Should my internet gateway know about internal network/vlans?

Question

I have an internet gateway that's currently doing NAT for my internal network. With the purpose of better isolating my internal network, I'm creating VLANs on a L3 switch, and for each subnet, I have a IP on this switch that plays the role of the internal gateway for all theses subnets.

Ex.:

[Internet Router (RouterOS v6.41.2)]
(172.16.1.1/252) 
       | (VLAN172)
 (172.16.1.2/252)
   [L3 Switch (Dell N2024 6.3.1.8)]
    |
    |- VLAN1 (192.168.1.254/24)
    |- VLAN2 (192.168.2.254/24)
    |- VLAN3 (192.168.3.254/24)

If I'm on a PC on VLAN3 (192.168.3.123) and need to reach a PC on VLAN1 (192.168.1.123) I'll go through the [L3 Switch] as my default GW on all VLAN3 computer is 192.168.3.254.

My L3 switch has 172.16.1.1 as default GW, and would forward all local computes being the L3 Switch to the internet, and here comes the point to my doubt.

For this to work, I'll need routes to all my internal networks (192.168.[123].0/24) in my internet gateway, right ? Since it's the internet gateway that will do the NAT.

And since my objective with this separation of Local GW and Internet GW was to isolate the networks, I think that should be a better design where I wouldn't need to make the routes for internal network available on the Internet Router.

Since a malicious attack to this internet gateway could give more information about my internal network when it could be avoided.

Answer 1

For this to work, I'll need routes to all my internal networks (192.168.[123].0/24) in my internet gateway, right ? Since it's the internet gateway that will do the NAT.

Yes and no.

You need a route in your internet gateway to bring the traffic back to the L3 switch.

However there is no need for the internet gateway to know about all of your individual subnets individually. Assuming all your internal networks are in 192.168.0.0/16 a single route will suffice.

As Ron points out if you do this you should also add a null route for 192.168.0.0/16 on the L3 switch so that if a packet addressed to a nonexistent subnet somehow enters the network it doesn't bounce back and forth between the L3 switch and Internet gateway.

Answer 2

Routers need to know where to forward traffic. If a router doesn't know how to forward traffic to a destination, then it drops the traffic. One way to make sure no traffic is dropped is to configure a default route (0.0.0.0/0) that matches all destinations. This is common on routers connected to the public Internet. That router will forward all traffic for which is does not have a more explicit destination to the interface of the default route. Unless your WAN router has the full Internet routing table, it will need a default route pointing to the ISP router.

Your WAN router will need to know how to reach the networks behind your LAN router (layer-3 switch). Routers learn route in three ways:

1. Directly connected networks
2. Statically configured routes
3. Through dynamic routing protocols

Since your WAN router is not directly connected to the networks behind the LAN router, you will need to either configure static routes for those networks pointing to the LAN router, or you will need to run a routing protocol between the LAN and WAN routers so that the LAN router can tell the WAN router about the networks behind it.

---

You have not given us the network device models and configurations, so we cannot give you the specific configurations.

Also, I would not use a VLAN between the LAN and WAN routers. You should probably configure the interface on the layer-3 switch as a routed interface, rather than a switched interface.