I use Mikrotik RouterOS as the NAT router. Some hosts behind the router also have a direct connection to the Internet and these hosts have a default route to the ISP's gateway instead of RouterOS. I set up a OpenVPN server in tun mode on one of these hosts with public ip. The problem is that VPN clients cannot communicate with hosts that have a public IP because they have a default route to the ISP. I can put a static route on RouterOS but I have no control over my ISP's router. So packets sent to the VPN client are sent to WAN link instead of the VPN server. What options do I have?
private DHCP pool 172.16.10.0/24, gateway 172.16.10.1 (RouterOS)
OpenVPN pool 172.16.11.0/24
- tap mode, a lot of overhead
- tun mode, VPN pool inside DHCP pool and OpenVPN server proxy-ARP for the VPN pool in the LAN
- tun mode, add a static route for OpenVPN pool on every host with a public IP. This does not scale well, too much work in a mixed environment
- IPv6. The problem is that a lot of Windows applications (for example VMware products) have poor support for IPv6. All hosts do have IPv6 connectivity but VPN clients might have a hard time getting IPv6.
I know I probably should put everything behind the firewall. I will do that after I get a Juniper SRX. I don't have enough public IPs for every host. And RouterOS/pfSense is not well suited for an environment with mixed public/private IPs. I have to admit this is a poor design to begin with, any migration path without breaking the bank? It's not production, just a bit complicated home network.
I appreciate your input.
Edit1 (Response to JelmerS's answer): This is doable but does not scale really well as I mentioned in OP. In the environment I have different flavors of BSD, Linux, Windows and standalone appliances without shell (e.g. printer, network monitoring devices, phone). I will try DHCP option 33 and option 121, not sure how well they are supported on different devices.
Edit2 (Response to Joseph Drane's answer): 1. Currently hosts with a public IP have a link to RouterOS LAN and another link to the ISP (bypass RouterOS)
Is there any justification for doing static NAT? It seems unnecessary (heavy performance penalty)
The firewall I am looking for can work well in transparent mode. DHCP/NAT can totally be done by another box. But most firewalls I have used don't support/work well in transparent mode and are difficult to troubleshoot (lack of visibility)
Edit3: RouterOS runs inside ESXi. There are some other guest OSes. The environment is mixed with physical/virtual hosts. I do have enough NIC interfaces on ESXi box. I want the flexibility to allow hosts to easily switch between public/private address.