[dakka1]

Using a Netgear R7000P, r53939. We want to start with a pretty standard setup, WAN connects outbound (is assigned an IP), and run WiFi/wired connections in our office. All fine. We have a separate inbound wired IP which is on a different network. We'd like to isolate one of the router ports for this connection, assign a static IP (its a public IP) and use it for inbound only. We want the following:

- inbound connections only on specific ports, forwarded to specific machines on default VLAN (allowing ssh access)
- no outbound traffic to use this inbound connection

I've looked over the forums and found a few examples that are close but not quite what we want.
I guess I'd also like some help with iptables commands for above.

Any help appreciated
/dakka

[egc]

I am not sure what you want, do you want to have two WAN interfaces?

Perhaps make a diagram to show what you want?

[dakka1]

Hi - see attached diagram. So we have one default WAN where all outbound internet traffic goes. This is provided by the office services. The second WAN is not through that service, but is dedicated to us. We want that to go into port 1 on the router. Inbound ssh connections from that IP with specified ports should then be forwarded to one of the servers (1-3) depending on the inbound port. All other inbound traffic should be dropped. No outbound traffic should be routed through the inbound WAN.

Thanks!
/dakka

[egc]

a Dual WAN solutions is possible with DDWRT but you need to do it manually, see:
https://wiki.dd-wrt.com/wiki/index.php/Dual%2C_Triple_%28and_probably_quad%29_WAN_with_multiple_active_WAN_links_and_source_routing

You need networking expertise to get this going, to be honest this is more for a professional solution and/or professional advise.

[dakka1]

Thanks for the reply. The dual WAN setup you refer to is not really the same thing. It describes multiple WAN (outbound), failover and source routing (from within). We need something much simpler - just the addition of the inbound WAN. We don't need DNS, DHCP, failover etc or anything else for that other WAN.

I have made an attempt to get this working by:
-creating a second bridge (br1), assigning a static IP
-removing port 1 from VLAN1 and br0 and adding it to VLAN3, add VLAN3 to br1

This isolates port 1 and now has a static IP. The missing part is the iptables rules to allow the inbound traffic on specific ports to be routed across to specific hosts on VLAN1, and rules to prevent any outbound traffic going to VLAN3.

I guess its a bit tricky but I wouldn't have thought that it was that advanced.

[egc]

Like you described it port 1 is on a different subnet than the servers on port 2,3 and 4.
If this is the case then you need routing which means you actually create a second WAN (A WAN is nothing more than an interface and routing/firewall rules to route between subnets).

If the Office can use the same subnet as your outbound WAN/Firewall you can turn it around and use the WAN port for the inbound connection, connect port 1 for outbound connection and bridge with the wireless interfaces, they do not have DHCP from the router but from the firewall/outbound side.

[dakka1]

Anyone able to suggest the iptables rules?
/dakka

[D.F.Cruizer]

While a picture is worth a thousand words as conventional saying would have it, I fail to see the logic of the traffics as depicted by the diagram.

For a start, Firewall is typically placed on the traffic coming into (inbound) to a local network for obvious reason. The diagram throws that convention upside down by placing Firewall on the outgoing traffic.

Unless i miss something terribly convoluted in your desired setup.

[dakka1]

The firewall is provided by the office services. All traffic on their network goes through their firewall.
There is no firewall inbound. We have to add that with our iptables rules. The traffic using that IP is open, hence the need to lock it down and route only the ssh traffic to the other servers.

/dakka

[Alozaros]

all routers have SPI firewall that usually filters the traffic inbound...so only related , established connections are permitted...that was the previous post all about...if you disable the SPI firewall than you are on your own...no idea how the iptables rules will worn...SPI firewall works only WAN to LAN and opposite, but not LAN to LAN