Multi-WAN Scenario with lease line and public internet line

How can i deploy multi-WAN link scenario where lease line need to be take care only inbound traffic to access internal servers by external hosts(NATed) and public internet takes internet access by internal users. Both traffic should be isolated each other. Please guide.

To deploy a multi-WAN link scenario that isolates inbound and outbound traffic, you must use a networking device that supports Policy-Based Routing (PBR).


1. Inbound Traffic for Internal Servers

The key here is to use a one-to-one static NAT or destination NAT on your firewall or router.

• Configure the leased line's public IP address to be the destination for all inbound traffic to your internal servers.
  
• The firewall or router then translates this public IP to the private IP address of the internal server.
  
• This ensures that all inbound requests from external hosts are directed exclusively through the leased line.
  
  
  

2. Outbound Traffic for Internal Users

For outbound internet access, you will use Policy-Based Routing to direct this traffic through the public internet WAN link.

• Create a PBR rule that matches traffic originating from the internal user network.
  
• The rule should then direct this traffic to egress via the public internet WAN interface.
  
• This traffic will use Port Address Translation (PAT) a form of NAT where multiple internal private IPs are translated to a single public IP, allowing internal users to share a single public IP for internet access.
  
  
  

3. Traffic Isolation and Security

This setup effectively isolates the two traffic flows:

• Inbound NAT traffic never touches the public internet link.
  
• Outbound user traffic is never routed through the leased line.
  
• Use a firewall to enforce strict access control lists (ACLs) and security policies for each WAN link.
  
  
  
  • For the leased line, create rules that only allow inbound traffic on specific ports (e.g 80, 443 for web servers) and from specific external IP addresses, if possible.
    
  • For the public internet link, establish rules to filter and inspect outbound traffic from internal users, preventing unauthorized access or malware transmission.