I would like to know if it's possible to redirect all network traffic to a device (it can be Firewall or Transparent Proxy). My lab has the image layout (Physical Connection), how can I force all traffic through the firewall (Logical Connection)? enter image description here


Traffic within a network is sent directly from host-to-host, so you would need to put each host in its own network and VLAN to force the traffic through the configured gateway on each host. In this case, the firewall.

The firewall would need to be configured as a router-on-a-stick with a subinterface in each network, and a different interface or subinterface to the router.

The router would need to know about all the networks behind the firewall, either statically configured (does not scale) or through a routing protocol run between the router and firewall.

  • I could use vlans for each final host, have a trunk interface where the firewall will receive all the packets and redirect the data through a specific vlan where it can only talk to the router? it works? The best situation would be to have a router/firewall, right? I would like to understand how this is done in big companies.
    – Bruno Dias
    Mar 23 at 23:47
  • "I would like to understand how this is done in big companies." This is not something normally done. Either you prevent traffic between hosts using private VLANs, or you allow (must allow unless it is a private VLAN) traffic directly between the hosts on the same VLAN. Firewalls are placed at the network edge for traffic into and out of the network, and, no, a large company will have a dedicated firewall (actually multiple firewalls).
    – Ron Maupin
    Mar 23 at 23:55
  • right, I understand that in the case of the firewall it is on the edge and we can do the manipulation using the vlans, the same can be done for a transparent proxy? would it be just replacing the position of the firewall with the proxy?
    – Bruno Dias
    Mar 24 at 0:13
  • Proxies are configured per application, normally for HTTP and HTTPS, but there are proxies for other application-layer protocols, too. Unfortunately, host configurations and protocols above OSI layer-4 are off-topic here. You can ask about those on Server Fault for a business network.
    – Ron Maupin
    Mar 24 at 0:22

Unless you're using VLANs to separate the subnet between firewall and router/gateway from the rest of the network, your physical setup is flawed. You cannot permit end nodes to talk to the router directly when you want them to use a firewall. A firewall needs to be the only connection between different network zones.

So, either

  1. set up a separate VLAN between firewall and router and trunk the end-node VLAN and the router VLAN to the firewall
  2. use separate, physical connections that resemble your desired logical connections

If the firewall is transparent (bridging) it might not support variant 1. If it's routing this setup is sometimes called router-on-a-stick.

  • Traffic between hosts on the same VLAN would still not travel to the firewall, and the OP, twice, says "all traffic."
    – Ron Maupin
    Mar 23 at 22:01
  • Thanks guys, I already know which way to go.
    – Bruno Dias
    Mar 24 at 0:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.