DMZ Firewall Solution for the Express Router
4 DMZ Multiple IP Address Solution
This solution explains how to set up a DMZ when the ISP supplies you with multiple IP addresses. In the example, the ISP has assigned the site a range of IP addresses: 193.84.251.0 to 193.84.251.7 (subnet mask 255.255.255.248).
|
|
| HTTP/FTP |
|
|
|
|
|
| ||
HTTP/FTP | proxy | SMTP | News | ||||||||
server | server | server | server | ||||||||
193.84.251.1 | 193.84.251.2 | 193.84.251.3 | 193.84.251.4 | ||||||||
|
|
|
|
|
|
|
|
|
|
|
|
DNS
server
194.25.6.4
News
(NNTP)
server
196.24.5.8
DMZ
193.84.251.0 |
|
|
|
|
|
| |
|
|
| server |
| LAN2 port | 89.20.0.1 | |
|
| ||
| 193.84.251.5 | News | |
|
|
| |
|
|
| server |
| Intel Express | LAN1 port | 89.20.0.2 |
| 89.20.0.10 |
| |
Internet | Router | Layer 3 switch | |
|
|
| |
|
|
| 10/100 |
|
| Secure LAN | Users |
|
| 89.20.0.0 | Secure LAN |
|
|
| 90.20.0.0 |
Note: The services available on the DMZ can be placed on a single server. If this is done, you must configure NAT accordingly.
The solution does not configure NAT on the WAN interface (connection to the Internet). This eliminates problems with protocols that are not supported by the router’s NAT implementation.
4.1IP Address Assignment
The servers on the DMZ network have been assigned official public IP addresses. NAT is not required for these addresses. The secure private LAN consists of two networks, 89.20.0.0 and 90.2.0.0, which are official public IP addresses. You must use NAT to translate these addresses to private IP addresses.
Note: The first and last IP address in the range provided by the ISP must not be used for devices. The WAN connection to the Internet must be configured as unnumbered.
4.2Static Routing Setup
Configure static routing as follows:
∙Configure static routing on the Internet connection, LAN1, and LAN2. This is done in Advanced Setup by setting the Routing Protocol parameter to None/Static.
∙Define a static route on the WAN interface to the Internet. Use the default static route setting (network address of 0.0.0.0 and network address of 0.0.0.0) as shown in the example below.
Version 1.0 | 17 |
