lwebber
asked on
How to give DMZ WiFi WAP access to LAN web server
Goal: corporate visitors using WiFi should have full access to the Internet, zero access to the LAN.
I have a SonicWall PRO 2040 Standard and a set of HP ProCurve switches. I have created a VLAN on the switches so that a WiFi WAP connected to a specific port can hit the SonicWall DMZ port but nothing else. The SonicWall has DHCP configured on the DMZ's IP range (192.168.20.0:24). There is a reservation for the WAP's MAC address, and a nice wide range for DHCP leases. DNS is hard coded to the ISP's name servers. The WAP is configured to use DHCP. The LAN's subnet is 192.168.1.0:24.
Works perfectly. You get a WiFi connection that lets you out to the Internet, but you can't see anything on the LAN. But it works a little TOO perfectly. We have an exchange server on the LAN, and have opened up the necessary firewall ports to allow our employees to use OWA when traveling. There is an external DNS A record for mail.FooCorp.com that points to our SonicWall's external IP address (say, 76.101.5.68). The SW has a firewall rule that sends port 80 traffic to the IIS server on our Exchange box. This has worked well for ages.
The problem is this. When an *employee* uses the WiFi connection, the employee can surf the net just like anyone else. But when the employee tries to hit mail.FooCorp.com, they get a DNS error: server not found. I need to tell the SonicWall that when it hears a request for 76.101.5.68, it should send the traffic to our internal web server. Can I do that with a firewall rule, or do I need to define a static route of some kind?
I have a SonicWall PRO 2040 Standard and a set of HP ProCurve switches. I have created a VLAN on the switches so that a WiFi WAP connected to a specific port can hit the SonicWall DMZ port but nothing else. The SonicWall has DHCP configured on the DMZ's IP range (192.168.20.0:24). There is a reservation for the WAP's MAC address, and a nice wide range for DHCP leases. DNS is hard coded to the ISP's name servers. The WAP is configured to use DHCP. The LAN's subnet is 192.168.1.0:24.
Works perfectly. You get a WiFi connection that lets you out to the Internet, but you can't see anything on the LAN. But it works a little TOO perfectly. We have an exchange server on the LAN, and have opened up the necessary firewall ports to allow our employees to use OWA when traveling. There is an external DNS A record for mail.FooCorp.com that points to our SonicWall's external IP address (say, 76.101.5.68). The SW has a firewall rule that sends port 80 traffic to the IIS server on our Exchange box. This has worked well for ages.
The problem is this. When an *employee* uses the WiFi connection, the employee can surf the net just like anyone else. But when the employee tries to hit mail.FooCorp.com, they get a DNS error: server not found. I need to tell the SonicWall that when it hears a request for 76.101.5.68, it should send the traffic to our internal web server. Can I do that with a firewall rule, or do I need to define a static route of some kind?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
either way, you'd still have to create a firewall rule because the loopback is NAT'ing back to the private IP of the exchange server in the same manner that specifying the private IP rather than mail.foocorp.com. before we get too far, review this PDF. it discusses loopbacks in standard OS. don't forget to create the firewall rule.
SonicOS-Standard-2.0-Configuring.pdf
SonicOS-Standard-2.0-Configuring.pdf
ASKER
I'll give this a try tomorrow from the office. I don't think I can test it any other way than to connect to my guest WiFi on the DMZ and try to hit mail.foocorp.com. I'll let you know what happens.
that's true...got my fingers crossed, good luck!
ASKER
Thanks for your help, Digitap. I now have a guest WiFi network that does exactly what I want. In fact, today I just added another WAP to the same VLAN. Just modded the ProCurve VLAN setup to UNTAG the port where the new WAP is plugged in, gave it a static IP in the 192.168.20.0 subnet, and it worked instantly. So now I have a WAP on the 4th floor and a WAP on the 5th floor. And some very happy clients.
that's awesome! i'm so glad i was able to help and thanks for the points! what's that saying by the A-Team guy..."I love it when a plan comes together."?
ASKER