Firewall/NAT

Section 6.5 of the manual http://doc.m0n0.ch/handbook/nat-outbound.html makes it pretty clear that one could use Advanced Outbound NAT to have NATed hosts on LAN and non-NATed hosts on OPT1, for example.

What doesn't seem to be treated in the manual, FAQ, or list archives is the possibility of accomplishing the same thing on a single LAN interface.

I made some effort at it and wasn't successful. Testing is complicated by the fact that I'm rarely on the LAN; I administer via WAN or PPTP.

m0n0's WAN address is static, 66.x.x.2/27, gateway 66.x.x.1.
The LAN is 10.0/16 with Advanced Outbound NAT enabled and one mapping:
 WAN      10.0.0.0/16      *      *      default NAT

This works great for DHCP hosts using 10.0/16 addresses. What I need though, is to be able to have also have static 66.x.x.0/27 (or even /24, if necessary?) hosts on the same LAN interface.

I realise that an OPT1 interface should make this simple, but one must understand that my NAT and non-NAT hosts are necessarily intermingled physically on the network. i.e., they come into the m0n0wall on the same access point and wire, thus if I were to go that route then my LAN and OPT1 interfaces would be plugged into a single switch along with the access point.

So my questions are:

1. Is there any possible way to configure NAT & non-NAT hosts on a single m0n0wall LAN interface?

2. Are there any caveats to having the LAN and OPT1 subnets sharing the same physical network if I should have to go this way?

db

There's no way to put two IP subnets on the same broadcast domain, which is what you're asking. It's not a good idea regardless.

So just to clarify, are you saying that option 1 is impossible and option 2 is a bad idea vis-a-vis security?

db

Impossible in the GUI, yes. People have hacked in extra subnets on an interface using exec.php after told what I said above, then have other consequences because m0n0wall is not designed to work that way.

From a network design perspective, running two IP subnets on the same broadcast domain is something to be avoided. It's just ugly.

From a security perspective, you have no control over what someone could do with those public IP addressed systems if compromised. Adding an alias on the private subnet would be easy, and would expose your entire network.

Putting the second subnet on a second broadcast domain, whether a VLAN, or preferably an OPT interface with a dedicated switch, really doesn't change anything other than giving you a cleaner, more secure network. They would have to route through m0n0wall to communicate between each other anyway, even on the same broadcast domain.

Impossible in the GUI, yes. People have hacked in extra subnets on an interface using exec.php after told what I said above, then have other consequences because m0n0wall is not designed to work that way.

Fair enough.

From a security perspective, you have no control over what someone could do with those public IP addressed systems if compromised.

We are an ISP. From a security perspective most ISPs have limited control over what their customers are doing with their public IP addresses. There has been some debate in the media lately over common carrier status, and I think it's fair to say that this is a double-edged sword. ISPs for the most part have stayed out of the content debate, and while we do what is reasonably within our power to safeguard the security of our users' machines, we cannot be responsible for their total security, nor would the average user want so many imposed constraints. All our customers to date have 10.0 NAT addresses. To put our 10.0 customers in a broadcast domain with our (pending) 66.x customers, while perhaps ugly, as you put it, imperils their security no more than to give them all a public IP address, it would seem to me. Correct me if I'm wrong.

Adding an alias on the private subnet would be easy, and would expose your entire network.

I have already added an alias on the LAN  interface for unrelated purposes, as discussed on the lists in March. This serves to operate a read-only, LAN-only subnet with no NAT privileges. I have much to learn at this networking game, and I still fail to see exactly how another alias would accomplish what I am attempting/asking about herewith.

Putting the second subnet on a second broadcast domain, whether a VLAN, or preferably an OPT interface with a dedicated switch, really doesn't change anything other than giving you a cleaner, more secure network. They would have to route through m0n0wall to communicate between each other anyway, even on the same broadcast domain.

Whereas it is impossible (or at the very least grossly impractical) to physically separate my 10.0/16 subnet from my 66.x.x/27 subnet, i.e., to put them on separate broadcast domains; and whereas to "expose [my] entire network", as you say, would be to put them in no greater peril than what any other ISP does for its customers, I'll respectfully accept your caution and restate my question:

What I have:

10.0/16 [LAN] -- || mono || -- [WAN] 66.x.x.2/27

What I need:

    10.0/16 --
                    |
               || mono || -- [WAN] 66.x.x.2/27 ---- 66.x.x.1
                    |
   66.x.x/27--

Now unless I have grossly misunderstood the NAT section in the manual, this is a trivial and healthy thing to do with an OPT1 interface. Acknowledging that I cannot create a separate broadcast domain for my new subnet, and an additional NIC is therefore superfluous, I endeavor to accomplish this via my existing 2-NIC monowall.

What must I do to make this happen? If you think it would be imprudent to post some guidelines in the forum, then please, by all means email me.

Fow what it's worth, I can almost infer from your post what needs to be done. Maybe a wink and a nod will suffice if I'm not far off:

[LAN]em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=b<RXCSUM,TXCSUM,VLAN_MTU>
            inet 10.0.0.1 netmask 0xffff0000 broadcast 10.0.255.255
[alias]   inet 66.x.x.3 netmask 0xffffffe0 broadcast 66.x.x.31
   
[WAN]nve0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        inet 66.x.x.2 netmask 0xffffffe0 broadcast 66.x.x.31

Add outbound NAT for 10.0/16, firewall rules and proxy ARP for 66.x.x/27 and we're done. Yes? I'm still not sure about my proposed ifconfig. Thanks for your help.

db

Solution (warning and disclaimer: using an alias on your LAN interface creates security problems and is not recommended):

WAN is x.x.x.2/30

LAN is 10.0.0.1 with alias of x.x.x.17/28 (and <shellcmd> to recreate alias on reboot)
      [my address space is /27, so it is necessary to use /28 such that the LAN and WAN subnets do not overlap]

Static route for LAN x.x.x.0/27
      [This is necessary to prevent the formation of a hidden firewall rule that blocks traffic on the LAN interface that is not sourced from that interface's primary subnet. I'm not sure why, but a /28 subnet won't work here: it prevents the LAN alias from being assigned]

Firewall rules to allow traffic to/from x.x.x.16/28

Advanced outbound NAT enabled with an entry for primary LAN subnet

Proxy arp for x.x.x.16/28

Clients use static IP address in x.x.x.16/28 address space with x.x.x.17 for gateway

I now have this (or similar) setup tested working on 2 monos. Hope this info is useful to someone.

db