1

I want to accomplish network shown in image. network image

1.Local can access servers

2.internet can access servers with limited ports and cannot connect to local network

3.I have only 1 public static ip so i cannot place firewall between router and isp

  1. My firewall is small so I couldn't able to use firewall as my main network gateway

The question is firewall's traffic will be same as gateway or the small firewall can handle it as shown in image?

Is there other good solution?

Can i do it with only router?

Improve this question
4
  • Your diagram has your router and local network unprotected by your firewall. That would be a foolish thing to do. I am confused because your firewall could be set up as a transparent firewall where it doesn't use a public IP address.
    – Ron Maupin ♦
    Commented Aug 20, 2017 at 13:23
  • @RonMaupin thanks for reply, Yes, I was planning firewall in front at first, but firewall device is very small and couldn't handle ~100 users and ~10 servers traffic. So, I wanted to filter only servers' connections by place firewall transparently between router and servers.
    – Bagi
    Commented Aug 21, 2017 at 5:12
  • But you leave your router and users vulnerable to compromise, and if the users have access to the servers, then the servers can be compromised from a a compromised user. You really need to rethink this design.
    – Ron Maupin ♦
    Commented Aug 21, 2017 at 6:08
  • I have talked to my ISP about increase public IP and they said it is possible. So, can I accomplish with the image? I think firewall will only take external traffic, is it right?
    – Bagi
    Commented Aug 21, 2017 at 6:37

3 Answers 3

Reset to default
1

the size of traffic and number of connections made:
- from local users to servers and vise versa.
- from internet users to servers and servers response.
will determine so far if your firewall is small or big enough to handle them all, so if you are sure that your firewall is smaller than enough, you don't have to install it to meet those few conditions.
- regarding to Local can access servers once you configure interfaces with suitable IPs it will be done.
- regarding to internet can access servers with limited ports and cannot connect to local network you can publish them via NAT configurations on the router with port number as desired and ACL will handle the access rights as well.

please make use of this example enter image description here

Improve this answer
2
  • @Gadeliowthanks for great advice. Could you please give me example(I never worked on cisco before. So, basic configuration example would be nice). I think this firewall is odd in here as you said. My goal is protect local network from outside and narrow server incoming ports. So, it would be very clean and straight if I can do it only with my cisco 2921.
    – Bagi
    Commented Aug 21, 2017 at 5:16
  • i'll edit my answer soon, to prepare this example
    – Gadeliow
    Commented Aug 21, 2017 at 9:06
1

Whether or not your firewall can handle the traffic depends on its capabilites and the amount of traffic. Since you tell us neither, nobody will be able to answer this question.

From you diagram, you're passing local traffic through router and firewall. If you're not sure of their capabilities, it might be a bottleneck.

Your firewall needs to be adequately sized. You might want to connect local and server networks with more bandwidth - either just with a (layer 2) switch or a fast router/layer 3 switch.

Improve this answer
1

Plug your internet into the same firewall. Then you can have ACLs for your servers, hosts and internet if you want to use the firewall that way. We plug lots of networks into firewalls for some customers. Some firewalls record traffic patterns much better than a router. If someone tries to access the financial server from inside the network you'll have record of it for example. (if you have a capable firewall)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.