Sonic Firewall inside of Netopia 3347 ADSL modem/router

Posted on 2008-10-15
Last Modified: 2013-12-14
Here is my scenario:
ATT DSL Router/MODEM Netopia 3347ENT with public IP address xx.xx.xx.xx ----> LAN network
I need to add in a sonicwall tz170 and create a site to site VPN to a server.

Internet ----> netopia router (public IP#1) ----> LAN #1 ----> sonicwall (public IP#2 via nat from router) ----> server LAN #2

I have a second public IP that I have created a one-to-one NAT pointing to Sonicwall tz170, i have plugged this server in the sonicwall device and had to create a different subnet for within the sonicwall.

My question: How can i get the server to communicate with local area network, LAN #1 to talk to LAN #2?? If there is an easier way to do this, I am all ears.
Thanks for the help
Question by:jessewilker
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
LVL 32

Expert Comment

ID: 22729725
If I understand correctly; you wish to have communication between LAN1 and LAN2 OR you wish to have a VPN from the internet to Sonicwall and then communicate between the remote network and LAN2.

If it is former why you want to have VPN;
if it is latter, then on Netopia you need NAT-T and IPSec passthrough, you might be better off putting the additional public IP as DMZ in this case.

Please provide more details.

Thank you.

Author Comment

ID: 22731332
It is the former: I need a site to site vpv tunnel from the server on the sonicwall to another network accross the I need a remote network to have access to LAN #2.....however I need devices on LAN #1 to communicate with the same device on LAN #2.....I believe one option is to add a second network card on this device for LAN#1, is there another way?
If I added the Sonicwall as the DMZ on the Netopia, would I set the WAN IP on the sonicwall to the 2nd public IP or as an IP on LAN#1 with all traffic to Public IP#2 forwarded to the sonicwall?
Still asks the same question how can the LAN #2 of the DMZ sonicwall communicate with LAN#1 of the netopia?

thanks for the help, any information is appreciated.
LVL 32

Expert Comment

ID: 22731491
I would say let's not make too many changes to start with.

By default LAN2 would have access to machines/devices on LAN1 [for LAN2 it would appear as they are connecting to a machine/device on internet]; and by default all traffic originating from LAN1 ->LAN2 would be denied [traffic is coming from the internet to the internal network].
You would need to create services to allow the traffic from LAN1 to LAN2.

If possible configure Netopia in bridged mode; have sonicwall get the public IP; this way you would have good firewall protection and you need not have multiple levels of NAT implemented. Also, you can effectively use the public IP addresses.

Thank you.

Accepted Solution

VCBooth earned 500 total points
ID: 22738702
Get the Netopia to pass ALL traffic to the SonicWALL.  Let the SonicWALL be a firewall and the Netopia be the router.

Now then, because of the above situation UDP Port 500 (for IPSEC) is being forwarded to the SonicWALL.  I guess you have a static IP (even better if you have a range and can assign the range to the SonicWALL).

You need another device at the other end - for instance another SonicWALL device.  So, in VPN create the connection using the defaults - each site needs to have a unique IP scheme, i.e. / at Site A and / at Site B.

Go through the VPN wizard to make life easier for you and create it on one side.  Then simple do a manual creation on the other, copying all detals including the shared key but the only change is the IP scheme for each site.

You should then be able to ping from one side and from the other (assumng is indeed a device on the network).

Featured Post

Get HTML5 Certified

Want to be a web developer? You'll need to know HTML. Prepare for HTML5 certification by enrolling in July's Course of the Month! It's free for Premium Members, Team Accounts, and Qualified Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
Getting hacked is no longer a matter or "if you get hacked" — the 2016 cyber threat landscape is now titled "when you get hacked." When it happens — will you be proactive, or reactive?
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

626 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question