Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I connect the 'net with a public static IP (my router's IP address for NAT) and a /29 subnet (for machines behind the router).

On my router, I have:

#sh ip route | inc x.x
     x.x.0.0/16 is variably subnetted, 3 subnets, 2 masks
C       x.x.196.62/32 is directly connected, Dialer1
C       x.x.206.72/29 is directly connected, BVI2

#sh run int dial 1 | inc zone
 zone-member security out-zone
#sh run int bvi 2 | inc zone
 zone-member security in-zone

The zone-pair is fairly restrictive. I would like to relax the restrictions for clients which first connect via a remote-access VPN:

#sh run int virtual-template 1
 zone-member security relaxed-zone

Now clients connecting via VPN must be assigned a private IP address. (I don't allocate public addresses to clients, right?):

# sh ip local pool

 Pool                     Begin           End             Free  In use   Blocked
 RANET100          20       1       0

So now if I want to get a packet to x.y.206.73 from, that's fine - the router has the information it needs. But it means that the host x.y.206.73 would have to permit traffic to its public-scoped IP address from a private address ... something it would normally be configured to ignore!

So this is a dirty hack, right? What is the True Path (TM)? Should I just multi-home the hosts with the public IP addresses so that they also have a private IP address?

share|improve this question
up vote 1 down vote accepted

It's entirely reasonable to have this setup. Consider it thus:

Your 'internal network' consists of multiple networks:

  • a globally routable /29
  • a locally routable /24 for VPN users

Your public host doesn't care that it gets a connection from an RFC1918 address unless you configure it that way. Just let it happen.

No need to configure another IP.

share|improve this answer
I like the language 'globally/locally routable' versus 'public/private' addresses - that helps to clarify matters. – David Bullock Jul 28 '11 at 6:46
This is a better answer IMHO. Let the edge router ensure that no packet with a non-globally routable address arrives from a global interface, but let a host with a globally-routable address exchange traffic with both local-only and global hosts. – David Bullock Jul 28 '11 at 6:53
I find it easiest to worry about global/private addresses at one point (well, ideally it's >1 point :) ) - the network edge. Keeps things simple. – MikeyB Jul 28 '11 at 13:44

"But it means that the host x.y.206.73 would have to permit traffic to its public-scoped IP address from a private address"

No it wouldn't, it'd mean that a host would have two IP addresses, which happen to have different routing expectations to the Internet as a whole.

There's no reason not to place more than one IP address on an interface; it's entirely possible, and in fact, IPv6, it's pretty much universal. Just make sure that your address selection rules for outgoing connections use the right address for the right task.

share|improve this answer
OK, that answers the question. Giving the host both private and public IP addresses is the best solution, then? – David Bullock Jul 21 '11 at 4:20
There's not enough information available to be able to say it's the best solution, but I'm fairly confident in saying it's a solution. – womble Jul 21 '11 at 5:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.