1

I currently have a small network which contains an FTP server that I'd like to be able to access from the Internet at home.

This network has a firewall with 2 interfaces - 192.168.0.75 - Facing the internal network & 192.168.1.1 going to my router at 192.168.1.254. I need to be able to forward ports from the router's subnet, through the firewall on to my internal subnet and to the FTP server.

I'm not sure if static routes are the most ideal way to achieve this, or exactly how it should be set. With static routes am I correct in the assumption I'd need a route going from the router to the firewall with its gateway set as 192.168.1.1, with destination IP 192.168.0.75, and setup port forwarding on the firewall to the FTP server?

Please advise, I also attach a simplified diagram.

Network Diagram

Routes view from Router

  • I don't see any netmasks; are those 192.168.0.0/24 and 192.168.1.0/24? – vhu Jun 19 '14 at 11:27
  • Yes they're both /24. – Richard Jun 19 '14 at 11:28
  • ZyXEL screenshot is barely readable but it looks like you should have 192.168.0.0 as destination IP and 255.255.255.0 as subnet mask. – vhu Jun 19 '14 at 11:50
  • If you click to view the image, you should be able to zoom in. The 255.255.255.255 netmask was autofilled by the router. – Richard Jun 19 '14 at 11:50
  • When entering only 192.168.0.0 as the destination the netmask changes to 255.255.0.0, so I'm not exactly sure what that would achieve. – Richard Jun 19 '14 at 11:58
3

Static routes are just fine. In this case your default gateway should always point towards internet:

  • FTP server should have default gateway 192.168.0.75
  • Firewall's default route (0.0.0.0/0) should have next hop 192.168.1.254.

Firewall shouldn't need any other routes. 192.168.0.0/24 and 192.168.1.0/24 are already connected so they should be in the routing table already.

Your router (192.168.1.254) should have static route for 192.168.0.0/24 via 192.168.1.1.

Port forwarding must be done at least on a device with public IP address - router in your case. In this case you don't need to perform NAT nor port forwarding on the firewall it'll just run the firewall rules. Port forwarding on the router should set 192.168.0.162 as new destination address.

You could do port forwarding on both firewall and router but I that's probably counter productive. You cannot perform port forwarding and NAT on firewall only as it isn't reachable from the Internet due to private IP addresses.

| improve this answer | |
  • The FTP Server already has the default gateway set like you suggest, and the firewall's default route is as you specified and the routing table does indeed contain the route for 192.168.1.0/24. – Richard Jun 19 '14 at 11:45
  • With the information provided would you say the configuration in the newly added picture to my original post is correct? – Richard Jun 19 '14 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.