INTERNET
              |
              |
         CORE ROUTER
          |        \ (Fiber)
          |         \
        SWITCH     OFFICE Gateway (Nat)  --- LAN
          |
          |
   PROXMOX CLUSTER

• 1 ports plugged to the DMZ, 1 another to the office network, then the connection is physically isolated. But i lost the possibility in the proxmox cluster to use the 2 ports in // using ISCSI Multipath
• 2 ports plugged to the DMZ. use a tunnel/vpn to connect to the proxmox cluster
• 2 ports plugged to the DMZ, and minimise routing to the IP when it comes from the office gateway (not sure how to do it though)
• Plug the nas to a switch, create 2 subnets in 2 vlans and connect the 2 ports to it, and then connect the DMZ and the the LAN each to one isolated port of the switch.

What is stopping access from office gateway <-> core router <-> switch <-> NAS ? Assuming firewall policies and ACLs are correct.

Click to expand...

What's protecting the proxmox DMZ from the Internet? I'm guessing 'Internet' on the diagram is not the next hop from core router, but rather indicates generally where the Internet is in relation to this.

Click to expand...

benoitc said:

@fredbert the nas need to be accessible from the proxmox cluster and the network behind the office gateway. So either connected to the switch between the core router and the cluster or connected to this switch and on a switch in the office network.

Click to expand...

benoitc said:

well the the office gateway is in its own subnet on a different port of the router. maybe the is a way to connect them directly using a firewall rule ?

Click to expand...

fredbert said:

Ok, but what I asked was: where is the NAS today? Connected to the switch?


Routers route traffic between subnets, provided that they have been configured to do that. Even if the subnets are within different VRFs you can use the router to bridge two VRFs and pass traffic between them (subject to configuration etc).

So I'm not sure why being in different subnets is an issue when you have the office gateway (which will have routing capabilities, plus the NAT you identify) and a core router. You would need to add ACLs to the core router to permit office LAN traffic (hidden behind the office gateway's NAT IP) to router to the NAS in the proxmox cluster's subnet. And back, if the router works at packet level and not session.

If you just connect the NAS directly to each subnet then you are relying on the NAS not to bridge the two subnets in ways that are undesirable. While each subnet's devices can access the NAS, the NAS's services can likewise access each subnet... and today that's not the case and wouldn't be if you adapt your network's routing and security configurations. Why have a proxmox DMZ if you bridge it?

Click to expand...

• security policy that dictates interaction and controls between LAN segments of different use types: are there restrictions to expose to the Internet; business criticality of devices and data; intellectual property of data; data access restrictions.
• should devices on the different subnets actually have access to the same NAS? Is it the same data for both; Why is the NAS being used for different data.
• by allowing office LAN to route to the proxmox LAN will there be an increased risk (if proxmox LAN doesn't currently have the same external accesses as the office LAN).