Software

Ask something
Discussion Locked

Firewall Configuration?

0 helpful
5 replies

by Former member

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I just purchased a soho3 and intend on intergrating it with my single 2000 server (No web or mail servers). Currently, one NIC is connected to the router for my WAN, and the other NIC is connected to my switch for my LAN. I am using the server as arouter to serve my clients since I'm only using one static IP.

My question?

Should I be placing my firewall between my server and my router? How should I configure the firewall? Everywhere I read the firewall is running from the router to the switch, not the server. But since my server is acting as a router, this can't be the case..... I'm lost to as how I should assign static WAN IPs...

Any suggestions would be great!

Thanks in advance....
Chaz

5 replies

by cg it

First, your router probably has it's own onboard firewall that you can use as one layer of security from the internet to your network. Also, I suggest using ISA server (takes the place of proxy server 2.0) as another layer of security which when installs uses filters to secure your internal network from the internet. Configuring a firewall should be done by the firewall mfg manual. Most firewall defalut values are of denying access therefore following the mfg's instructions necessary. Placementof a firewall for your small office/home office assuming you use cable or DSL modem for your internet connection would be between the external server connection and the internal server connection. Assigning static IP address for Wide Area Network ports doesn't see to be productive. W2K Server has IIS management that allows you to configure your external and internal connectors (pick which nic card is used). Run that IIS wizard to set up your connections. for TCP/IP routing for outbound connections, you can run a connection wizard which allows you to use a 3 rd party router (non server routing) as your gateway. for more information, see Microsoft Internet Security and Acceleration Server 2000, IIS management.

by cg it

ok. A simple physical setup for a SOHO Windows 2000 Small Business server with DNS, DHCP running, X # of clients, each client sharing internet access connections via a DSL modem would be to have two NIC's on the server (one used as external connection, one for the internal[clients]connection[use a switch for the clients rather than a hub]. DHCP will assign an IP address to both cards. Run IIS manage connections wizard to secure the reservation of DHCP assigned addresses for the two NIC's. As far as using the server for a router, discard that and instead use a 3rd party router between the DSL modem and the external connection on the server. The DSL modem ethernet cable will attach to the WAN port on the router, the cable from the external connection of the server will attach to the LAN port on the router. For clients, the cable for the internal connection on the server will attach to the WAN port on the switch and clients cabling will attach to the LAN ports on the switch. With large #'s of clients, you'll have to hub em into groups with the hub connecting to the switch on the LAN side. A firewall would be situated between the router and the the external connection of the server with filters allowing outbound traffic. The router's IP [usually default set by the mfg to 192.168.2.1] is considered the gateway for the external server connection. The external connection IP address is the gateway for client internet access. [ISA server handles this very well for a DHCP type of IP addressing scheme] [static routing for a somewhat medium # of clients is a nightmare and one is better off letting DHCP assign IP addresses] If your using RRAS, DHCP can not be used as RRAS assigns IP addresses to clients. A way to map this out is tosit down with a piece of paper and diagram the directional flow from clients up to your ISP and then back. Assign IP addresses (static to each node, then in the NIC properties assi

by Former member

A few more detials....

My router can't be configured with NAT nor does it offer firewall, so at the time I used the first static for my first nic on my server (WAN). Then I configured my second NIC for the LAN, thus my server is acting as a router utilizing DHCP to server the stations. BTW, I have more stations than statics, thus not a single static for each station. Also, there is no proxy software involved. So my WAN gateway is X.X.X.225 and the first static route (X.X.X.226)is used on the 1st NIC on my server. If my Firewall is put in line between my router and server, how do I need to configure the firewall for resolution on my WAN NIC? Do I need to create a static route on the firewall? The instruction from sonicwall are vague. Or should I use 1-to-1 NAT to point X.X.X.226 (a static IP of the router through the firewall to the 1st server NIC?

Does this even make sense?

I have not yet called sonicwall, but I will be on Monday....

Thanks,
Chaz

This discussion is closed to new replies.