Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I do know a little about networking but im having some trouble trying to figure out in my head how to make this work before comcast comes to do the install on thursday.

Right now we have AT&T DSL with one dynamic IP so im using dyndns to run a webpage, a sharepoint site, a helpdesk site, and email all using port forwarding thru a Linksys gigabit wireless router. We have a small domain with about 10 workstations also. We will be getting comcast business class and 5 static IP's

My problem is trying to figure out how to get the computers that will be using the public IP's to be able to talk to our DC which will be behind the linksys router. From what i have been reading i know i could just allow one public IP to pass thru the comcast router to my linksys router and life would go on as normal just as it is now. However, once i take our web server, which needs to talk to the DC because we have some apps that require AD usernames/passwords, and move it out from behind the linksys router to give it one of the public IP's i dont think it will be able to get thru the router to talk to the DC. The DC is also running our DHCP server.

To make this work, would i need to just scrap the idea of using our linksys router and just use the comcast router/gateway? If i did that can i just have the DC give out IP's in our private 192.168.5.* scope, and give out the IP's in the public space as well? does it work like that?

Right now the linksys router only allows me to forward port 80 or 443 to one IP, im assuming the comcast router will allow me to forward 80 thru to whichever public IP its intended to go to?

Sorry if im making this more confusing then it needs to be but i cant figure it out in my head!

share|improve this question
up vote 0 down vote accepted

Sounds like the best way would be to put your Comcast modem/router into bridge mode, then get a business class router/firewall (I like Sonicwall) and configure the WAN interface with your static IP addresses. In the firewall and NAT rules on the Sonicwall, setup the ports (Sonicwalls actually have a handy wizard for this):

  • port 80/443 goes to web server 1 (
  • port 80/443 goes to web server 2 (
  • port 25 goes to email server (
  • etc.

This will allow you to essentially keep everything behind the firewall the same (no changes to DHCP or configuring servers' NICs with wan IPs).

Some other points:

  • Keep everything behind the firewall if possible. It doesn't sound like you need to move your web server in front of the firewall, so don't. Moving it in front of your firewall will make the web server that much easier to hack and will significantly complicate the AD communication back to your DC. We could get into a big discussion on DMZs and AD communication and what's possible and not possible, but for your situation, it sounds like it would be logical to just keep everything as-is and do the port forwarding as described above.
  • I never rely on the ISP's equipment to do anything other than provide an interface to their connection (i.e. just be a modem). Their routers are usually sub-par quality, lacking features, poor support. Bridge from the ISP's modem/router to your own equipment whenever possible. I setup offices around the country and have had a chance to work with lots of different ISP's. I've found it's better to just make the ISP equipment as dumb as possible and use your own equipment for all the firewall, port forwarding, wan IP config, etc. Using a sonicwall, for example, you can utilize all the support resources of sonicwall to achieve whatever you need instead of relying on Comcast 1-800-WHO-CARES to try to configure whatever the Comcast/Time-Warner/Verizon/AT&T router flavor of the month is. Just get the ISP modem/router into bridge mode and you're done dealing with their device.
share|improve this answer
OK awesome thanks, but i would be ok using the Comcast router until we have money to purchase a business class router/firewall? – Tom B Jun 18 '11 at 17:36
What do you think about the Untangled software that you install on a machine and it acts like a firewall, do you have any experience with that? Im just trying to think of a free solution until we have the budget to upgrade – Tom B Jun 18 '11 at 17:37
If the comcast router will handle the multiple static IP addresses and allow you to forward ports for each IP, then it should work for what you need. Not sure what model your modem/router is. On a side note, you can get a sonicwall TZ 200 currently for about $380. This also gives you 90 days of phone support from Sonicwall. The TZ 200 would do everything you need (and more, like an IPSEC vpn) and give you with a very stable system. – user78940 Jun 19 '11 at 16:17
Just for the record, the comcast router doesnt allow you to map the same port to more then 1 IP. It will allow you to do 1 to 1 nat but you have just lost all your protection that way – Tom B Jun 23 '11 at 21:46

The "least impactful" approach is to probably go with a NAT router which can service multiple public/WAN IPs - whether that is through the Comcast equipment (if it has the functionality you need) or through a replacement of the Linksys. That will allow you to specify per IP-to-port mappings for each Internet/WAN IP simultaneously, so your current internal IP plan can stay the same.

share|improve this answer

TommyB, I was close to your exact position with Comcast. I do IT for a living, was using Comcast home service, running a Windows server, including Exchange for e-mail. My port 25 kept getting blocked, so I moved to business class. I also use Dynamic DNS, and have a SonicWALL firewall in the middle.

When they put in my business-class modem/router with its small switch, it became clear very early on that the new modem would not work because it did not handle bridging so it kept giving a 192.168.x.x IP address to the WAN interface of my SonicWALL which was being reported to my dynamic DNS provider, so I had three choices:

  1. Pay through the nose for a static IP (then it can be put into bridged mode)
  2. Dump the SonicWALL (in your case the Linksys) and use their modem as a firewall, which was not appealing since it is very limited
  3. Or simply trade the business-class modem for a home version, which can be bridged, but make sure they kept my IP in the business-class range.

I also had to use their smarthost with my username and password for relaying e-mail.

I chose the last, and have been working that way for over a year, but since you already made the commitment to the statics, ask them about putting it into bridged mode. You will probably need to upgrade your Linksys to a more functional firewall.

In the alternative, if you are OK with the Comcast modem/router as a firewall, it also does 1-to-1 NAT (as well as port forwarding), allowing you to use multiple external IP's and map them to internal servers.

share|improve this answer
Have you ever heard of or used the untangled software firewall? I have seen that pop over on a few times and im assuming that would be better then comcast's router – Tom B Jun 18 '11 at 17:39
@Tommy B Well, you would still need a Comcast modem/ untangle gateway would replace the Linksys. – KCotreau Jun 19 '11 at 2:25
sorry yea i meant firewall. So i would just pass everything thru to the untangle server and let it handle routing and firewall policies correct? – Tom B Jun 19 '11 at 3:13
Right, but you would want that comcast modem in bridged mode. – KCotreau Jun 19 '11 at 10:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.