1

My firewall, an iptables Linux box only has one Ethernet port.

My network topology is pretty simple and looks something like this:

ISP (Port Gi 1/1) -> Switch <-Firewall on Port Gi 1/2
                       ^
                       |
        Other devices Gi 1/3 - Gi 1/48

On my firewall the eth0 interface can have both a DHCP address (from ISP) and a private 192.168.x.x address on the same eth0 interface (as a gateway/dhcp server).

The NATing from my private network to my ISP works and all connected devices can access the internet. However, I'd like to separate the two networks because right now nothing is stopping my other devices from trying to request an IP from my ISP which they shouldn't be able to do.

How could I separate and have my firewall NAT between the two networks with my Dell 3048-ON switch?

P.S. I know it may be more simple to buy an extra network card for my firewall but I rather not have to. Thanks in advance for help on this

My switch has a basic configuration but here it is anyway:

Current Configuration ...
! Version 9.13(0.0)
! Last configuration change at Tue Jan 16 03:00:13 2018 by default
!
boot system stack-unit 1 default system: A:
!
hostname DellEMC
!
protocol lldp 
!
redundancy auto-synchronize full
!
stack-unit 1 provision S3048-ON
!
interface GigabitEthernet 1/1
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/2
 no ip address
 switchport
 no shutdown
!       
interface GigabitEthernet 1/3
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/4
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/5
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/6
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/7
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/8
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/9
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/10
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/11
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/12
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/13
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/14
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/15
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/16
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/17
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/18
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/19
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/20
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/21
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/22
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/23
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/24
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/25
 no ip address
 switchport
 no shutdown
!       
interface GigabitEthernet 1/26
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/27
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/28
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/29
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/30
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/31
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/32
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/33
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/34
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/35
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/36
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/37
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/38
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/39
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/40
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/41
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/42
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/43
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/44
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/45
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/46
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/47
 no ip address
 switchport
 no shutdown
!
interface GigabitEthernet 1/48
 no ip address
 switchport
 no shutdown
!       
interface TenGigabitEthernet 1/49
 no ip address
 shutdown
!
interface TenGigabitEthernet 1/50
 no ip address
 shutdown
!
interface TenGigabitEthernet 1/51
 no ip address
 shutdown
!
interface TenGigabitEthernet 1/52
 no ip address
 shutdown
!
interface ManagementEthernet 1/1
 no ip address
 no shutdown
!
interface ManagementEthernet 2/1
 no shutdown
!       
interface ManagementEthernet 3/1
 no shutdown
!
interface ManagementEthernet 4/1
 no shutdown
!
interface ManagementEthernet 5/1
 no shutdown
!
interface ManagementEthernet 6/1
 no shutdown
!
interface Vlan 1
!untagged GigabitEthernet 1/1-1/48
!
line console 0
line vty 0
line vty 1
line vty 2
line vty 3
line vty 4
line vty 5
line vty 6
line vty 7
line vty 8
line vty 9
!
reload-type
 boot-type normal-reload
 config-scr-download enable
!
end
  • You have your WAN uplink directly connected to your LAN? No VLANs? Seriously?? – Zac67 Jan 31 '18 at 19:20
2

Bridging your LAN and the WAN link is a terrible idea to start with...

You don't need a 2nd physical interface on your firewall but you do need a 2nd logical interface.

  1. On the switch, configure a new WAN VLAN on port Gi1/1 untagged and port Gi1/2 tagged (as VLAN trunk).
  2. On the firewall, add a VLAN subinterface to the NIC with the same VLAN ID as on the switch.
  3. Set up NAT between LAN and WAN VLANs.
  • I had already tried this but my problem turned out to be something else. I was running a Win10 host with a Linux guest VM running 8021q vlans. However the VM doesn't have access to vlans from a normal ethernet port. I had to go to device manager in the host (Windows 10) to the VLAN tab of the NIC. then make the guest VM use that newly created virtual interface that was tied to the vlan of my choosing. I asked this question because I thought maybe I had to do it another way. But thanks for reaffirming I wasn't completely clueless and on the right path! :) – Tek Feb 1 '18 at 12:35
  • 1
    Yes, the host needs to be able to process 802.1q tags for the VM to use them. :D – Zac67 Feb 1 '18 at 12:43
2

One way is to create two logical interfaces (trusted and untrusted) on your firewall, using 802.1q trunking. You will configure your switch port to be a trunk with two VLANs. Logically, your Linux box will have two ports.

Linux configuration is off-topic here. You can get details on configuring 802.1q on Server Fault.

  • To add a little color, Port 1 will need to be an "access" port on one VLAN (I suggest VLAN 100 for the external, Internet traffic to make it pretty clear), ports 3 and up should be an access port on another (say VLAN 2 for internal trusted traffic? You can leave them with the default, which is probably 1, but better to be explicit), and port 2 will be a "trunk" port that is configured with both VLANs (I suggest both be "tagged" (not "native")). You'll need to configure the server to match the tags to VLAN interfaces, but no other devices need configuring in that approach. – Slartibartfast Feb 1 '18 at 3:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.