0

Starting from the following network topology:

Internet --- ISP Cable Router --- Firewall --- Router --- rest of the network / multiple VLANs
             (port forwarding)       |
                                    DMZ

I had to expose two VLANs over the internet through VPN for two groups of users. To achieve this, I chose the following approach:

                                         trunk
                                      for exposed
                                       _ VLANs _
                                      /         \
Internet --- ISP Cable Router --- Firewall --- Router --- rest of the network / multiple VLANs
             (port forwarding)  (VPN server)
                                     |
                                    DMZ

The "rationale" of this choice was that as both the firewall and the router have the power to run the VPN server, running it on the Firewall will help share the load at the cost of an additional trunk port and cable. It also helps me split the responsibilities (external access rules and traffic shaping on the firewall, inter-VLAN rules on the router) and avoid having to expose any service on the LAN.

Everything's working as expected, however as I'm not a professional nor experienced (I'm learning), I'm wondering if it is the recommended approach (from a ease of management, traffic shaping, security perspectives).

For instance I could have done this as well:

Internet --- ISP Cable Router --- Firewall --- Router --- rest of the network / multiple VLANs
             (port forwarding)       |      (VPN server)
                                    DMZ

The questions I ask to experienced people are:

  1. what are the risks of my choice if there are any?
  2. what is the recommended way of achieving what I want to do?
  3. could you please explain "why" so I can learn?
2
  • Removed mention of off-topic device models and primarily opinion-based question.
    – Ron Maupin
    Sep 12, 2023 at 12:53
  • Has any answer solved your question? Then please accept it or your question will keep popping up here forever. Please also consider voting for useful answers.
    – Zac67
    Feb 9 at 14:14

1 Answer 1

0

what are the risks of my choice if there are any?

Given that the firewall is between your LAN, DMZ and the Internet there's no obvious risk. Everything depends on your firewall ruleset, of course.

what is the recommended way of achieving what I want to do?

I'd do it the same way. Although I don't see the real need for a plain link and a VLAN trunk between router & firewall - a VLAN trunk should be able to handle everything. (I'm guessing "router" is an L3 switch that handles both L2 and L3 connectivity, otherwise the VLAN trunk wouldn't make sense.)

Alternatively, you could use a single, routed link between router and firewall - you could trust IP addresses/subnet association as it's a dedicated link.

But I don't think there's a "recommended way".

5
  • Thank you for your answer. The "router" is a rb5009 mikrotik router whoes port1 is the WAN port with NAT, and port2 is trunk port carrying traffic tagged with the two vlans. Is it a bad idea ?
    – Kraal
    Sep 12, 2023 at 15:20
  • Your diagram indicates three ports, hence the comment. Separate WAN and (VLAN trunk) LAN ports are what I meant.
    – Zac67
    Sep 12, 2023 at 16:23
  • In the second method (router as vpn server), the firewall is completely bypassed. So you are trusting whoever/whatever connects to the VPN.
    – Ricky
    Sep 12, 2023 at 17:28
  • @Zac67 sorry if it was not clear: the "rest of the network" consists of switches, servers, printers, workstations.
    – Kraal
    Sep 12, 2023 at 17:59
  • @Ricky this is why I avoided this approach.
    – Kraal
    Sep 12, 2023 at 18:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.