Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our ISP has given us a small subnet of WAN ips for the organisation where I work. If I assume the subnet is 11.22.33.40/29 and the ISP gateway is 11.22.33.122. I have a Linux box with two interfaces. I have to set it up as router-gateway (non-nat) with the ip 11.22.33.41 so that the other hosts can have ips ranging from 11.22.33.42 to 46 and use the router ip (11.22.33.41) as the gateway. I need help for setting it up as the router. Can I bridge eth0 (which faces ISP) and eth1 and and give it the ip 11.22.33.41 and specify the default gateway as 11.22.33.122? What iptables rules should I use? All hosts should reach WAN directly without getting firewalled like any other WAN hosts. I prefer to do it on ubuntu server. I don't want to make my employer (an educational institution) to shell out heavily for cisco routers. At least that money can be used for some other useful projects.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Configuring your machine as a bridge would indeed work just fine. Detailed instructions for setting it up are available (among other places) at http://www.linuxjournal.com/article/8172

I recommend looking into using a distribution like Freesco though, if you are a) not overly familiar with linux/routing and b) aren't going to use the machine for anything else. The targetted linux/router distros tend to have nice interfaces that would allow you to setup the machine however you wish, without digging into the internals. Obviously, if you also want to run various services on the router, then stick to ubuntu.

share|improve this answer

You don't need a router for that, your ISP already provides one. Just get a switch, connect the hosts that require direct Internet access to the switch and also the router/gateway/modem whatever from your ISP and off you go. Since your ISP won't provide a DHCP service (unless you know different), you will need to put the relevant host interfaces onto static IP addresses.

One observation: The ISP's gateway cannot be 11.22.33.122 for a subnet of 11.22.33.40/29. The gateway must lie within the subnet. It is usually either 1 down from the broadcast address (in your case the broadcast would be 11.22.33.47 and therefore the gateway would then be 11.22.33.46) or it is the lowest address in the subnet. I suspect this got a bit muddled when you modified the addresses for posting here, but nevertheless it is important for you to understand this part, because otherwise you'll struggle to get anything working.

Example from my private server (hosted in the UK:

IP address 217.10.144.210
Bcast:217.10.144.215
Mask:255.255.255.248 Gateway 217.10.144.209 Network 217.10.144.208

In this case the gateway is one up from the bottom, but it can lie anywhere within the subnet (that's the ISP's decision).

Since all of your hosts are connected directly to the Internet, you will need to have a firewall on each one of them, protecting them indvidually against any threats. Obviously those rules depend on what services these hosts provide.

share|improve this answer
    
In my case, if I take up your example, the isp has not set up 217.10.11.208/29 network. I have to set it up and make one machine a gateway with the ip 217.10.11.209. I have to specify other 217.10.11.208/29 network hosts to use 217.10.11.209 as gateway. But where 217.10.11.209 router can forward the requests. For that I have to use the isp supplied 11.22.33.122 gateway. To return to my example, a network host, lets say, 11.22.33.42 will forward the request to the gateway I have set (11.22.33.41), and this gateway will forward it to ISP gateway 11.22.33.122. –  nixnotwin May 12 '11 at 12:49
    
Well, the ISP has actually set up the 217.10.144.208/29 subnet, and my server is using one of the addresses in that subnet. The other addresses are not currently in use, but the ISP could decide to give them to other people (or indeed to me, if I applied for it). Why do you want to make this more difficult than it has to be? Since the ISP already provides you with routing into this subnet, all you really need is a switch. –  wolfgangsz May 12 '11 at 14:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.