Access to the local subnet from the WAN interface (NAT RULE?)

Hi Matteo,

first of all I would suggest not to connect a router (FW2) behind a client network.

create a new transfer/transit subnet for the connection between FW1 and FW2 (otherwise you may get asymmetric routing)

but also possible:
however you can add a route via FW2 to any 192.168.122.x device to reach the 192.168.111.x subnet directly

Thanks for you answer.

Nowadays something changed:

FIREWALL 1 is configured like this:

LAN  192.168.122.X         (Aerial 1 is part of this DHCP pool)

FIREWALL 2  has the aerial connected directly to a port, configured as another LAN zone, with a static IP from the FIREWALL 1 range.

Could i make them communicate with each other via firewall rules or, as you said before, better make a transit subnet?

Can you make an example? Thanks.

please provide a short network sketch ...

At the moment it's like this, but think i'd better connect the Aerial1  directly to a firewall1 interface so i can create a transit subnet as you suggested before.

Yes, a dedicated transit-netwirk would be better.

Currently your 192.168.122.0/24 network has two gateways. This will sooner or later lead to asynchronous routing