Basic SOHO Network with Switch

Overview

One of the most common and basic network configurations starts with a modem which connects the Internet from an Internet Service Provider (ISP). The modem can be a cable modem, fiber modem, DSL modem or other type, but it will have an Ethernet output. The Ethernet output is connected to a firewall, then the firewall is connected to a switch. It is recommended that the switch handles all local traffic within a subnet, as the Vault's hardware is not optimized for this.  By doing so will also simplify firewall configuration.

The following diagram depicts a basic configuration for a Small Office/ Home Office (SOHO) network. This article is intended to serve as a general reference explaining how best to incorporate a Protectli Vault that has been configured to act as a firewall using any chosen firewall software such as OPNsense, pfSense, etc. This assumes that the Protectli Vault has been loaded with a fresh installation of the selected OS.

 

Vault Interface Connections

• WAN to modem (ISP) Ethernet port
• LAN to PC being used for configuration, access to OS GUI
• OPT1 to switch

IP Assignments

• WAN interface will receive an IP address via DHCP address from the modem
• LAN interface will have a DHCP server enabled by default, and will be assigned an address of 192.168.1.1. and it will provide an IP address of 192.168.1.X to the PC used for configuration
• Set the OPT1 IP address to 192.168.2.1, and enable DHCP Server for the interface

Configuration

Note: It is important with this setup to verify that the WAN IP addresses is NOT in the 192.168.1.X or 192.168.2.X range as this would create an IP address subnet conflict between the OS on the Vault and the other network devices.

• Verify the PC connected to the LAN port receives an IP address in the range of 192.168.1.X
• Browse from the PC to the installed OS on the Protectli Vault using default IP address of 192.168.1.1
• Verify the OS GUI is displayed
• Enable OPT1 and assign an IP address of 192.168.2.1 and enable DHCP Server for OPT1 ( Services > DHCP Server)

Firewall Rules

In order to block unknown and/or unwanted incoming traffic from the Internet and to allow access out to the Internet, the OS has some built in rules for the WAN and LAN ports.

• WAN: Default rule is to DENY any incoming traffic
• LAN: Default rule is to ALLOW any incoming or outgoing traffic

In order to allow access out to the Internet for all of the switch connected devices, a rule has to be created for the OPT1 interface that is the same as the default LAN interface rule.

• OPT1: No default rules. Replicate the LAN ANY to ANY rule to allow traffic through this interface

 

By following the simple network configuration above, the firewall should be able to effectively pass network traffic among all network devices and out to the Internet. Keep in mind that this is intended to document the physical topology and get the firewall up and running as quickly as possible. Refer to documentation pertaining to the specific software that is installed on the Vault in order to customize configuration settings to suit your network needs. Installation guides and more can be found in our Knowledge Base. As always, should you need additional assistance, please feel free to reach out to us using our support page.