I have a Linksys BEFW11S4 wireless router behind a WatchGuard gateway router and use static addressing for our...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
network. I would like to create a different subnetwork behind the wireless router, which still has access to the Internet and to some of the machines behind the gateway router. Can you help me? Thank you. You should be able to configure your Linksys Broadband Router and WatchGuard firewall like this (for example):
Internet-------WGRD------+------ServerA 192.168.0.1 | 192.168.0.2 | | 192.168.0.3 +------BEFW11S4------ClientB 192.168.1.1 192.168.1.2
Here, the Linksys BEFW11S4 is configured with static WAN IP address 192.168.0.3 (default gateway 192.168.0.1) and static LAN IP address 192.168.1.1. The WGRD's inside (trusted) subnet is 192.168.0.0/24, and both ServerA and the BEFW11S4 are part of that subnet. The BEFW11S4's LAN subnet is 192.168.1.0/24, and ClientB is part of that subnet.
When ClientB sends outbound traffic through its default gateway (192.168.1.1), the BEFW11S4 applies Network/Port Address Translation, changing the packet's source IP address to 192.168.0.3 and forwarding the packet towards its destination. If the packet's destination is on the public Internet, the packet will be relayed through the default gateway (192.168.0.1). If the packet's destination is ServerA, the packet will be forwarded directly over the trusted LAN to 192.168.0.2.
A response coming from the Internet will be forwarded by the WGRD to 192.168.0.3, where the BEFW11S4 will NAT it back to 192.168.1.2 (ClientB). A response coming from ServerB will be sent directly over the trusted LAN to 192.168.0.3 and be NAT'ed back to ClientB.
You do not need any extra static routes because the BEFW11S4 is operating in NAT mode and thus appears to the WGRD and ServerB like another host on the same trusted LAN. You do not need to create any static NAT bindings on the BEFW11S4 as long as you only want to allow outbound traffic from wireless clients to wired servers or the public Internet. If you wanted to enable inbound (unsolicited, non-response) traffic from ServerA to ClientB, then you would need to configure 1-1 NAT bindings on the BEFW11S4.
Dig Deeper on Wireless LAN Implementation
Related Q&A from Lisa Phifer
The enterprise mobility management market for wearable devices is in its infancy, but IT can still use existing EMM tools to manage wearables.continue reading
Wireless expert Lisa A. Phifer explains to what extent WEP cracking remains a worrisome issue. It all depends on your company's WLAN security policy.continue reading
Wireless expert Lisa A. Phifer explains why you shouldn't stop using 802.1X authentication methods for enterprise WLAN access control.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.