0

I need some help setting up a Sonicwall NSA 2600. Hoping somebody can help.

I have multiple public IP's assigned to us. The Wan IP is (example) set to 3.3.3.3

I have a server setup with a public IP and no private IP. I'm sure who set it up, but it's an OpenSuse server running asterisk if that helps at all. It's setup with 3.3.3.4

I can't figure out how to get network access to that server.

I tried this link: https://support.software.dell.com/kb/sw8612

But no luck.

Any help is appreciated. Thank you.

2
  • Simple question, do you have management of this server? You just could assign a private address to that server and make a PAT fromo 3.3.3.4 to that private address.
    – KorXo
    Oct 4, 2015 at 9:24
  • I do. Just trying not to mess with the server too much.
    – DanielF
    Oct 4, 2015 at 16:28

1 Answer 1

2

If you have a WAN subnet of, for example, 3.3.3.3/29 then you have a range of WAN IPs from, say, 3.3.3.2 - 3.3.3.6 (let's assume 3.3.3.1 is your default gateway/ISP router).

If your SonicWALL X1 interface is configured to use 3.3.3.3 then you can use the other available IPs to provide NAT to internal IPs (on your X0 interface, or another interface) OR you can provide Transparent IPs to another interface where devices on that Transparent interface will have PUBLIC IPs (like 3.3.3.4).

The SonicWALL KB you linked to is part of the first case: providing external access using (say 3.3.3.3) to some internal IP (say 10.100.0.3) on a LAN (or DMZ) interface. This is OK for services that are NAT friendly, like HTTP. BUt less so for VoIP protocols that are not.

What you want to do is configure an interface in Transparent mode (which is called Splice L3 Subnet in newer SonicOS releases). Have a look at this KB: https://support.software.dell.com/kb/sw5979

Transparent mode is like the device having a Public IP and "sharing" the WAN subnet BUT is still fully protected by the firewall and security services (IPS/Gateway AV, etc) with no NAT to get in the way.

What to do: If you have a server on 3.3.3.4/29 which means it has a Public WAN IP and you want to put it behind the Firewall then you want to configure an interface (say X2) in Transparent / L3 Splice mode and connect it there.

  • Configure your interface (X2) to be in the DMZ zone (or create a new Zone if you are using DMZ on another subnet)
  • Set the IP Assignment to Transparent / Splice L3 mode
  • For the Transparent Range select (or create) an Address Object that contains the IP (3.3.3.4 /29 or whatever your subnet is). You can have a single IP in the range, a range of IPs, or a group of IPs. But they must all be from the WAN (probably X1) subnet.
  • Give it a useful comment, enable Ping so you can ping the WAN IP, and HTTPS if you desire.

Now you can connect your Linux server to that port (X2, or to a switch connected to that port -- you could have several machines in your range, so long as they all have unique IPs within the WAN subnet, like 3.3.3.5 and 3.3.3.6 in our example).

The Default Gateway of the devices in the Transparent Range (X2 in our example) can be EITHER the WAN IP of the SonicWALL (3.3.3.3) OR the Default Gateway of the subnet (what the SonicWALL has as its Default Gateway, 3.3.3.1 in our example).

DNS should be the ISP's DNS servers or some public ones, like Google's.

You will now need to some Firewall rules:

  • Outbound rules (DMZ > WAN) will probably already allow Any/Any/Any which is probably what you want -- unless you want to block some outbound access.
    • If you want to be able to Ping or HTTPS manage your SonicWALL from this Transparent IP you will need to allow the correct rules here.
  • Inbound rules (WAN > DMZ) will need to be created. You will need to create any rules to allow the outside world to access your server, so you might want to create a rule allowing SIP from ANY to your Server (3.3.3.4). Or SSH from "Your External Management IP" to your Server.

  • You will also want some internal rules as well, you probably have full access from LAN > DMZ to allow connecting from your LAN to your Server.

  • But you will likely need some DMZ > LAN rules to allow your Server to connect to your LAN. Such as allowing SMTP from Your Server to your internal mail server (which is maybe 10.100.0.66 on the LAN/X0 interface).

In my experience it can take a few minutes for the Transparent interface to "work" -- so once you configure it and add the rules, try connecting out from the Server to the internet and give the SonicWALL a few mins to update the ARP tables to allow it to work. If it doesn't try changing the gateway on the Server to the SonicWALL's IP. Or test the scenario with a laptop to get a working setup before connecting in your Server.

[Note: L2 Bridge mode is different, that's also Transparent but placing the SonicWALL "inline" more like a switch not a router, if you see that option]

2
  • Dude, this is awesome. Worked perfectly. Thank you.
    – DanielF
    Oct 5, 2015 at 18:09
  • You're welcome, glad it worked out for you!
    – PSaul
    Oct 6, 2015 at 19:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.