A second Firewall, just "pass-through".

[forg99]

Hello "Apple friends" !

I ran into an issue who doesn't seems to be so complicated at the first look.
But I've already loose 8 hours on this "simple problem" and I sure need help now, because I've tried many different things.
Any advice will be appreciated !

I was running a NetBarrier software firewall for months on my "home network". This Mac G3/266 beige was connected to my cable-modem on the first NIC(DHCP from ISP) and the second NIC was on the LAN-side of my network with an 192.168.x.x ip address. So it was my gateway for other computers on my Lan and everything was working fine.
My connection architecture was then :
Internet --> CableModem --> NetbarrierOnJaguar --> Hub --> OtherComputers

Last week, I bought an hardware router/switch/WirelessAccessPoint D-link DI-624 box. It's a 54/108 Mbits equipement with an integrated hardware firewall and it's seems to work great(installation, performance, reliability).
This box is now receiving the DHCP IP address from my ISP.
My first tests with my new router was using this connection architecture :
Internet --> CableModem --> Router --> Hub --> OtherComputers
And this one was working fine too.

Now, I want to include my netbarrier as a second firewall on my network(I'm a bit unsecure :O) The two(2) fw will be one behind the other and not into a parallel pattern.
So I'm trying to use this connection architecture :
Internet --> CableModem --> Router --> NetbarrierOnJaguar --> Hub --> OtherComputers
And this one is not working ! Only this Mac can access the Internet and the rest of my Lan is only working inside(share drives, printers, etc.).
But no Internet for those "behind the second fw" workstations.

So my questions for the Mac computer are :
* Do you thing this setup is a good idea and is it functional(performance) ?
* How can I teach my Jaguay box to be a kind of "pass-through paquet analyser" and not an "Internet Connection Sharing" box ?
* Is this a "bridge architecture" ?
* Do I need to turn on any kind of "proxy server" on Jaguar ?
* How can I temporarily turn off my NetBarrier(version X 10.1) software firewall ? Is this a kind of service(or PID) that I can stop for my tests ?
* What are IP address, Router address and DNS that I must configure on my "external NIC" and on the "Internal NIC" for the Netbarrier box ?

And what about the other mac workstations. What are the IP address, Router address and DNS that I must configure ??

I don't think this is a "tricky network setup". Is it ?

Thank you very much and have a nice day !

 

[bob@bomar.us]

What you can do is this:

Int --> Cbl Mdm --> (DHCP) Router (10.0.0.1) --> (10.0.0.2) NetBarrier (192.168.1.1) --> Hub --> Other

Then have the Netbarrier set to share connections, but has 2 static IP's. The default gateway for the NetBarrier will be 10.0.0.1, and the default gateway for the other machines will be 192.168.1.1.

There will be a performance degradation due to the 2 gateways that you are using.

Another way to do this is what I have:

Internet --> Cbl Mdm --> OpenBSD Firewall --> (dhcp)router(192.168.1.1) --> Switch --> Everything else

If your firewall can support it, you can use the two NIC's in bridged mode, then have the firewall on the incoming NIC, and have a transparent firewall.

 

[forg99]

Thank you very much "bob@bomar.us" for your reply !
I really appreciate.

I can't use your second idea because my Jaguar box is also a database server and I don't want to send him to the front and to expose him directly on Internet...
So I've tried your first idea and I've setup my jaguar box to be a second gateway and It's partly working. :O)
Ok, my second firewall is connected between my home-router and my hub, but now my two subnets are not speaking together... :O(

I've try to setup both NIC in my jaguar to be on the same subnet but it's not working !?? Sorry for this basic question but;
do a gateway must absolutely has a different subnet on the "Internal NIC" and on the "external NIC" ??

Right now, my connection pattern is :
Internet --> CablModm --> (DHCP)RouterWithHardwareFirewall(192.168.1.1) --> (192.168.1.2)MacJaguarWithNetBarrier(192.168.0.1) --> Hub --> OtherComputersWith 0.xxx IpAddresses.

Some of my networks services like Timbuktu, FileSharing on PCs, network printing, etc are not working now.
But, on the other hand, every computers can succesfully access the Internet ! :O)

Can you tell me how I can make my two(2) subnets speaking together ??
I need my home network to act like one network and to share ressources transparently.
Any advice is welcome !

Thank you very very much !