I want to implement a security scheme in a new network configuration. There are two buildings for the client:

  • Office Building 1 (OB1) with address /, Gateway ( Router1 Zyxel ). In OB1, is installed also the domain controller ( ) where the users of OB1 have already joined to.

  • Office Building 2 (OB2) with address /, Gateway ( Installed as Internal Address (lan) of a Firewall ) Firewall wan1 device has address and uses as Router2 (Zyxel) address.

Router1 provides internet access for users of OB1 and Router2 provides internet access for users of OB2. In OB2 Firewall has configured for protection and web filtering for network. Both buildings are connected through VPN implemented between Router1 and Router2.

I would like to know:

  1. how to setup firewall protection of OB1 ( network ) using Firewall Device in OB2 ( perhaps with some network re-configuration )
  2. how to setup users in OB2 ( network ) to join the domain implemented in Domain Controller which is part of network in OB1

3 Answers 3


I may be way off here, but if one building has the domain controller, and the other has the firewall, why don't you just set traffic of OB1 to route through the VPN to your gateway( There isn't sufficient information to really give you much guidance. Questions that I have are, how is your VPN implemented? Are you willing to take a hit on your bandwidth if you route all of your traffic across a VPN just so it can go through a web filter? What if one of the buildings goes offline, how will it affect the other? In short, it sounds doable, but is that going to be the best solution long term?

  • +1 Not enough info. My solution would be similar: set up a VPN tunnel between the two sites. The VPN box could be your gateway on network 2, this would cause all the traffic in net2 to go through net1's firewall. This could be slow, though.
    – Jeff
    Feb 6, 2012 at 19:24

what I understood from your question is this.

OB1 ----------------------> Xyxel router 1
OB2------>firewall--------> Xyxel router 2

Router1 and Router2 has a VPN for inter-connectivity. Each router has a separate Internet connection.

Now with this info, you need to keep certain things into account.
1. Does your firewall device support multiple Internet connections
2. if not then can a single connection be sufficient for both offices. Then what about single point of failure (ISP connection) though there might be other single point of failures.

I would suggest this: 1. The VPN connection between office1 and office2 should be changed to firewall and Router 1 from router to router.
2. The Internet connection in office1 be disabled.
3. default routes added on router 1 to forward data through the firewall. 4. add firewall rules to allow ports like UDP 53, 88, 135. TCP 389, 53, 135, 138, 139, 445, 3268, 3269, 464 between these subnets

Another way of setting this up would be
1. bring the xyxel router 2 behind the firewall device instead of current firewall behind router.
2. Disable the Internet on Router1 and add a default route to forward packets to router 2, which will forward the Internet bound data through firewall to Internet and would not require an extra interface on it.

All depends on what type of hardware you have at your disposal.


The simple answer to this is just no.

You would need to route all the traffic through a single firewall at a single physical point.

One thing you could do is:

OB1>---(>VPN>--(gateway to internet on>---OB2>---(>FW>->

But you'd lose half your internet bandwidth.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .