topic Server with public IP behind the firewall without Natting in General Topics

Server with public IP behind the firewall without Natting

MP18 — Fri, 22 Mar 2019 00:05:34 GMT

We need to have a 1 server behind the firewall with public ip address.

We do not want private ip on the server.

Firewall - outside zone

Server is behind the DMZ_Zone.

Currently DMZ has sub interface with private ip address

so when traffic comes from internet it will hit he firewall and hit should redirect that to DMZ zone where server has public ip address.

For NAT rule i can do source and destination zone as outside

Source address any and Dest has server public ip address and no natting.

For security rule same ips but dest will be dmz zone.

Will this setup work?

Re: Server with public IP behind the firewall without Natting

reaper — Fri, 22 Mar 2019 09:54:44 GMT

You first need to consider the firewall as a router

It knows that x.x.x.x/x is on the untrust interface and it knows that a.a.a.a/a is on the DMZ interface

If you add a server with ip x.x.x.z to the a.a.a.a/24 network, the firewall will not be able to route to it as it's routing table will demand the packets be sent to the x.x.x.x/x interface

Your server will also not be able to communicate with any of the other servers in the DMZ, because they too know to send x.x.x.x/x to the firewall instead of an adjacent device (default route and broadcast domain)

There are 2 solutions that I can think of (well, 3, but NAT is not an option)

1. put the server behind a vwire that is connected to the outside router. That way your server is 'on the outside' but still protected by the vwire

2. create layer2 interfaces and add the server to the same vlan as the untrust interface, make sure to enable intrazone security profiles

3. NAT 😛

Re: Server with public IP behind the firewall without Natting

jeremy.larsen — Fri, 22 Mar 2019 15:11:13 GMT

4. Put this server in it's own vlan/subnet. Either use a separate physical interface for it or add a subinterface on the same port as your current DMZ zone. Attach this interface to the applicable vRouter and add static or dynamic routing.

Re: Server with public IP behind the firewall without Natting

MP18 — Sun, 24 Mar 2019 22:44:35 GMT

MAny Thanks Reaper for answering the Question.

Best Regards

Mike