4 
 [Internet]
     |
     |
     |---------[ Public Server ]
     |
     |
[ Firewall ]
     |
     |
[Private LAN]

In above Design we have a few public servers. We moved them outside the firewall because they are very high intensity servers, firewall degrading performance and filling connection tables.

Question: Currently if any Private LAN (10.x.x.x) using NATing (one to many) if it wants to talk to Public Server in DMZ.

Does it OK to do NAT on firewall for Public Server or we should configure Routing?

I can add 10.x.x.x route in all Public server to hand off packet to Firewall.

What would be the best design in this case?

Improve this question
5
  • You client is in a private network (10.x.x.x) and the server is in the public internet so there is no choice but to NAT, because private IP cannot be used on the internet. Apart from that I see this not as a question regarding security, even if there is a firewall in your picture.
    – Steffen Ullrich
    Oct 9, 2015 at 20:29
  • Why no choice but to NAT? I can put 10.x.x.x on Outside Server toward firewall for inside traffic. right? Because both inside and outside network directly connected to firewall. for Internet access they can NAT but for Outside Server range they can route. right?
    – Satish
    Oct 9, 2015 at 21:21
  • If the internal server is part of the internal network you might live without NAT. But then the server should be internal behind the firewall. If the server is not internal than it can not have a internal IP address and thus you need NAT. Maybe you might invent some mixed setup were the server is connected to both the internet and the internal net but this would be a nightmare to setup and keep secure.
    – Steffen Ullrich
    Oct 9, 2015 at 22:10
  • 1
    It's possible, depending on your firewall. But I will reiterate that putting your server outside your firewall is a poor design choice. I hope there's no information on it worth stealing, because it will likely be compromised.
    – Ron Trunk
    Oct 9, 2015 at 22:15
  • @RonTrunk you are right those server has no confidential data, its just media server doing high bandwidth streaming, putting them behind firewall killing my firewall performance and customer getting angry. I have DB server behind firewall and that is why i don't want to use NAT when inside server connect to outside server.
    – Satish
    Oct 12, 2015 at 17:05

3 Answers 3

Reset to default
5

First of all, as they mentioned above it is a poor design. No security engineer would consider exposing their servers directly to public without having any defenses (IPS, Firewall DMZ or host based firewalls)...

Still to answer your questions technically,

There is no need to do NAT at the firewall for your public server since you may already have default route towards outside to facilitate the public Internet traffic so this public server IP also would be reachable (or adding a route for this public server will work).

It is fine, if you could add route in the public server for the complete private subnet towards firewall outside to reach internal network (because, it make no sense to route private subnet towards Internet).

With NAT exempt in the firewall, it will work.

BTW, can you share more details on your firewall model, memory & CPU utilization, Interface types, max used connection when you had your public servers traffic through this firewall?

Improve this answer
1
  • Believe me there is a big reason to put server outside firewall, Those servers are streaming server it has nothing secrets, Many time we get DDoS and they filling connection table of firewall and whole network was down. That is why we put those high bandwidth servers outside firewall and DB server inside firewall. Outside server as iptables running on it. by the way Firewall is ASA 5550 4G memory
    – Satish
    Oct 12, 2015 at 17:12
4

You need to get a beefier firewall that can handle the traffic. You really don't want your servers unprotected.

If you do go down the path of your drawing, you would need to get a larger public address allocation from your provider (good luck with that!) since you don't have a device to NAT your servers.

If you need NAT, whatever device you get to NAT may end up with the same problem as your firewall. You should just get a firewall capable of handling your traffic.

Improve this answer
3
  • My question is can we do routing in firewall instead of NAT to reach out my own outside server from inside? currently they are doing NAT but i want them to do routing so outside Server can see original source address
    – Satish
    Oct 9, 2015 at 21:31
  • If the traffic is coming from inside the firewall, you can route it somewhere, but traffic originating from outside the firewall destined to someplace outside the firewall will be ignored by the firewall so it can't route it.
    – Ron Maupin ♦
    Oct 9, 2015 at 21:43
  • 1
    It's possible, depending on your firewall. But I will reiterate that putting your server outside your firewall is a poor design choice. I hope there's no information on it worth stealing, because it will likely be compromised.
    – Ron Trunk
    Oct 9, 2015 at 21:50
4

Place your public servers into a network segment that is being routed on the firewall for security and management reasons.

If you cannot do that due to performance reasons you should consider Host-Based firewall on you public server(s) to have atleast stateful inspection capabilities (iptables, firewalld in case of *NIX).

Having your public servers directly in your public transit network is a poor design choice if you want to access the servers from the clients without NAT. You would have to have routes on the servers to route traffic destined to your internal networks to the firewall otherwise the default route to your ISP gateway would match and ISP will drop the traffic because its RFC1918 address space.

If you only have one server and do not have to scale you may go with the host based firewall and routes on the server option.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.