Network Configuration - Revision history

Græmer at 15:37, 3 May 2022

2022-05-03T15:37:26Z

Hpaunet: /* What "bridged" really means. */

2019-11-19T23:39:40Z

What "bridged" really means.

← Older revision		Revision as of 23:39, 19 November 2019
Line 112:		Line 112:
	It means that packets coming inside one side of a bridge will NOT necessarily exit the other side of the bridge. It also means that packets destined with a specific route will be routed according to Untangle's routing table. '''All traffic is routed according to Untangle's routing table.''' It also means MAC addresses are not maintained across segments, even if they are bridged together as packets are brouted.		It means that packets coming inside one side of a bridge will NOT necessarily exit the other side of the bridge. It also means that packets destined with a specific route will be routed according to Untangle's routing table. '''All traffic is routed according to Untangle's routing table.''' It also means MAC addresses are not maintained across segments, even if they are bridged together as packets are brouted.

	This may cause you to wonder how Untangle works in the traditional "Bridge Mode." The answer is simple, for outbound traffic to the internet untangle will route that to its default gateway which was probably where the traffic was headed anyway and definitely where it should go. For inbound traffic Untangle knows ~~the~~ where each local host on the bridged segment lives and it routes it directly. So inbound and outbound traffic both flow as expected.		This may cause you to wonder how Untangle works in the traditional "Bridge Mode." The answer is simple, for outbound traffic to the internet untangle will route that to its default gateway which was probably where the traffic was headed anyway and definitely where it should go. For inbound traffic Untangle knows where each local host on the bridged segment lives and it routes it directly. So inbound and outbound traffic both flow as expected.

	Where things get complicated is when networks have more complicated routes and do not configure Untangle with those routes. Assume Untangle is installed in traditional bridge mode on a 192.168.1.1/24 network. Lets assume the network also has another internal network of 192.168.2.1/24 behind an internal router 192.168.1.100. There is probably already a route on the existing firewall telling it that 192.168.2.* can be reached behind 192.168.1.100. If the user then inserts untangle in bridge mode and configures it as 192.168.1.2, the entire 192.168.1.* network will work but none of the traffic on 192.168.2.* will work. Why? Because Untangle routes all traffic according to its routing table. The firewall will route 192.168.2.* traffic to 192.168.1.100. When that traffic passes through Untangle it will not route it to 192.168.1.100 - it will route it according to its routing table. Since it knows nothing about 192.168.2.* and those addresses aren't local, it will be sent back out to the default gateway. As such the 192.168.2.* network will be completely offline as return traffic from the internet will not reach those hosts. Once a 192.168.2.0/24 route to 192.168.1.100 is added to Untangle traffic will flow as expected. The routing table on Untangle must reflect the layout of the network.		Where things get complicated is when networks have more complicated routes and do not configure Untangle with those routes. Assume Untangle is installed in traditional bridge mode on a 192.168.1.1/24 network. Lets assume the network also has another internal network of 192.168.2.1/24 behind an internal router 192.168.1.100. There is probably already a route on the existing firewall telling it that 192.168.2.* can be reached behind 192.168.1.100. If the user then inserts untangle in bridge mode and configures it as 192.168.1.2, the entire 192.168.1.* network will work but none of the traffic on 192.168.2.* will work. Why? Because Untangle routes all traffic according to its routing table. The firewall will route 192.168.2.* traffic to 192.168.1.100. When that traffic passes through Untangle it will not route it to 192.168.1.100 - it will route it according to its routing table. Since it knows nothing about 192.168.2.* and those addresses aren't local, it will be sent back out to the default gateway. As such the 192.168.2.* network will be completely offline as return traffic from the internet will not reach those hosts. Once a 192.168.2.0/24 route to 192.168.1.100 is added to Untangle traffic will flow as expected. The routing table on Untangle must reflect the layout of the network.

