Use a Common Firewall for two Different Subnets

Question

I want to implement a security scheme in a new network configuration. There are two buildings for the client:

• Office Building 1 (OB1) with address 10.0.0.0 / 255.255.255.0, Gateway 10.0.0.1 ( Router1 Zyxel ). In OB1, is installed also the domain controller ( 10.0.0.250 ) where the users of OB1 have already joined to.

• Office Building 2 (OB2) with address 10.0.1.0 / 255.255.255.0, Gateway 10.0.1.167 ( Installed as Internal Address (lan) of a Firewall ) Firewall wan1 device has address 192.168.5.199 and uses 192.168.5.2 as Router2 (Zyxel) address.

Router1 provides internet access for users of OB1 and Router2 provides internet access for users of OB2. In OB2 Firewall has configured for protection and web filtering for 10.0.1.0 network. Both buildings are connected through VPN implemented between Router1 and Router2.

I would like to know:

1. how to setup firewall protection of OB1 ( network 10.0.0.0 ) using Firewall Device in OB2 ( perhaps with some network re-configuration )
2. how to setup users in OB2 ( network 10.0.1.0 ) to join the domain implemented in Domain Controller which is part of network 10.0.0.0 in OB1

Answer 1

The simple answer to this is just no.

You would need to route all the traffic through a single firewall at a single physical point.

One thing you could do is:

OB1>---(10.0.0.0)---ISP-->VPN>--(gateway to internet on 10.0.1.0/24(FW)>---OB2>---(10.0.1.0)-->FW>->0.0.0.0/0

But you'd lose half your internet bandwidth.

Answer 2

what I understood from your question is this.

OB1 ----------------------> Xyxel router 1
OB2------>firewall--------> Xyxel router 2

Router1 and Router2 has a VPN for inter-connectivity. Each router has a separate Internet connection.

Now with this info, you need to keep certain things into account.
1. Does your firewall device support multiple Internet connections
2. if not then can a single connection be sufficient for both offices. Then what about single point of failure (ISP connection) though there might be other single point of failures.

I would suggest this: 1. The VPN connection between office1 and office2 should be changed to firewall and Router 1 from router to router.
2. The Internet connection in office1 be disabled.
3. default routes added on router 1 to forward data through the firewall. 4. add firewall rules to allow ports like UDP 53, 88, 135. TCP 389, 53, 135, 138, 139, 445, 3268, 3269, 464 between these subnets

Another way of setting this up would be
1. bring the xyxel router 2 behind the firewall device instead of current firewall behind router.
2. Disable the Internet on Router1 and add a default route to forward packets to router 2, which will forward the Internet bound data through firewall to Internet and would not require an extra interface on it.

All depends on what type of hardware you have at your disposal.

Answer 3

I may be way off here, but if one building has the domain controller, and the other has the firewall, why don't you just set traffic of OB1 to route through the VPN to your gateway(10.0.1.167). There isn't sufficient information to really give you much guidance. Questions that I have are, how is your VPN implemented? Are you willing to take a hit on your bandwidth if you route all of your traffic across a VPN just so it can go through a web filter? What if one of the buildings goes offline, how will it affect the other? In short, it sounds doable, but is that going to be the best solution long term?