If I place a firewall behind a Peplink Balance Router, Placing all Users if office behind the firewall with NAT enabled.
How does the WAN link load balance works?
LAN ---------- Firewall ---------- Peplink ---------- Internet (3 ISPs)
LAN : 10.100.100.0 /24
Firewall WAN IP : 10.50.50.5 /24
Peplink LAN : 10.50.50.0 /24
Peplink WAN IP : Static Public IP
How the load balance works as all users traffic will get NATed to Firewalls WAN IP (Peplink LAN)
technically your scheme can work for most applications but it may be quite complex to manage it. All difficulty depends on your inbound/outbound balancing requirements.
If I were you, I would consider those topology alternatives:
Use firewall of Peplink router without additional security appliance.
If intermediate firewall is necessary, check option of:
A. Firewall in L3 NAT mode + Peplink router with advanced featureDrop-in mode
B. Firewall in L2 bridge mode if possible.
So what will trip you up in this configuration is that the only IP the Balance sees is the WAN IP of the firewall. The default HTTPS persistence rule is set to ‘by source’ to keep all https traffic from the same LAN IP destined for the same internet service on the same WAN.
Instead - if you have to be in Layer 3 load balancing mode like this you want to use ‘by destination’
However it is still a considerable limitation - depending on the number of devices behind the firewall. And if you need to open ports for inbound services you have to open them on both the balance and the firewall.
Drop in mode doesn’t really help with load balancing in this scenario since you are still WAN side of the Firewall. It does make it easier to manage firewall rules and port forwarding though since you would continue to do that on the original firewall.
The best load balancing experience would likely be - as @Ricardas suggested, if you could change the topology to have the firewall as a transparent bridge or just get rid of it completely (depending on the customer requirement).
Just disable the NAT for the firewall will do. Make sure firewall have default route to Balance LAN IP and Balance have the static route for the LAN : 10.100.100.0 /24 route via the Firewall WAN IP will do. This is the comman design whereby you have core switch/ firewall running behind Balance device.
