Cicso RV320, Port forwarding On Wan1 and Wan2

[RCarter9304]

I'm working from home thx to Covid-19 and have come up against a config challenge. Have a DSL with 5 static IP's, currently only using 1. The gateway is configured to pass through so it does nothing except host the public IP's. The LAN side is a single subnet where I host my own web and mail server and the RV320 forwards WAN1 to the respective internal hosts. All has worked flawlessly for some time.

The challenge comes from the current project, which requires a new host and dev mail server that needs to be fully functional for inbound and outbound mail. Got ahead of myself and set up firewall rules to accommodate this only to be stymied at port forwarding, ie. how does WAN1 know which internal IP's to route mail traffic to? My bad... Now I'm trying to figure out a workaround if possible, so here's my question. Would it be possible to run another wire from the gateway, utilizing one of the other public IPs, to WAN2, which is currently set to DMZ mode on the RV320? At present that doesn't look possible but before I started reconfiguring things any further and digging a hole for myself, though I would get some feedback from those more knowledgable. 

My firewall settings block everything, then I have individual rules for each service, one that routes service traffic to the appropriate host another that blocks it for all other internal hosts, creating pinholes to a specific host. 

I was kind of hoping the RV320 had some magic that would recognize that WAN2 was active once I plugged in a wire, make WAN2 available in port forwarding? Probably more like magic thinking on my part... Don't think I can use DMZ mode on RV320 cause the new host for dev work is a VM on the same subnet as two other VM's. Setting up a new virtual LAN is also over my head as is one to one NAT. As you can see, I'm getting beyond my basic understanding of networking as I'm a software developer and not a network guy, so this is where I ask for help.

As this work is contract work, I would consider upgrading my RV320 to a more powerful router, I just don't know which one would best fit the current need.

Appreciate any advice I can get, thanks in advance.

[Georg Pauwen · Accepted solution]

Hello,

I think the problem will be that you have several IP addresses, but they are from the same range, so if you enable the second WAN interface, it won't even let you add the IP address because you have an overlapping address space.

That said, I wonder if you cannot just add the dev and mail servers to the current subnet, and then configure custom services for these servers (meaning, you configure a different port as external port for e.g. SMTP) ? I am not sure if the RV320 lets you do that (page 34 of the attached guide). The idea is to run both servers, using different external ports.

https://www.cisco.com/c/dam/en/us/td/docs/routers/csbr/rv320/administration/guide/en/Updated/rv32x_ag_en.pdf

[RCarter9304]

Using different ports for SMTP, POP and IMAP is what I've been doing during early development stages, so yes that works, but I haven't tested this through the RV320. Still, I would think it's a piece of cake with the ability to define custom service ports, thanks for suggesting, and even though I would prefer to avoid it, it may come to that.

 My question was in part, also anticipating push back from the client if having to go this route, you know how non-tech clients can be, hoping I could avoid it when users start beta testing features. I'm going to hold out a bit longer for more suggestions from others, there may yet be a way to cobble something together with what I have, something the client will agree with.

But for the life of me, I'm still confused about what the distinct differences are between Port Forwarding and Firewall Access Rules. Firewall rules allow you to select WAN1 or WAN2, but port forwarding doesn't, and to confuse it further, your firewall rules don't work unless port forwarding enabled. So I'm assuming port forwarding is doing its thing for both WAN interfaces, and yet it can only forward to one subnet on a device that can have multiple VLANs as subnets. Kind of looks like some pieces were left out when putting a lid on the box.

The RV320 documentation is straight forward and easy to understand for basic setup and configuration, but lacking when combining router features for something like this. In fact, I'm not sure I'm even asking the right questions. So as a software guy, what other network guys say you can do and how you get there, looks like voodoo to me. I'll keep hoping a witch doctor will see this post and lift the lid on the black box to reveal its mysterious secrets.

And if the client balks on using non-standard ports for testing, I’ll be back here asking for a recommendation on a model that can do these things.

Thanks for the quick feedback.