Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 5 subscribers
  • Views 1843 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to route a static WAN subnet over a single carrier IP

ChrisSoukup

Hi,

I need some help to fix a WAN configuration issue since I can't access the admin-interface of the gateway behind my sophos-gateway.

That's how our internet access infrastructure looks like:

We get our internet connection through a cable modem and a additional router which creates a subnet with 8 ip addresses. Here is a draft:

---(cable)---[CABLE-MODEM]---(eth)---[MicroTik-ROUTER]---(eth)---[Sophos-SG210]---

We use the MicroTik router to multiplex/route between the single IP address that the modem provides to the x.y.z.112/29 subnet that is finally used by our sophos gw. This router has been installed years ago by some other network admin before we had the Sophos SG210. It was a demand from our ISP in order to give us the official-ip /29 subnet.

My plan is to remove the MicroTik router from the whole chain since the Sophos-SG210 should be capable of mastering this routing task (route a subnet through one ISP address). One of the main reasons is a down-stream bandwidth issue that came up after our ISP exchanged the cable-modem which should provide higher up/dn bandwidth (400/40 MBit down/up)but instead throttles down the downstream (to 200MBit) which is even below the values (250MBit) we had before.

 

Side issue I would like to solve:

First of all I would like to access the admin-interface of this MicroTik router at x.y.z.113 which is also used as "IPv4 Default GW address" in the UTM WAN1 interface.
When I attach a notebook directly to one of the LAN ports on the MicroTik router I can access the admin-interface but not from the internal corporate LAN behind my UTM.

I should probably ignore this little problem since I want to get rid of this "in between" router anyway and I can connect to it directly in case I need to lookup something or do some changes. Still it makes me curious and think that something is not configured correctly on the WAN side - or do I just worry too much and it's normal?

 

Main issue I have to solve:

However I should focus on the main task which is to remove the MicroTik router and put it's routing/multiplexing task to the Sophos SG210 side.
AFAIK the single "carrier" IP address that the modem provides on it's LAN side can be assigned dynamically (DHCP).

I guess the WAN interface should be just configured to "Dynamic IPv4" and physically connected to the modem. But where do I create my static /29 IP subnet and how do I tell to route/multiplex this subnet to the "carrier ip". And if there are different routing types/modes - how do I find out which one is being used currently in the MicroTik router?

Currently the WAN interface is configured to a static IP  x.y.z.118 (belongs to our /29 subnet) and there are 3 extra entries on the "Additional Addresses" page (for some other services we provide externally on other IPs from our subnet).

So which changes have to be done to get our subnet running on the Sophos SG210 ?



This thread was automatically locked due to age.
Parents
  • 0

    Hallo Chris,

    I agree that the MikroTik should go away and with apijnappels that the problem is likely a missing firewall rule.  You could do #1 in Rulz to confirm that or determine that it's a missing masq rule.

    You can't route traffic through the "carrier" IP - your ISP has to do that.

    If you take the suggestion to put all of your /29 on the "Dynamic IPv4" interface, you should be able to use one of those IPs to masq your internal IPs.  Note that, in this situation, you might want to use an "Any -> Any -> Any" SNAT rule instead of Masquerading as the various proxies will use the primary ("carrier") address to send traffic handled by them.

    Presently, you have two of your /29 IPs in use to connect the UTM and the MikroTik.  Instead of putting them on the External interface, you might want to consider a DMZ with public IPs.  The ISP's routing solution for your /29 would not be affected.  I wouldn't recommend this approach if you're using Webserver Protection.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0

    Hallo Chris,

    I agree that the MikroTik should go away and with apijnappels that the problem is likely a missing firewall rule.  You could do #1 in Rulz to confirm that or determine that it's a missing masq rule.

    You can't route traffic through the "carrier" IP - your ISP has to do that.

    If you take the suggestion to put all of your /29 on the "Dynamic IPv4" interface, you should be able to use one of those IPs to masq your internal IPs.  Note that, in this situation, you might want to use an "Any -> Any -> Any" SNAT rule instead of Masquerading as the various proxies will use the primary ("carrier") address to send traffic handled by them.

    Presently, you have two of your /29 IPs in use to connect the UTM and the MikroTik.  Instead of putting them on the External interface, you might want to consider a DMZ with public IPs.  The ISP's routing solution for your /29 would not be affected.  I wouldn't recommend this approach if you're using Webserver Protection.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
  • 0 in reply to BAlfson

    Thank you for the information. I spoke to my ISP and decided to move the subnet routing to their side since the new modem is capable of taking over that task now. Since that extra subnet service belongs to our contract it's also wiser to move the duty to their end.

    We did the change this morning and it works great. The bandwidth issue is gone (it was the MikroTik device) and we have our ~400/40 MBit throughput as advertised.

     

Unfiltered HTML