?
Solved

Access LAN from DMZ

Posted on 2012-08-17
13
Medium Priority
?
1,125 Views
Last Modified: 2012-08-18
I have two router to build my own DMZ:

Router 1 (Cisco RV110W) connected from Internet to DMZ:
WAN IP: 80.21X.XX.XX
LAN IP: 192.168.1.1

Router 2 (Cisco RV810W) connected from DMZ to LAN:
WAN IP: 192.168.1.101
LAN IP: 192.168.2.1 / 255.255.255.0

I have a WebServer (IIS, 192.168.1.103) in the DMZ. I can see (ping, RDP) this server from my LAN, but the WebServer can't see anything inside my LAN. That's OK so far.
Now I have a NAS Devices (192.168.2.222) inside my LAN and that is configured to be an FTP server. How can I give access to this Device from Internet / DMZ?
0
Comment
Question by:mr-kenny
  • 6
  • 5
  • 2
13 Comments
 
LVL 5

Expert Comment

by:EVeuger
ID: 38304320
You have to create a route in Router 1 (I assume this is your default gateway)!
0
 
LVL 5

Expert Comment

by:EVeuger
ID: 38304335
So in your case in router 1 (configuration mode) enter: ip route 192.168.2.0 255.255.255.0 192.168.1.101

Cheers!
0
 
LVL 1

Author Comment

by:mr-kenny
ID: 38304365
Thanks, I don't understand yet:

I have both Routers in Gateway Mode (NAT).

In the Routing menu of Router 1 I have to add a Static Routing:

Destination LAN IP: 192.168.2.0
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.101
Interface: LAN & Wireless   OR Internet (WAN)

is this correct?
0
Veeam Disaster Recovery in Microsoft Azure

Veeam PN for Microsoft Azure is a FREE solution designed to simplify and automate the setup of a DR site in Microsoft Azure using lightweight software-defined networking. It reduces the complexity of VPN deployments and is designed for businesses of ALL sizes.

 
LVL 35

Accepted Solution

by:
Ernie Beek earned 1000 total points
ID: 38304366
You will also have to create access lists to allow ftp through and create nat statements to link the public address/port to the server (and the same from the LAN.
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 38304375
I took the liberty of adding 'network routers' and 'networking hardware' the your zones to draw some extra attention.
0
 
LVL 5

Assisted Solution

by:EVeuger
EVeuger earned 1000 total points
ID: 38304406
That is correct. Only router 1 has a public address, so there you need to route towards your LAN which is connected to router 2. The websever in the DMZ will have router 1 as DG and also needs that route access anything on the LAN.

Happy routing!
0
 
LVL 1

Author Comment

by:mr-kenny
ID: 38304451
I still have no access from my WebServer into LAN when I try to ping my NAS (192.168.2.222)

Here's my config:

Routing Table on Router 1 (Internet-DMZ):
Destination LAN IP	Subnet Mask	        Gateway	Interface	 
192.168.2.0	                        255.255.255.0	192.168.1.101	LAN	
192.168.1.0	                        255.255.255.0	192.168.1.1	LAN	
20.100.68.0	                         255.255.254.0	20.100.69.55	WAN	
0.0.0.0	                                 0.0.0.0	                 20.219.68.1	WAN

Open in new window



Acces Rule on Router 2 (LAN):

Always Allow       ANY       Enabled       Inbound (WAN (Internet) > LAN (Local Network))       
Source: 192.168.1.1 - 192.168.1.250
Send to Local Server (DNAT IP): 192.168.1.101
0
 
LVL 5

Expert Comment

by:EVeuger
ID: 38304475
Is the DG on the webserver set to router 1?
0
 
LVL 1

Author Comment

by:mr-kenny
ID: 38304517
yes IP of WebServer is 192.168.1.103 and DG 192.168.1.1
0
 
LVL 5

Expert Comment

by:EVeuger
ID: 38304542
Can you post a tracert to the NAS from the webserver?
0
 
LVL 1

Author Comment

by:mr-kenny
ID: 38304556
1 192.168.1.1
2 192.168.2.222
3 Request timed out
0
 
LVL 5

Expert Comment

by:EVeuger
ID: 38304563
It seems the issue here is not routing, because it is routing correctly!
0
 
LVL 1

Author Closing Comment

by:mr-kenny
ID: 38308218
I think it works now: I've changed the router mode of the router in the LAN to "Router" instead of "Gateway". Now the Router WAN-DMZ is configured in Router mode "Gateway" and the other in the LAN as "Router". I added the static Routing on the one router and Allow Inbound traffic on the LAN Firewall. <br /><br />It works now but I wonder if it also should work with both Routers configurd to run in Gateway Mode? <br />Thanks for your help.
0

Featured Post

Prep for the ITIL® Foundation Certification Exam

December’s Course of the Month is now available! Enroll to learn ITIL® Foundation best practices for delivering IT services effectively and efficiently.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Security is one of the biggest concerns when moving and migrating your data from your on-premise location to the Public Cloud.  Where is your data? Who can access it? Will it be safe from accidental deletion?  All of these questions and more are imp…
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

755 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question