Here is an ER4 I have with this scenario.
AT&T WAN: 12.X.X.70/30
AT&T Gateway: 12.X.X.69/30
AT&T Routed Block: 12.X.X.240/29 (My IP addresses)
My LAN: 10.1.1.0/24
Interface setup:
interfaces {
ethernet eth0 {
address 12.X.X.70/30
description "AT&T FIber"
duplex full
firewall {
in {
name WAN_IN
}
local {
name WAN_LOCAL
}
}
speed 100
}
ethernet eth1 {
address 10.1.1.1/24
address 10.204.1.1/24
description "St Charles LAN"
duplex auto
firewall {
in {
name LAN_IN
}
local {
name LAN_LOCAL
}
}
speed auto
vif 5 {
address 10.204.5.1/24
description "Guest WiFi"
mtu 1500
}
}
ethernet eth2 {
duplex auto
speed auto
}
ethernet eth3 {
duplex auto
speed auto
}
}
System:
system {
gateway-address 12.X.X.69
}
Service-> Nat:
nat {
rule 1 {
description "Forward Telnet from Epicor"
destination {
group {
address-group ATT242
}
port 23
}
inbound-interface eth0
inside-address {
address 10.1.1.250
port 23
}
log enable
protocol tcp
source {
group {
address-group EpicorIPAddr
}
}
type destination
}
rule 2 {
description "Forward RDP from Epicor"
destination {
group {
address-group ATT242
}
port 3389
}
inbound-interface eth0
inside-address {
address 10.1.1.12
port 3389
}
log enable
protocol tcp
source {
group {
address-group EpicorIPAddr
}
}
type destination
}
rule 3 {
description "Allow SMTP from Google"
destination {
group {
address-group ATT242
}
port 25
}
inbound-interface eth0
inside-address {
address 10.1.1.5
port 25
}
log disable
protocol tcp
source {
group {
network-group Google_SMTP_Networks
}
}
type destination
}
rule 4 {
description "Allow SMTP from Google"
destination {
group {
address-group ATT242
}
port 587
}
inbound-interface eth0
inside-address {
address 10.1.1.5
port 587
}
log disable
protocol tcp
source {
group {
network-group Google_SMTP_Networks
}
}
type destination
}
rule 5 {
description "Inboud PBX traffic"
destination {
group {
address-group PBX_Outside
}
}
inbound-interface eth0
inside-address {
address 10.1.1.30
}
log disable
protocol all
source {
group {
}
}
type destination
}
rule 6 {
description "Inbound Web Traffic"
destination {
group {
address-group ATT242
port-group Web_Ports
}
}
inbound-interface eth0
inside-address {
address 10.1.1.22
}
log disable
protocol tcp
source {
group {
}
}
type destination
}
rule 5900 {
description "PBX Traffic"
log disable
outbound-interface eth0
outside-address {
address 12.X.X.244
}
protocol all
source {
group {
address-group PBX_Inside
}
}
type source
}
rule 5997 {
description LAN
log disable
outbound-interface eth0
outside-address {
address 12.X.X.242
}
protocol all
source {
address 10.1.1.0/24
group {
}
}
type source
}
rule 5998 {
description "Public WiFI"
log disable
outbound-interface eth0
outside-address {
address 12.X.X.243
}
protocol all
source {
address 10.204.5.0/24
group {
}
}
type source
}
rule 5999 {
description "Default NAT Masquerade"
log disable
outbound-interface eth0
protocol all
type masquerade
}
}
Firewall Groups:
firewall {
group {
address-group ATT242 {
address 12.X.X.242
description "AT&T IP 242"
}
address-group ATT243 {
address 12.X.X.243
description "AT&T IP 243"
}
address-group EpicorIPAddr {
address 159.66.236.224
address 159.66.234.224
description "Epicor IP Addresses"
}
address-group Exchange_Servers {
address 10.1.1.5
description "Internal Exchange Servers"
}
address-group Internal_Web {
address 10.1.1.22
description "Internal Webservers"
}
address-group PBX_Inside {
address 10.1.1.30
description "Phone System Internal IP"
}
address-group PBX_Outside {
address 12.X.X.244
description "Phone System External IP"
}
network-group Google_SMTP_Networks {
description "Networks used by Google to send SMTP"
network 216.239.32.0/19
network 209.85.128.0/17
network 173.194.0.0/16
network 74.125.0.0/16
network 72.14.192.0/18
network 66.249.80.0/20
network 66.102.0.0/20
network 64.233.160.0/19
network 64.18.0.0/20
network 207.126.144.0/20
}
network-group Private_LAN {
description "Private LAN Networks"
network 10.204.0.0/16
}
port-group SMTP_Ports {
description "Ports used for SMTP"
port 25
port 587
}
port-group Web_Ports {
description "Inbound Web Ports"
port 80
port 443
}
}
