Hello Everyone!
Hopefully I'm posting this in the correct subforum!
First time user of UTM 9.1. Just installed the home edition on my new purpose built firewall PC. Initially installed Untagle, but was not happy with the limited offerings of the 'Lite' package. As this is strictly for a small home network, I could not justify the yearly fee's.
When I first heard of Astaro / Sophos, I was a little intimidated as I have never setup / used a dedicated firewall before. Previously, it has always been whatever came in my consumer grade Linksys or TP-Link router.
The hardware I am running is as follows:
Gigabyte GA-C847N-D Motherboard
- 1.1GHz dual core Celeron
- dual on-board Realtek gigabit NIC
4GB DDR3 1333
250GB 2.5" laptop HD
TP Link 10/100 PCI NIC
My ISP is a dynamic cable connection, only one IP allowed. I use the term dynamic loosely as it has yet to change in the 3+ yrs I've had the service :)
Installation went smoothly with no problems. The initial setup was straight forward also. I had no internet connectivity issues once the UTM installation was finished. Unfortunately that was the end of the 'smooth sailings'.
I'm going to try an explain what I am trying to do... and the issues I have encountered as clearly as possible.
eth0 - EXT
eth1 - INT
eth2 - DMZ
I have a TP Link 24 port managed gigabit switch that currently has three VLANs enabled. Two ports for EXT, two for DMZ and the rest connected to INT.
I did spend about 4hrs going through various forum posts last night, but I figured after those 4hrs, it was time to ask for some assistance!
All devices connected to INT are able to route to the internet without any problems.
Only one device on the DMZ, and it is unable to route to the internet.
INT and DMZ do not need to speak to each other, as the DMZ device is simply a MagicJack / VOIP adapter.
I realize that a dedicated DMZ is not needed for the MJ, but since it is only a backup, I figured there is no harm in trying things out.
QUESTION: How do I setup the DMZ interface so that the connected device has unfettered access to the internet?
I am also having some internal routing issues. All my devices are Linux / BSD, and the only Windows machines are VM's that occasionally run.
Most of my connected devices obtain an IP automatically, as it does not matter what their IP is (smart phones, laptops, etc)
The TP Link switch and two TP Link wireless access points have statically assigned IP's that are set within their GUI's.
Two of my machines are servers and have statically assigned IP's. These IP's were assigned within the software settings of the OS.
These machines, as well as the TP Link devices, do not show up on the DHCP lease table (makes sense as they are not obtaining their IP from the DHCP server).
I've noticed however, that the routers DHCP service had provided one of the statically assigned IP's, thus making the server unavailable.
example: server has an internally assigned IP of 192.168.1.122, but the DHCP server assigned the same IP to one of my smart phones.
QUESTION: Is there a way to 'reserve' an IP range so that static IP's have the first 25 addresses (192.168.1.100 - 192.168.1.125) and the dynamically assigned ones would be .126 - .150?
QUESTION: If the above is not a suitable solution, would it be better to assign the static IP's within the routers DHCP service instead of within the OS?
I've also had an issue where I've selected a device on the network (XBMCbuntu) that has been given a dynamic IP by the DHCP service of 192.168.1.110, but I want it to be is 192.168.1.111. I clicked the 'make static' button and sete it to the IP I want it to be.
The device then shows up under both the static and dynamic. Same MAC under both, but two different IP's One static, one dynamic.
QUESTION: Is this going to possibly cause a conflict? Is there a way to release a dynamic assigned IP?
I also noticed last night that I was unable to route to certain devices on the network from one machine, but could do so from another. Example: My SUSE laptop (dynamic 192.168.1.109) could route to 'XBMC' (dhcp static .1.111) and 'server' (os static .1.148), but could not route to FreeNAS (os static .1.122).
If I used the laptop to SSH into either the XBMC or server boxes, I could hit the FreeNAS box from them by both SSH and by the fact the NFS shares were mounted correctly.
Rebooting the modem, then switch, then router, then each connected device one at a time, did not resolve the routing issue. I even added static routes within the router (192.168.1.122 -> internal), with no change.
QUESTION: What's going on with the routing issue? Is it related to the IP assignments I noted above?
Any and all help is greatly appreciated!