VM Business : Hitron and ASUS ZenWi-Fi AX

[Fitzy007]

Hi Everyone

I'm tring to get on the front foot here and my knowledge is limited:- My boss has just purchased a voom 500 bundle with 5 static IPs and an ASUS ZenWi-Fi AX which he would like configured to provide access, both internal/external, to a windows 2016 server essentials box as well as general internet access.

I have had a good look around and I see that there have been a number of problems historically with the hitron but that a lot of people now seem to be able to overcome them.

Having read a number of threads with responses from ccarmock/General Maximus and others I note that (which of course I could have completely wrong?):

a. The default configuration for the Hitron will use the first of the usable IP addresses
b. The Asus will need to be manually configured with the next IP in the range as a static address on it's WAN interface.
c. The subnet mask will be 255.255.255.248.
d. The default route (or next hop address) should be the IP address of the Hitron.
e. Rather that connect the server directly to the hitron and assign a static IP it is best to do this via NAT/PAT on router and control the firewall rules there.

To that end I have a couple of questions that I am hoping somebody may be able to help me out with:

a. does anybody have any direct experience with this setup/configuration - if so are there any pitfalls to watch out for?
b. Is the ASUS ZenWi-Fi AX suitable (i dont think he's unboxed it yet)?

Any and all assistance would be appreciated.

[ccarmock]

I have a very simialar setup, albeit with a Draytek as opposed to an Asus router, suspect the Asus will work just fine though. One of the reasons I went with Draytek is they support multiple WAN IP addresses so I can map other public IP addresses to different services. It's not a feature that every router supports- notably the Ubiquiti devices don't for example.

I agree with all your points a to e

[mrmistoffelees]

Your server should already be using a static IP address on the existing internal LAN
Use the ASUS router and port forward, DO NOT put it on a public address.

Out of interest, which inbound access is wanted?

[Fitzy007]

Thank you ccarmock and mrmistoffelees - comments are appreciated

Hopefully they do have a static IP but I'm not convinced and I wouldn't be surprised if its not. It appears that the server has been purchased off a 'mate' from another company.

Not entirely what you mean by 'inbound access' mrmistoffelees? but essentially my presumption is that remote access will be required from 5 locations across the country (we have 5 office locations): obviously I will need to determine its intended future use but I think he wants it used as a file server predominantly?

[mrmistoffelees]

I do hope if that’s the case you have site to site VPN’s running or your clients in offices will connect via vpn to the server in question.

Even locking down by source CIDR on your port forward is not without risk and permitting from any external is just suicide

[Fitzy007]

Hoping to get up there tomorrow to see what the lie of the land is but i'm pretty sure that no site to site vpn will be in place, that being said I think 2016 essentials provides for vpn connectivity out of the box doesn't it? or are you recommending that an alternative/additional system needs to be in place?

[mrmistoffelees]

Originally Posted by Fitzy007

Hoping to get up there tomorrow to see what the lie of the land is but i'm pretty sure that no site to site vpn will be in place, that being said I think 2016 essentials provides for vpn connectivity out of the box doesn't it? or are you recommending that an alternative/additional system needs to be in place?

Hopefully you got this all sorted, apologies for the late response.

Yes Server Essentials contains something called Anywhere Access IIRC, Port forward required ports through the Asus