Hpaunet: /* Configuring VLAN on Untangle in Bridge Mode */

2019-11-15T22:58:33Z

Configuring VLAN on Untangle in Bridge Mode

← Older revision		Revision as of 22:58, 15 November 2019
Line 199:		Line 199:
	===Configuring VLAN on Untangle in Bridge Mode===		===Configuring VLAN on Untangle in Bridge Mode===

	Some users want to configure ~~untangle~~ in bridge mode in the middle of a VLANed network.		Some users want to configure Untangle NG Firewall in bridge mode in the middle of a VLANed network.
	This is possible, but '''NOT RECOMMENDED'''. It is suggested to install Untangle as the gateway and terminate VLANs on an addressed VLAN interface. However, if you wish to install Untangle as a bridge in the middle of several (V)LANs simultaneously, the following instructions will allow you to establish multiple bridges and then enter the routes to tell Untangle that if traffic enters on a specific interface it should exit the bridged peer.		This is possible, but '''NOT RECOMMENDED'''. It is suggested to install Untangle as the gateway and terminate VLANs on an addressed VLAN interface. However, if you wish to install Untangle as a bridge in the middle of several (V)LANs simultaneously, the following instructions will allow you to establish multiple bridges and then enter the routes to tell Untangle that if traffic enters on a specific interface it should exit the bridged peer.

Hpaunet: /* NAT traffic exiting this interface (and bridged peers) */

2019-11-15T22:56:41Z

NAT traffic exiting this interface (and bridged peers)

← Older revision		Revision as of 22:56, 15 November 2019
Line 132:		Line 132:
	=== NAT traffic exiting this interface (and bridged peers) ===		=== NAT traffic exiting this interface (and bridged peers) ===

	The first option is ''NAT traffic exiting this interface (and bridged peers)''~~, as~~ described in the [[Interfaces]] documentation, will NAT any traffic exiting this interface and any of its bridged peers. This is ~~the~~ enabled by default on WANs.		The first option is ''NAT traffic exiting this interface (and bridged peers)''. As described in the [[Interfaces]] documentation, this option will NAT any traffic exiting this interface and any of its bridged peers. This is enabled by default on WANs.

	What this means is that any and all traffic exiting that WAN interface or bridged peers will be NATd to ''auto'' which is the current primary address of that WAN interface. Traffic between this interface and any bridged peers will not be NATd. Checking this option also blocks all traffic coming to this WAN that is not to a local process or explicitly forwarded with a [[Port Forward Rules\|Port Forward Rule]].		What this means is that any and all traffic exiting that WAN interface or bridged peers will be NATd to ''auto'' which is the current primary address of that WAN interface. Traffic between this interface and any bridged peers will not be NATd. Checking this option also blocks all traffic coming to this WAN that is not to a local process or explicitly forwarded with a [[Port Forward Rules\|Port Forward Rule]].

Hpaunet: /* Standard Bridge Mode */

2019-11-15T22:51:17Z

Standard Bridge Mode

← Older revision		Revision as of 22:51, 15 November 2019
Line 70:		Line 70:
	This is extremely useful when there is a firewall upstream.		This is extremely useful when there is a firewall upstream.

	For example, if the firewall is 192.168.1.1, then you can ~~configured~~ External as 192.168.1.2/24 with 192.168.1.1 as the gateway.		For example, if the firewall is 192.168.1.1, then you can configure External as 192.168.1.2/24 with 192.168.1.1 as the gateway.
	The internal hosts all have 192.168.1.* addresses and can continue to use 192.168.1.1 as a gateway (192.168.1.2 will also work as a gateway).		The internal hosts all have 192.168.1.* addresses and can continue to use 192.168.1.1 as a gateway (192.168.1.2 will also work as a gateway).

Hpaunet: /* Configuring the Interfaces */

2019-11-15T22:50:25Z

Configuring the Interfaces

← Older revision		Revision as of 22:50, 15 November 2019
Line 48:		Line 48:
	* Configure additional subnets on the External/Internal.		* Configure additional subnets on the External/Internal.

	Because Untangle routes all traffic according to its routing table~~. Additional~~ routes/aliases may be required for any additional subnets on your network.		Because Untangle routes all traffic according to its routing table, additional routes/aliases may be required for any additional subnets on your network.
	More information on that in [[Installation#Configure Other Subnets]]		More information can be found on that in [[Installation#Configure Other Subnets]]

	* Configure additional interfaces		* Configure additional interfaces

	After the setup wizard only External and Internal are configured. Additional interfaces are disabled and still require configuration.		After the setup wizard only External and Internal are configured. Additional interfaces are disabled and still require configuration.
	More information on that in [[Installation#Configure Other Interfaces]]		More information can be found on that in [[Installation#Configure Other Interfaces]]

	* Configure any tagged VLANs		* Configure any tagged VLANs

	If you have tagged VLANs (802.1q) on your network~~. You~~ will need to add [[Network Configuration#VLANs\|VLAN Tagged Interfaces]].		If you have tagged VLANs (802.1q) on your network, you will need to add [[Network Configuration#VLANs\|VLAN Tagged Interfaces]].

