Two Wingate LAN

[Nev]

Hi all,

Need a bit of advice before solving an emerging problem.

Long story // short - small workgroup with two Wingate's Servers as gateway to a Private Intranet, the other Internet which has worked well for five plus years.

Time to solve some problems as their seems to be a migration to the Internet from the Intranet and some applications are requiring NAT to both services!

What I am thinking is to abandon the Intranet Wingate Server and try one of two things:

Add an IP and Gateway to the Intranet subnet to the external NIC of the primary Wingate [both routers then into a switch on this interface]

Or

Add a third NIC to the Wingate Server, assign a new IP and Gateway for the Intranet and set this to be an External interface

Probably the latter is more likely to be more successful?

Also DNS is from the Intranet, so I would have to point the resolver at that system, otherwise the Intranet hosts won't resolve at all.

Thoughts appreciated!

[jasona]

I think the 3 NIC option would be best, why would you set the intranet as external though?

[Nev]

I think the 3 NIC option would be best, why would you set the intranet as external though?

Thank you for the reply, it is appreciated.

Well the Intranet has a policy which requires the client to provide their own firewall and has an estimated 10,000 plus users' on it too, so we receive hits from compromised machines in there all the time and I thought the designation of the interface as external might prove the routing.

My other question which I think will stump this is; as some applications require NAT to both services, will it route from both the connections properly?

Another idea which hit me, was to shift the second Wingate machine into router only mode and give the users' in the lan [about 11] a second ip address on another subnet for the Intranet.

Thoughts appreciated! :)

[Nev]

I think the 3 NIC option would be best, why would you set the intranet as external though?

Hi all,

Not even that difficult!

I tried the 3 NIC idea and wasn't surprised when it wouldn't work.

Single user needed sftp via nat through the non default gateway at Wingate No2 = use 'persistent route add' to solve.

................destination...............................first hop
route add -p 203.xx.xxx.x mask 255.255.255.255. 192.168.0.1