2

I have an internet gateway that's currently doing NAT for my internal network. With the purpose of better isolating my internal network, I'm creating VLANs on a L3 switch, and for each subnet, I have a IP on this switch that plays the role of the internal gateway for all theses subnets.

Ex.:

[Internet Router (RouterOS v6.41.2)]
(172.16.1.1/252) 
       | (VLAN172)
 (172.16.1.2/252)
   [L3 Switch (Dell N2024 6.3.1.8)]
    |
    |- VLAN1 (192.168.1.254/24)
    |- VLAN2 (192.168.2.254/24)
    |- VLAN3 (192.168.3.254/24)

If I'm on a PC on VLAN3 (192.168.3.123) and need to reach a PC on VLAN1 (192.168.1.123) I'll go through the [L3 Switch] as my default GW on all VLAN3 computer is 192.168.3.254.

My L3 switch has 172.16.1.1 as default GW, and would forward all local computes being the L3 Switch to the internet, and here comes the point to my doubt.

For this to work, I'll need routes to all my internal networks (192.168.[123].0/24) in my internet gateway, right ? Since it's the internet gateway that will do the NAT.

And since my objective with this separation of Local GW and Internet GW was to isolate the networks, I think that should be a better design where I wouldn't need to make the routes for internal network available on the Internet Router.

Since a malicious attack to this internet gateway could give more information about my internal network when it could be avoided.

Improve this question
1
  • Unfortunately, your router is off-topic here because MikroTik does not offer optional, paid support, so we cannot help with the WAN router, but we could help with the switch if you post the configuration.
    – Ron Maupin ♦
    Apr 6, 2018 at 18:02

2 Answers 2

Reset to default
2

For this to work, I'll need routes to all my internal networks (192.168.[123].0/24) in my internet gateway, right ? Since it's the internet gateway that will do the NAT.

Yes and no.

You need a route in your internet gateway to bring the traffic back to the L3 switch.

However there is no need for the internet gateway to know about all of your individual subnets individually. Assuming all your internal networks are in 192.168.0.0/16 a single route will suffice.

As Ron points out if you do this you should also add a null route for 192.168.0.0/16 on the L3 switch so that if a packet addressed to a nonexistent subnet somehow enters the network it doesn't bounce back and forth between the L3 switch and Internet gateway.

Improve this answer
3
  • the /16 routing option was the way to go since I'm trying to show less information
    – Enderson Maia
    Apr 6, 2018 at 18:15
  • 1
    You're not showing any information to the WAN side when using NAT. NAT translates any private LAN address to the WAN router's public address.
    – Zac67 ♦
    Apr 6, 2018 at 18:26
  • 1
    @EndersonMaia, "since I'm trying to show less information" that really makes no sense, You are not advertising your private networks to the Internet. You are not showing anything to the Internet except your public address. The /16 network also aggregates non-existent networks, so you should also set up a static route to null, which is what routing protocols do for aggregations.
    – Ron Maupin ♦
    Apr 6, 2018 at 18:27
1

Routers need to know where to forward traffic. If a router doesn't know how to forward traffic to a destination, then it drops the traffic. One way to make sure no traffic is dropped is to configure a default route (0.0.0.0/0) that matches all destinations. This is common on routers connected to the public Internet. That router will forward all traffic for which is does not have a more explicit destination to the interface of the default route. Unless your WAN router has the full Internet routing table, it will need a default route pointing to the ISP router.

Your WAN router will need to know how to reach the networks behind your LAN router (layer-3 switch). Routers learn route in three ways:

  1. Directly connected networks
  2. Statically configured routes
  3. Through dynamic routing protocols

Since your WAN router is not directly connected to the networks behind the LAN router, you will need to either configure static routes for those networks pointing to the LAN router, or you will need to run a routing protocol between the LAN and WAN routers so that the LAN router can tell the WAN router about the networks behind it.

You have not given us the network device models and configurations, so we cannot give you the specific configurations.

Also, I would not use a VLAN between the LAN and WAN routers. You should probably configure the interface on the layer-3 switch as a routed interface, rather than a switched interface.

Improve this answer
6
  • I din't even think of giving you my network device models, looks like asking to much for the configuration commands. ;) I'll edit the question anyway with those details, anyway. About the "router interface" option, I didn't know it was an alternative to VLAN either, I'll search for it.
    – Enderson Maia
    Apr 6, 2018 at 17:39
  • And about my question, I know that the router needs to know where to send it's packets, but I was wondering if there's a better approach to reveal lesse information about internal network to equipments that are on the internet. Is it sounding paranoid ?
    – Enderson Maia
    Apr 6, 2018 at 17:41
  • That's what firewalls are for, to protect your network. The WAN router is going to need to know what your internal networks are. You could aggregate networks, but three networks leads to multiple aggregations. The number of networks need to be a power of two for a single aggregation.
    – Ron Maupin ♦
    Apr 6, 2018 at 17:48
  • 1
    You can simply copy the configurations from your terminal application, paste into your question, and use the Preformatted-text feature.
    – Ron Maupin ♦
    Apr 6, 2018 at 18:01
  • hey @RonMaupin, I've added the device information, could you provide me more info on how to change the interface to a routed interface instead of a switched oner, as you said. or should I make a new question ?
    – Enderson Maia
    Apr 6, 2018 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.