Can't Remote Desktop after switching to Uverse with static IPs

It's true that if you're using DMZPlus mode for a router-behind-router setup that no NAT or firewall is in the way (with a very few exceptions that are peculiar to the 2Wire RG).

However, you're not using DMZPlus, you're assigning one of your static IPs to the Sonicwall.  In that case, you have to disable the firewall manually.  Go to the following page on the 2Wire RG:

http://192.168.1.254/xslt?PAGE=C_2_4

In the list of devices, find the SonicWall.  Change the Firewall pulldown menu to "Disabled".  Then click the Save button down at the bottom of the page.

Thanks for the reply SJ,

One of the things I was instructed to do was to change the IP address of the 2wire to the 10.0.0.0 / 255.255.0.0 series so that it did not conflict with the Sonicwall's address (192.168.1.254).  As such, the link you provided did not work for me.  I tried 10.0.0.1/xslt?PAGE=C 2 4 but no luck there.  I was able to log into the UI of the RG by going to 10.0.0.1, but I don't see an option to disable the firewall.  Should I have changed the RG's IP address?  Is there another was to get to the interface that allows me to disable the RG's firewall.  FYI the RG ATT provided is a  2701 HGV-B.

Also, for clarification, are you saying that I should not have the Sonicwall set to DMZ mode in the firewall settings?  I suppose if the idea is to disable the firewall, than it does not matter what this setting is.

Lastly, can you offer any assistance with the Sonicwall in terms of my verifying that the DHCP settings are correct?

Thanks for your help.

IB

SJ,

To further clarify (or perhaps somewhat restate) my issue, our IT consultants have asked ATT to put their RG in bridge mode, which I now understand cannot be done.  Your 3/16/2011 post regarding using Uverse for business recommended setting the router behind the RG to DMZ mode to achieve the closest approximation to bridge mode that Uverse is capable of.  Step 8 of this process was as follows:

8. Restart your router, when it gets an address via DHCP again, it will be the public outside IP address.  At this point, you can leave your router in DHCP mode (make sure the firewall on your router allows the DHCP renewal packets, which will occur every 10 minutes), or you can change your router's IP address assignment on the WAN interface to static, and use the same settings it received via DHCP.

As I said in my OP, the Sonicwall is receiving the public address, but I am unsure how to properly set the DHCP settings.  Are the symptoms I am having (i.e. no remote desktop or webmail access) likely related to these DHCP settings?  Thanks again for your help.  IB

No, I doubt the symptoms you're seeing relate to DHCP.  Let's assume that's working properly for now.

Your issue is the firewall on the RG.  It must be turned off for the SonicWall's IP address.  You stated the SonicWall is on a static IP out of your assigned static IP block.  This is fine but this is a different configuration than using DMZPlus mode.

You should have mentioned that your RG is a 2701.  This means you have ADSL2+ based U-Verse, not VDSL.  Thus, the link I gave you will not work right.

You need to find the IP Address Allocation page in the 2Wire 2701.  It will have this same firewall setting on it for the SonicWall, you need to disable it.  I can't walk you through how to get there, I have never configured a 2701.

I am trying to be as clear as I can given my lack of technical expertise.  Please forgive me if I am missing the basics.

According to our IT consultants, in true bridge mode, all 5 of our usable IP addresses would be passed to the Sonicwall which would then allocate them using one-to-one NATing.  In it's current DMZ configuration, the RG appears to be only passing one IP to the Sonicwall (this IP is within, not outside, of the usable static IPs provided by ATT).  With only one IP address available to the Sonicwall, we are not able to allocate a separate static IP to each of the following:

1. Our mail server

2. Our file server

3. Our remote connections

4. One other piece of equiptment that allows our consultants to reboot our servers remotely (not a critical for us)

Do we need to use an ATT RG other than the 2701 to have multiple static IPs passed through?

If there is no way to have multiple IPs sent through a single port on the RG connected to the Sonicwall (my understanding of a true bridge), is there a way to connect more than one of the RGs Ethernet ports to the Sonicwall and pass multiple addresses that way?  There is only one WAN port on the Sonicwall, but perhaps some intermediary device could be used?  I am trying to think outside the box here which could be dangerous considering my lack of networking knowledge.

Since my last post our consultants have come up with a work around which is to turn off "one to one NATing" and instead run our remote desktop connection through port 3389.  This has given us the ability to log in through Remote Desktop (some good news) but does not allow us to access our webmail interface (previously accessed through mail.domainname.com) and also does not allow our IT consultants to do the off-site monitoring of our systems that they typically do.  I was told the reason we can't use webmail (which is how our mobile phones use to connect to our mail server) is that it would need to use port 80, and that port 80 is already being used (I believe by the Sonicwall itself).  I don't completely understand this new setup, but it apparently can't give us all the functionality we had prior to getting Uverse.

Thanks for sticking with me and offering advice to someone with a growing but still very limited understanding of the networking world.

IB

Thanks again SJ,

Regarding opening ports to "do everything [we] need to as long as the port numbers are different," does this include running both the Sonicwall and the webmail interface .  As I said in my last post, we have been told that both of these "devices" use port 80 and therefore we cannot use both.  Is there any reason the webmail or Sonicwall can't use a port other than port 80 to avoid a conflict?  In other words, are certain functions dedicated to particular ports or can you assign any type of device/function to any port?

Regarding the VPN server alternative, would this system replace the Sonicwall in our current setup?  What sort of startup cost are we looking at to set up a VPN server?

Thanks.

IB

Certainly, the mail server could use a different port than 80, either only on the public side of the SonicWall or on both sides depending on how you want to configure it.

The SonicWall may be able to use a different port than 80, I have no idea if it has that capability, I have never used one.  I always use Cisco equipment for business/enterprise installations.

VPN services are built in to Windows Server, if that's what you use, making the cost nothing.  It would not replace the SonicWall.

At this point, your questions are well outside the scope of U-Verse and involve network architecture.  You need to get an on-site consultant to assist you with this so that they can evaluate the situation with knowledge of the details of your network.

I agree.  My last post was simply an attempt to educate myself so I will be better prepared to have the next conversation with our IT consultants.  Thanks for all your help.

IB

I am back in this morning, I have no new updates and tracert shows the problem still exists. I will escalate.

Disregard this, I posted to the wrong topic!