1

I have a small network with a business-class cable modem. I have a *.192/29 block assigned to the internal side of the modem. The first usable IP, .193, is assigned to the cable modem interface. I have no access to the config on the cable modem - that belongs to the ISP.

As I see it, I have two options. One is to subnet the /29 into two /30s. The problem with that is that it will give me two essentially point-to-point connections. .193 on the modem connected to .194 on my router, then .197 on another interface on my router connected to a device using .198. Once I do that, my IPs are exhausted and I only have one device, other than the router, online.

The other option is to put the modem and any other devices on a common segment prior to the router. (This is the setup I currently have, using a Cisco 2651XM router with a NM-16 switching module.) This allows me to use .194 through .198 for active devices. The issue that I have with this solution is that I have no way to put a firewall access list on the traffic. I have a server running on IP .195. Traffic from the Internet to that server comes from .193 on the modem and goes directly to .195, staying within a single VLAN on the switching module. The interface connecting the modem is a layer two port and won't take an ACL. It doesn't go through a routed interface, and so won't go through any access lists. The server is wide open to the Internet with no control of traffic hitting it. I'm not intimately familiar with VACLs, which might work, but they seem to only be supported on high-end switches, and aren't available on the NM-16.

One possible solution would be to put a private IP on the server and use NAT to send the Internet traffic to the server but that causes issues with inside devices trying to reach the server, since their traffic won't be coming in through the outside NAT interface. This seems like it should be a common problem but I can't find anything on the 'Net discussing it. Am I missing something simple?

Improve this question
3
  • Why can't you connect the modem to a regular Ethernet port on the router rather than a switch port?
    – David Schwartz
    Feb 14, 2012 at 20:21
  • I can. Then how do I connect my servers with IPs in the same subnet as that routed port?
    – user69971
    Feb 14, 2012 at 20:45
  • That's what BVI and IRB are for.
    – David Schwartz
    Feb 14, 2012 at 22:26

2 Answers 2

Reset to default
2

Why not use RFC 1918 addresses internally (including on the server) and NAT/port forward traffic to internal hosts as needed, as you seem to be suggesting as one of your potential solutions? What do the internal hosts need to access on the server for that they're unable to using RFC 1918 addresses internally and doing NAT/port forwarding to the server?

Improve this answer
3
  • The biggest issue is that an internal computer can't go to www.myserver.com, as that resolves to the external IP. Similar issue with configuring the mail server. You'd have to point your browser to the inernal IP, add a custom entry to the host file to do point myserver.com to the internal IP, or use some other kludge. In addition to having to install the kludge on all the computers, you have the issue of laptops which might be on the internal network or might be taken home and connected to a home network. If you have things munged to work inside, they no longer work outside.
    – user69971
    Feb 14, 2012 at 20:04
  • 1
    Split Horizon DNS can fix the resolution issues. Also enabling hairpin NAT on the router might fix this, generally only higher-end newer router support hairpin though. Joe's setup is generally the "more secure" configuration, though Paul's answer can be just as secure when configured properly.
    – Chris S
    Feb 14, 2012 at 20:22
  • If you're going to configure hairpin or any other kind of NAT it would be worth putting your publicly accessible servers in another subnet (the DMZ) to avoid asymmetric routing and just as a general good security practice.
    – resmon6
    Feb 14, 2012 at 21:51
2

Ask the ISP to change the modem to act as a bridge rather than a router and put your public IP's on your own equipment so you can forward them wherever you need.

Improve this answer
1
  • The only difference that would make would be that he would have one more address to play with. Otherwise, nothing would change.
    – David Schwartz
    Feb 14, 2012 at 20:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .