Tech-Note Bridges Vs Routers Version /06/2009. Bridges Vs Routers

Transcription

1 Tech-Note Bridges Vs Routers - 02/06/

2 Index 1. About this tech-note Recommended configurations Issues that may arise with other types of connections Connected to a router behind NAT IPSec VPN Tunnel establishment between two WGServers Load balancing between two different access lines Some advantages of the recommended configurations Conclusions

3 1. About this tech-note The tech-note details Nonius recommendations for connecting a WGServer to the Internet and details some issues that may arise 3 2

4 2. Recommended configurations Nonius recommends the connection of the main WAN interface in one of the following ways: 1. Behind a router: a. Through the assignment of a Public IP address; b. Or to a DMZ LAN port; 2. Behind a modem: a. Make sure the modem is configured in bridge mode and assigns a Public IP address to the WGServer; 4 2

5 3. Issues that may arise with other types of connections 3.1. Connected to a router behind NAT Erro! A origem da referência não foi encontrada. shows a typical network diagram commonly used with the WGServer installation. In this case the router obtains the public IP address and is already configured with a private IP address in its LAN ports. The WGServer s Wan interface (LAN1) is connected to one of the router s LAN ports and is configured with an IP address (in this case, ) belonging to the private network of the router. This scenario may arise several issues: There are two equipments performing Network Address Translation (NAT): the router and the WGServer. The establishment of VPN tunnels is known to have difficulties with NAT traversal. Two consecutive NAT traversals may cause the VPN s establishment to fail; Figure 1 - WGServer behind NAT The router has a firewall that inspects all the packets from WGServer and, some of them, can be discarded (as an example, DNS queries are often discarded by the router due to supposed attack). Cisco routers are known to have Access Control Lists (ACLs) that drop packets from not specifically admitted protocols. Routers may limit the number of connections opened from the hotspot, which causes the impression that the Internet Service is down when the maximum limit is reached. An example are Zyxel routers: 5 2

6 Figure 2 Zyxel routers limit the number of TCP/UDP sessions per client 6 2

7 3.2. IPSec VPN Tunnel establishment between two WGServers Take a look to the following network diagram: Figure 3: VPN IPSec establishment with Double NAT The previous figure presents a network diagram of two remote locations connected with each other through a VPN IPSec. Both locations are equipped with a router and a WGServer. The WGServer located in the main office starts the IPSec connection and the WGServer in the remote office becomes connected to the main office through the VPN. With this kind of scenario (Figure 3), the VPN IPSec connection between the Main Office and the Remote Office may not work. Double NAT is being performed which causes the failure of the VPN IPSec establishment. The network diagram shows where Network Address Translation is being used: 1 st NAT: the router connected to the Internet 2 nd NAT: WGServer To solve this issue please follow chapter two s recommendations. The next figure shows one possible network diagram to connect the two remote buildings successfully: 7 2

8 Figure 4: Correct VPN IPSec implementation In the above network diagram, only one Network Address Translation is performed in which of the locations. The VPN IPSec is successfully established from the Main Office s WGServer and the Remote Office s WGServer. Both networks are link together and exchanging common documents Load balancing between two different access lines Another example of problems that may arise is the use of load balancing in the WGServer appliance. Take a look at the following network diagram: With this scenario, the WGServer is balancing all the traffic between the two WAN ports: LAN1 is connected to the Internet through a bridge modem (and has a public IP address) and LAN4 is connected behind a NAT-enabled router. When a hotspot user tries to establish a Figure 5: Load Balancing with different gateways VPN connection, through the WGServer, to the remote VPN Server (Figure 5), if the gateway is the LAN1 port the VPN is established with success. On the other hand, if the gateway is the LAN4 port, the VPN will fail because of the double NAT problem. The problem with the Load Balancing configuration, though, is that during the establishment of the VPN the public IP address seen by the Remote VPN server changes and the server will refuse the tunnel s 8 2

9 establishment. To circumvent this problem, the Remote VPN server s public IP address must be excluded from balancing. You can do this in WGConfig, at the Load Balancing form: Figure 6 - IP address exclusion from balancing 9 2

10 4. Some advantages of the recommended configurations Figure 7 shows the WGServer s main WAN interface connected to the Internet via a modem/bridge. In the case the WGServer (configured as DHCP in LAN1) obtains, through the modem, directly a Public IP Address. There are several advantages in this scenario: Only one Network Address Translation (NAT) is done; There are no firewalls between the WGServer and the ISP except the WGServer s internal firewall (already configured to optimize the client s access). There are no connection limits imposed on bridges. Figure 7: Network Diagram with a bridge The advantages described for the modem/bridge scenario also apply to the behind router scenarios with a Public IP address assigned to the WGServer or with the main WAN interface connected to a DMZ port. 10 2

11 5. Conclusions The examples shown demonstrate that with NAT-enabled routers, there is a bigger probability for issues such as: users can t open new web pages because their peer2peer programs have already attained the maximum number of connections, or users can t connect to their company s VPN and so on. The modem/bridge equipment gives full control to the WGServer appliance and eliminates the several referred issues. If a router is to be used, connect the WGServer to a DMZ port or, preferably, assign the WGServer a public IP address. 11 2