Can I remove NAT but still use the Firewall?

[Magnesium_CW]

Hello all,

My home setup is I have a modem with a DHCP server and an Asus RT-AC68U running as a router / firewall / wifi hotspot. I'd like to install an inline tap between the ISP Modem and Asus router (like http://greatscottgadgets.com/throwingstar/) and run a Network Intrusion Detection System (like http://www.securityonion.net/) to be able to monitor for virus infections and know which of my hosts are compromised, but having NAT on the Asus stops me from determining which member of my network is infected.

I want to disable NAT on the Asus router and use DHCP from my modem to solve knowing which asset is generating which network traffic, but I don't want to lose the amazing firewall capabilities of the Asus router in the process. Is there a way I can have both?

Thanks,
Magnesium

 

[ColinTaylor]

Does your modem also provide NAT? If it doesn't how will your LAN devices be able to connect to the internet?

 

[Calisro]

yes. you can disable nat. but are you going to pay for public ip addresses for each of your devices?

 

[System Error Message]

Consider running a UTM which is basically what you're looking for. Have the UTM also perform the NAT (or in some cases the UTM can filter at layer 2 instead so you can just put one in between).

 

[snapilica2003]

I think setting up your ASUS router in AP Mode will more than suffice. DHCP and NAT are turned off and all traffic is passed to the border router (in your case the ISP modem).

 

[Magnesium_CW]

Does your modem also provide NAT? If it doesn't how will your LAN devices be able to connect to the internet?

Sorry, that was a vital point I forgot to mention. My ISP modem also has a firewall an NAT's everything that it provides a DHCP address for. It's one of those ISP modems that they remotely control and I don't trust either what they do with it nor what malicious smart people on the itnernet can do to my internal network if compromising the ISP modem. This is why I want my own firewall to block unsolicited internal traffic.

 

[Calisro]

Got it! Do they not allow you to bridge their modem/router?

 

[Magnesium_CW]

I think setting up your ASUS router in AP Mode will more than suffice. DHCP and NAT are turned off and all traffic is passed to the border router (in your case the ISP modem).

Thanks Snapilica2003, but this would lose the ability for using the firewall of the Asus router. Maybe that's what has to be done in this scenario, like System_Error_Message has implied in his/her response, and I have to use a 3rd system between the router and the modem to do next gen firewall stuff. I was trying to avoid that scenario and that's why my OP is here asking if there's a way.

Anything anyone else can suggest before I consider this thread closed as a no? Maybe something RMerlin can think of?

Thanks again,
Magnesium

 

[ColinTaylor]

Have you tried disabling NAT (WAN > Internet Connection > Enable NAT = No) and seeing what happens?

 

[Magnesium_CW]

Got it! Do they not allow you to bridge their modem/router?

If I understand you correctly, my modem will do a full DHCP internally and I can set my internal router as a bridge / AP but then I think I lose the firewall capability of it.

Have you tried disabling NAT (WAN > Internet Connection > Enable NAT = No) and seeing what happens?

I have tried that. My Modem then fails to route traffic back to my internal network devices properly. Maybe there's a configuration I'm missing to allow this to happen gracefully, like an IP address overlap between my modem and router, but I've been unable to figure out how to get my router to send everything router related over the same switch port to my router (if that makes any sense).

 

[Calisro]

most modems and isps let you bridge their modem so your router gets the public ip.

EDIT: Sorry, I re-read what you are trying to accomplish. You actually want the ISP modem to be the dhcp/nat device so you can plug a tap on hte line and continue to use the firewall.

 

[Magnesium_CW]

<snip> You actually want the ISP modem to be the dhcp/nat device so you can plug a tap on hte line and continue to use the firewall.

That's right. @RMerlin, any ideas?