Small Office Network Configuration

[kooperthedog]

Hi Folks,

 

I'm currently setting up a small office network for a relative, and have some queries over the configuration of the topology. I have inherited most of the kit which includes:

 

Netgear DGFV338 ADSL Router/Modem/Switch/Access point

2 X 1Gbps Netgear Switch (unmanaged)

Dell GX270 (intend to setup Smoothwall 3.0 on this)

2 X Dell PowerEdge 2650 Servers

2 X HP Proliant ML115 Servers

4 Dell Dimension PC's

 

I have no issues regarding the Server/PC/Active Directory/DHCP/DNS side of things, but I also need to deliver Exchange 2003/OWA and also host a couple of web servers. The office currently has a 24Mbps broadbank link with Be, and this has been supplied with 8 true internet IP addresses.

 

The Netgear DGFV338 can effectively handle most of the security, but I would prefer to setup a Smoothwall box with three NIC's and have it connect to the cloud, the internal LAN and a DMZ for the web servers. I have attached an image (and I'm not saying it's a good one!) to try and explain the design.

 

 

What I am unsure about is the process of exposing the DMZ via Smoothwall to the cloud via the Netgear DGFV338. By default, the DGFV338 will undertake NAT/PAT and effectively anything plugged into the integrated switch on the DGFV338 is operating on the interal lan using private IP addressing. The DGFV338 does support an "exposed host" port, which as far as I can tell is a low end effort at a built-in DMZ.

 

I am wondering if it is possible to setup this exposed port to effectively route all traffic to my Smoothwall box, which would then allow me to assign some of the true internet IP addresses provided by Be to the Smoothwall box and the web servers. I could then use Smoothwall to manage the traffic flow between OWA and the exchange server hosted on the internal LAN etc. I am also assuming that Smoothwall could handle the NAT/PAT side of things for the internal LAN.

 

I appreciate that I might be well of the mark with some (or all) of this, but any advice is more than welcome.

 

Many Thanks,

 

Kenny

[tom_newton]

You'd be best mapping any/all your public IPs onto the smoothie. Feel free to give me a tinkle and we can discuss it in detail if you like, or ask any Smoothie q's on here

[yabbadabba]

How many devices do you want on a public IP address?

 

Have you been given your IP and subnet?

[kooperthedog]

Hi Guys,

 

Many thanks for the comments. I would be looking to have at least three devices with public IP addresses. One of the devices would run a couple of websites, the second device would run SSL Explorer and the third device is a CCTV system for the office with a web based management console.

 

Ideally, I would like all these services running on port 80 or 443. Until now, they have managed to get access to these services by running each service on a different port and then setting up port forwarding on the router. This has caused issues when they have been at a clients office and the client has these ports blocked via their firewall for outgoing traffic. Couple this issue with the fact that port forwarding isn't as secure as it could be, and you reach a scenario where an alternative solution is required.

 

Originally, they only had a single public IP address which was bound to the router. This meant that they could only host one website on port 80, as you can only have a single instance of port forwarding for a given port with this type of setup etc.

 

In answer to the subnet query, I am due to get the range that has been supplied to them later today. I am also unsure re the Exchange server - I suspect that this may also need to sit in the DMZ but need to do some more research before confirming this.

 

Thanks,

 

Kenny

[kooperthedog]

I've had a think re the Exchange server location and I could potentially keep it inside the internal lan and use the smoothie box to port forward the mail traffic.

 

Cheers,

 

K.

[Butuz]

4 x servers for 4 x workstations?? Thats a darned impressive ration you got there!

[kooperthedog]

Hi Butuz,

 

They aren't a hard up school and as such can afford the luxury of extra kit - please also remember that I have inherited most of this and I'm working with what I have been given, rather than what I would have liked.

 

They actually have a number of other PC's and laptops that I haven't added to my spec because my issue is based around the new design for the network, so it isn't really a 4X4 ratio.

 

It's also worth noting that they run a high volume scanning bureau and can generate upwards of 2Tb of data over the space of an average month, hence the need for plenty of storage space.

 

Cheers,

 

K.