Enabling Internet Access - D-Link NetDefendOS User Manual

routes are automatically removed. This method is used in the detailed examples given later.
High Availability and Transparent Mode
Switch Routes cannot be used with High Availability and therefore true transparent mode cannot
be implemented with a NetDefendOS High Availability Cluster.
Instead of Switch Routes the solution in a High Availability setup is to use Proxy ARP to separate
two networks. This is described further in Section 4.2.6, "Proxy ARP". The key disadvantage with
this approach is that firstly, clients will not be able to roam between NetDefendOS interfaces,
retaining the same IP address. Secondly, and more importantly, their network routes will need to
be manually configured for proxy ARP.
Transparent Mode with DHCP
In most transparent mode scenarios, the IP address of clients is predefined and fixed and is not
dynamically fetched using DHCP. It is a key advantage of using transparent mode that users can
plug in anywhere and NetDefendOS can route traffic correctly after determining their location
and IP address from ARP exchanges.
However in some transparent mode scenarios, user IP addresses might be allocated by a DHCP
server. For example, it may be an ISP's DHCP server that hands out public IPv4 addresses to
clients located behind a firewall operating in transparent mode. In this case, NetDefendOS must
be correctly configured as a DHCP relayer to allow the forwarding of DHCP traffic between clients
and the DHCP server.
It may also be the case that the exact IP address of the DHCP server is unknown but what is
known is the Ethernet interface to which the DHCP server is connected.
To enable DHCP requests to be relayed through the firewall, the property DHCP Passthrough
must be enabled all the interfaces involved with transparent mode. Doing this is described
further in Section 3.4.11, "Layer 2 Pass Through"

4.8.2. Enabling Internet Access

A common misunderstanding when setting up Transparent Mode is how to correctly set up
access to the public Internet. Below, is a typical scenario where a number of users on an IP
network called lannet access the Internet via an ISP's gateway with IP address gw-ip.
Important: Transparent mode must be enabled on the interface
For DHCP passthrough to function, transparent mode must also be enabled on the
interface so the routes are added automatically. If switch routes are added manually
then DHCP passthrough cannot function.
384
Chapter 4: Routing