Posts: 189
#5 (permalink)  
Old 04-02-2009, 01:17 AM
Default

I don't think my firewall responds to ping. I tried to ping the firewall from my main computer on the LAN subnet (192.168.116.***) and it doesn't respond.

I know the firewall is communicating with the Linksys wifi because the linksys is pulling an IP (192.168.117.2) from Astaro. And in astaro the linksys is showing up in the DHCP lease table.


--Scott
Reply With Quote
Moderator
Join Date: Jul 2001
Location: southern California
Posts: 12,063
#6 (permalink)  
Old 04-02-2009, 05:34 AM
Default

You can set the firewall's ping/icmp settings under the PacketFilter - ICMP page.

Barry
__________________
http://BlogSec.net
http://JobOyster.com
http://DealBert.net
IT Consultant specializing in high-performance Web Infrastructure and Security.
Astaro End-user since v1.x
  • ASL 9.2x, HP DL360G5 - FW, IPS, VPNs
  • ASL 9.2x, 2 Dell 1950's as WAF/proxy w HA
  • UTM 9.1x, Atom n270, 2GB RAM, 2 Intel GigE
    Netgear GS108T gigE switch & Astaro AP30 Access Point with 4 VLANs.
    60/60mbit FiOS internet.
  • Pending - UTM 9.2x, i5-4670, 4GB RAM, 2 Intel GigE
    Needs new NIC drivers before deploying
Reply With Quote
ScottG's Avatar
Senior Member
Join Date: Mar 2007
Location: New Jersey
Posts: 189
#7 (permalink)  
Old 04-02-2009, 10:42 AM
Default

I enabled pinging on the firewall. I am able to ping astaro from a computer connected to the linksys wifi.

masquerading:
Internal (network) > External (WAN)
DMZ1 (network) > External (WAN)
Reply With Quote
BAlfson's Avatar
Grandis Professorem Astaro
Join Date: Mar 2007
Location: Oklahoma City
Posts: 20,852
#8 (permalink)  
Old 04-02-2009, 01:00 PM
Default

It doesn't seem like you need the routing capabilty of the Linksys, so you might try putting it into WAP mode and doing DHCP from the Astaro for the wireless clients.

Cheers - Bob
__________________
ACE V7 - Astaro Preferred Partner since V3
SCA/UTM - Sophos Gold Solution Partner
www.MediaSoftUSA.com
Addicted to my iPhone!
Reply With Quote
Moderator
Join Date: Jul 2001
Location: southern California
Posts: 12,063
#9 (permalink)  
Old 04-02-2009, 03:55 PM
Default

a. Try a traceroute from wifi to an IP, like 4.2.2.1
b. If that works, then try traceroute google.com
If a works, but not b, you probably have a DNS problem.

Barry
__________________
http://BlogSec.net
http://JobOyster.com
http://DealBert.net
IT Consultant specializing in high-performance Web Infrastructure and Security.
Astaro End-user since v1.x
  • ASL 9.2x, HP DL360G5 - FW, IPS, VPNs
  • ASL 9.2x, 2 Dell 1950's as WAF/proxy w HA
  • UTM 9.1x, Atom n270, 2GB RAM, 2 Intel GigE
    Netgear GS108T gigE switch & Astaro AP30 Access Point with 4 VLANs.
    60/60mbit FiOS internet.
  • Pending - UTM 9.2x, i5-4670, 4GB RAM, 2 Intel GigE
    Needs new NIC drivers before deploying

Last edited by BarryG; 04-02-2009 at 03:59 PM.
Reply With Quote
Moderator
Join Date: Jul 2001
Location: southern California
Posts: 12,063
#10 (permalink)  
Old 04-02-2009, 04:00 PM
Default

Bob, he's NATing on the router for a reason, explained in post #1.


Barry
__________________
http://BlogSec.net
http://JobOyster.com
http://DealBert.net
IT Consultant specializing in high-performance Web Infrastructure and Security.
Astaro End-user since v1.x
  • ASL 9.2x, HP DL360G5 - FW, IPS, VPNs
  • ASL 9.2x, 2 Dell 1950's as WAF/proxy w HA
  • UTM 9.1x, Atom n270, 2GB RAM, 2 Intel GigE
    Netgear GS108T gigE switch & Astaro AP30 Access Point with 4 VLANs.
    60/60mbit FiOS internet.
  • Pending - UTM 9.2x, i5-4670, 4GB RAM, 2 Intel GigE
    Needs new NIC drivers before deploying
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT. The time now is 10:05 AM.


Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2015, Jelsoft Enterprises Ltd.

These pages are specifically maintained for the discussion of firewall issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases.