Segregate 2 networks using public IPs

design.jpg
Hi,

I have an RB750. I have attached a diagram of the network as I think it needs to look. Current setup for the site is a DSL connection from mainstream broadband provider authenticating using PPPOE and with 2 public IPs. It is bridged to a Sonicwall TZ200 (192.168.200.254) which is the firewall for the site. The private network is 192.168.200.0/24. This network is connected via VPN through the Sonicwall to another site, the network of which is 192.168.100.0/24.

The requirement is to introduce another network (10.0.0.0/24) which has to be separate from 192.168.200.0/24 for security purposes. Given the existing situation with VPN etc., a public IP still needs to go all the way through to the Sonicwall. Hence the reason for cabling the network as in the diagram. There is no problem getting the network 10.0.0.0/24 to be separated from the main private network 192.168.200.0/24 and to use exclusively one of the public IPs using a srcnat. However, problem remains to get the other IP to go all the way through to the Sonicwall. If I bridge ether1 (into which the DSL modem is connected and is connected to a PPPOE client on the Mikrotik) to ether3 (into which the Sonicwall is connected) the PPPOE fails but the Sonicwall will work - makes sense. I’m basing the solution on using a PPPoE client on the Mikrotik on ether1, using one on ether4 for 10.0.0.0/24 (works fine) and using the other on the Sonicwall (plugged into ether3). But how do I forward a public to the Sonicwall (in which case I can turn off the PPPOE on the Sonicwall, use the Mikrotik as planned and configure the Soniwall to connect to Internet using a Static IP forwarded from Mikrotik.

I can understand that this is complicated. Maybe it doesn’t need to be. Any help much appreciated.

Tom.

As much as I like Mikrotik RouterOS, I don’t see why you need it at all. Just add another zone on the SonicWall for the segregated network, and make it less trusted than the 192.168.200.0/24 network. Done.

Thanks for the reply.

Have tried adding a spare port on the Sonicwall as a new Zone. But didn’t see any option to create a separate NAT’ed network. If you’re saying it’s possible then I’ll revisit. I’ll try that and report back.

Thanks.

I don’t have a whole lot of SonicWall experience, but I’d be surprised if it couldn’t do that.