	== Bridging ==		== Bridging ==

Hpaunet: /* Placing Untangle on the Network */

2019-11-15T22:48:02Z

Placing Untangle on the Network

← Older revision		Revision as of 22:48, 15 November 2019
Line 33:		Line 33:
	# Install Untangle ''behind'' an existing gateway/firewall in flow with traffic.		# Install Untangle ''behind'' an existing gateway/firewall in flow with traffic.

	Installing Untangle as the gateway/firewall is recommended. It is usually the simplest approach and it allows Untangle to leverage its full feature set including [[WAN Failover]] and [[WAN Balancer]]. This also places it in a convenient place to handle other seperate internal networks (like wireless segments) that may only connected at the gateway. Also, If you have tagged VLANs it is much simpler to run Untangle as a endpoint of those VLANs. This is commonly referred to as ''router mode.''		Installing Untangle as the gateway/firewall is recommended. It is usually the simplest approach and it allows Untangle to leverage its full feature set including [[WAN Failover]] and [[WAN Balancer]]. This also places it in a convenient place to handle other seperate internal networks (like wireless segments) that may only be connected at the gateway. Also, If you have tagged VLANs it is much simpler to run Untangle as a endpoint of those VLANs. This is commonly referred to as ''router mode.''

	However, often organizations don't want to replace the existing gateway/firewall or can't because it is controlled by a different organization. In these cases, installing Untangle as a "bridge" behind the gateway allows Untangle and the apps to scan and process network traffic without providing the routing functions of your firewall. This is commonly referred to as ''bridge mode.''		However, often organizations don't want to replace the existing gateway/firewall or can't because it is controlled by a different organization. In these cases, installing Untangle as a "bridge" behind the gateway allows Untangle and the apps to scan and process network traffic without providing the routing functions of your firewall. This is commonly referred to as ''bridge mode.''

Hpaunet: /* Placing Untangle on the Network */

2019-11-15T22:47:18Z

Placing Untangle on the Network

← Older revision		Revision as of 22:47, 15 November 2019
Line 28:		Line 28:
	== Placing Untangle on the Network ==		== Placing Untangle on the Network ==

	The first step, after understanding the above cardinal rules, is to decide where to place Untangle on the network. Obviously, Untangle must be installed in-line with all network traffic so this provides a two options:		The first step, after understanding the above cardinal rules, is to decide where to place Untangle on the network. Obviously, Untangle must be installed in-line with all network traffic so this provides two options:

	# Install Untangle as the gateway/firewall for the network.		# Install Untangle as the gateway/firewall for the network.

Jcoffin: /* Configuring VLAN on Untangle in Bridge Mode */

2019-08-29T21:47:35Z

Configuring VLAN on Untangle in Bridge Mode

← Older revision		Revision as of 21:47, 29 August 2019
Line 230:		Line 230:
	#Bridge this interface to the external VLAN interface		#Bridge this interface to the external VLAN interface
	</blockquote>		</blockquote>
	[[Image:internal_vlan.png\|~~400px~~\|center\|Scenario 1: Additional Port]]		[[Image:internal_vlan.png\|600px\|center\|Scenario 1: Additional Port]]

	*Go to WAN Balancer and set the weights to send 100% of network traffic out of your untagged external interface		*Go to WAN Balancer and set the weights to send 100% of network traffic out of your untagged external interface

Jcoffin: /* Configuring VLAN on Untangle in Bridge Mode */

2019-08-29T21:36:20Z

Configuring VLAN on Untangle in Bridge Mode

← Older revision		Revision as of 21:36, 29 August 2019
Line 219:		Line 219:
	#Enter DNS servers you would like to use		#Enter DNS servers you would like to use
	</blockquote>		</blockquote>
	[[Image:external_vlan.png\|~~400px~~\|center\|Scenario 1: Additional Port]]		[[Image:external_vlan.png\|600px\|center\|Scenario 1: Additional Port]]

	*To set up the internal's VLAN interface		*To set up the internal's VLAN interface