PPPoE, Static IP addresses, Draytek, Internal firewall advice

[Davit2005]

Here's the scenario.

 

At home I have 5 Public IP's allocated (/29) for my own use and a /56 IPv6 allocation, wish all internet was IPv6 .

 

My firewall although next gen and really good is a bit limited when it comes to PPPoE which is what I get provided by the ISP. IPv4 is fine and works but their is no provision for IPv6 on the PPPoE settings.

 

To get around this have setup a DrayTek, this uses one of my IPv4 public IP's as it's WAN IP and then with a routed subnet and this uses an additional IP so 2 public addresses wasted.

 

Internal Firewall uses another Public IP, So 3 addresses used so far leaving 2 or possibly 3 if I use the firewall IP for another NAT'd service. I tried last night to use the Default gateway provided by my ISP on the internal firewall but this does not give internet connectivity.

 

While I like the DrayTeks (mine has being up for 200+ days with no issues), it is a bit limiting and most of it's functions are not being used due to the much better internal firewall. Wondering if I can get any better use of my IP's if I get a Cisco or something but want to keep using the Internal Firewall.

 

Anyone able to advise?

[Blue_Cookeh]

Does your firewall not have PPPoE capability? I know Sophos SG/XG, PfSense and most others do. I got a cheap Openreach VDSL modem from eBay and then put our PfSense firewall behind that. PfSense now does the PPPoE and I can do whatever I please with the IP addresses without wasting any.

 

We did the same with Sophos, but our license ran out hence the switch

[Davit2005]

Does your firewall not have PPPoE capability? I know Sophos SG/XG, PfSense and most others do. I got a cheap Openreach VDSL modem from eBay and then put our PfSense firewall behind that. PfSense now does the PPPoE and I can do whatever I please with the IP addresses without wasting any.

 

We did the same with Sophos, but our license ran out hence the switch

 

It does have PPPoE but not for IPv6 :-( . I'm not really willing to part with it as I also use the same make at work so it's really handy as a learning tool.

 

I also have both a DrayTek 130 and a openreach box whilst they do provide PPPoE passthru the let down is with the firewall that only supports IPv4 on PPPoE setting :-( .

 

I'm jus wondering if IP passthrough on a Cisco or similar would would work.

 

Not willing to go back to VirginMedia though, don't get me started

Edited August 2, 2017 by Davit2005

[Blue_Cookeh]

I think no matter what, you're going to end up wasting IP addresses if you want to route them internally like that.

 

1. Router external

2. Router internal

3. Firewall external

4. routed devices

 

What firewall are you using?

Edited August 2, 2017 by Blue_Cookeh

[MatthewL]

I don't find the Draytek kit very friendly, might be stable but its not easy to follow I don't find.

 

I'd put in pfSense and use that, should be able to achieve what you want quite easily.

[Davit2005]

I think no matter what, you're going to end up wasting IP addresses if you want to route them internally like that.

 

1. Router external

2. Router internal

3. Firewall external

4. routed devices

 

What firewall are you using?

 

Using a PaloAlto VM. I've played/worked with a few firewalls Cisco, SonicWall and had a Sophos UTM at home for years prior to the XG being released. Done the rule migration at a previous place of Cisco to a PaloAlto so got quite used to them and currently work with them.

 

Wish everything was IPv6. I'd have enough public IPs then for sure :-) .

Edited August 2, 2017 by Davit2005

[Opendium_Steve]

To get around this have setup a DrayTek, this uses one of my IPv4 public IP's as it's WAN IP and then with a routed subnet and this uses an additional IP so 2 public addresses wasted.

 

Internal Firewall uses another Public IP, So 3 addresses used so far leaving 2 or possibly 3 if I use the firewall IP for another NAT'd service. I tried last night to use the Default gateway provided by my ISP on the internal firewall but this does not give internet connectivity.

 

While I like the DrayTeks (mine has being up for 200+ days with no issues), it is a bit limiting and most of it's functions are not being used due to the much better internal firewall. Wondering if I can get any better use of my IP's if I get a Cisco or something but want to keep using the Internal Firewall.

 

I'd strongly recommend just terminating the PPPoE connection on the firewall itself instead of messing about with external routers (it seems very odd if you can't do this - anyone who's still selling firewalls that don't do IPv6 has no business selling network hardware at all).

 

If you really can't get around using a separate router, you should be able to assign a private network between the router and the firewall. i.e.:

 

The router is the PPPoE endpoint, but does not assume any address in the public /29. Instead it has a private address (lets say 10.0.0.254/24). The firewall has a private address in the same network (10.0.0.1/24) and the router has a static route that routes the whole public /29 via 10.0.0.1. The firewall would have its default gateway set to 10.0.0.254. The firewall would also need an address in the public /29 which it would need to be set up to use as the source address for all its outbound traffic.

 

Whether or not you can actually configure this, depends on the router and the firewall though. If they were both linux machines which you could prod the config of directly then it's certainly possible to set it up, but whether a simplified web UI of a consumer grade device will let you is another question.

[Davit2005]

I'd strongly recommend just terminating the PPPoE connection on the firewall itself instead of messing about with external routers (it seems very odd if you can't do this - anyone who's still selling firewalls that don't do IPv6 has no business selling network hardware at all).

 

If you really can't get around using a separate router, you should be able to assign a private network between the router and the firewall. i.e.:

 

The router is the PPPoE endpoint, but does not assume any address in the public /29. Instead it has a private address (lets say 10.0.0.254/24). The firewall has a private address in the same network (10.0.0.1/24) and the router has a static route that routes the whole public /29 via 10.0.0.1. The firewall would have its default gateway set to 10.0.0.254. The firewall would also need an address in the public /29 which it would need to be set up to use as the source address for all its outbound traffic.

 

Whether or not you can actually configure this, depends on the router and the firewall though. If they were both linux machines which you could prod the config of directly then it's certainly possible to set it up, but whether a simplified web UI of a consumer grade device will let you is another question.

 

It does do IPv6 and I am running dual stack IPv6 at home with Public IPv6 addresses on internal clients . Just doesn't do IPv6 as a PPPoE client, only does IPv4 as PPPoE client. The Draytek does both IPv4 and IPv6 client so am using that and presenting IPv4 and IPv6 gateways for the firewall to connect to.

 

I also don't want to double NAT.

 

The PPPoE is the problem. If I was still with Virgin I could of set the VirginMedia box to Modem Only. But from what I've read about Virgin Business, I'd rather not. Suffered enough with them as it is.

Edited August 3, 2017 by Davit2005