Source NAT for secondary networks?

[BR Thurr]

Guys,

First of all, hello to all of you.

I've been desperately trying to set up my home network in a DMZ-Lab type configuration. Here's my current configuration:

Edge (Home) Router: Asus RT-AC87U running DD-WRT v3 buld 29193
Internal Router: VyOS 1.1.6 running on Hyper V

Here's what I'm trying to accomplish (yes, I stole these, but I've configured them exactly as outlined. If you'd like more background on what I'm attempting to accomplish, see this.)

I've also configured the VyOS router as follows:

Hosts on the DMZ subnet can browse the Internet with no problem. However, my "internal" hosts cannot. With DD-WRT, this can be solved by entering the following in the Firewall section of the router:

And....it works! But only until DD-WRT crashes repeatedly which was why I moved on from it months ago. I flashed again with DD-WRT last night solely for the iptables command above. But it's just not worth it due to DD-WRT's instability, particularly on my model of router.

So my question is, can this be done with AsusWRT-Merlin? If so, how? I'd gladly switch back if this is possible, as the ASUS/Merlin firmware has been very stable and feature-rich.

Any help would greatly be appreciated. Thanks!

 

[mstombs]

No idea what you are doing, but I'm sure it can be done with AsusWRT-merlin for `get_wanface` I guess you should use `nvram get wan0_ifname`.

Enter first from an ssh command line, and if it works add to the jffs nat-start script

https://github.com/RMerl/asuswrt-merlin/wiki/User-scripts

 

[Danifunker]

How far did you get with this? I'm trying to setup a secondary network segment for a lab I'm building and ran into a snag... My setup is similar to yours with VyOS. In my case I'm trying to do a simple routed network (I have a static route on my main lan to my lab network, the lab network has a default gateway of the main lan router) but I'm having a routing issue between the servers on the different ip segments.

 

[sfx2000]

You might need to go back to Hyper-V, and build the virtual interface for the Vy-OS interface, once done, you can put it, and the children attached into the DMZ of the primary router/AP interface...

Keep the scopes separate...