I have an internet gateway that's currently doing NAT for my internal network. With the purpose of better isolating my internal network, I'm creating VLANs on a L3 switch, and for each subnet, I have a IP on this switch that plays the role of the internal gateway for all theses subnets.
[Internet Router (RouterOS v6.41.2)] (172.16.1.1/252) | (VLAN172) (172.16.1.2/252) [L3 Switch (Dell N2024 188.8.131.52)] | |- VLAN1 (192.168.1.254/24) |- VLAN2 (192.168.2.254/24) |- VLAN3 (192.168.3.254/24)
If I'm on a PC on VLAN3 (192.168.3.123) and need to reach a PC on VLAN1 (192.168.1.123) I'll go through the [L3 Switch] as my default GW on all VLAN3 computer is 192.168.3.254.
My L3 switch has 172.16.1.1 as default GW, and would forward all local computes being the L3 Switch to the internet, and here comes the point to my doubt.
For this to work, I'll need routes to all my internal networks (192.168..0/24) in my internet gateway, right ? Since it's the internet gateway that will do the NAT.
And since my objective with this separation of Local GW and Internet GW was to isolate the networks, I think that should be a better design where I wouldn't need to make the routes for internal network available on the Internet Router.
Since a malicious attack to this internet gateway could give more information about my internal network when it could be avoided.