1. Home
  2. Networking Firewalls
  3. Anyone Make an Off the Shelf DHCP Proxy NAT / Firewall?

Anyone Make an Off the Shelf DHCP Proxy NAT / Firewall?

I'm looking for a commodity small LAN firewall / NAT box that would support a DHCP proxy feature on its *external* interface, and then send those DHCP requests to a specific host behind the arp.

My application is that I have a Windows 2003 domain controller that I would like to have act as a DHCP server for the computers in its domain. The clients would be in front of a firewall / NAT and the domain controller would be behind the firwall / NAT. I want to find an NAT that would present a DHCP proxy on its external interface and send those requests to the domain controller.

The existing firewall we have in place supports DHCP proxy only in a weak way. It also requires adding some additional software to the firewall that I don't particularly want running on the firewall. So I would run the DHCP proxy as a bypass to the existing firewall, just for DHCP only. No other traffic besides DHCP would go in or out of the new firewall.

I see that Netopia's Cayman 3500 series supports a DHCP relay from

*internal* machines to an outside DHCP server. Unfortunately, that's the opposite of what I need, unless I am ready to turn the firewall 180 degrees around and make the clients the internal network and the domain controller the external. That would require some very iffy configuration to make secure, if it could be done. My preference is to find a similar off-the-shelf product that already incorporate DHCP proxy as I describe it. I would prefer to not have to install UNIX and do anything custom. Due to time limitations, off the shelf is what I need.

Does this product exist?

Reply to
Will
Loading thread data ...

formatting link

-Russ.

Reply to
Somebody.

My bad -- not fortigate.com...

formatting link
:-(

-Russ.

Reply to
Somebody.

This is not a good idea. Better use a VPN.

Yours, VB.

Reply to
Volker Birk

How is a VPN going to solve a DHCP presentation problem? DHCP is below IP on the protocol stack.

VPN seems like a lot of work to solve a very simple problem. What are the requirements for VPN to just solve a DHCP issue?

Reply to
Will

Why are you trying to do things this way? If they are domain clients why not stick them on the same subnet? E.

Reply to
E.

[...]
[...]

It solves the problem, what you want to have.

No. See RFC 2131. In fact, it uses the BOOTP message format, which uses UDP datagrams, see RFC 951.

Yours, VB.

Reply to
Volker Birk

We are trying to protect the domain controllers from attacks on ports that they don't need to use, and the firewall we are using can restrict the types of RPC traffic allowed to the domain controller as well, further liimiting the number of potential exploits against the domain controller.

The reason to want DHCP on the domain controller is that they the reverse and forward zone files in DNS both get maintained automatically, and it reduces by one the number of separate servers we might need to have around for special purposes.

Of course for the sake of DHCP you would like the clients and the server on one subnet. But for the sake of overall security between the clients and the domain controllers you want them on separate segments separated by a firewall.

Reply to
Will

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.