Two IP Addresses, One Building

Question

My company currently has a single IP address assigned to a server which is the entry point to our local network, i.e. outside connection -> modem -> server -> LAN. If I were to add another server that would to "sit along side" the current server, with its own non-local IP address, what kind of device would I need to place in front of both servers to allow them to function with this configuration? A router, a switch, or something else? Would there by any special configuration or feature that this device would need?

Answer 1

It depends on how, on your diagram, your server communicates with the modem, what your modem is able to do, and how your ISP will provide multiple routable IP addresses.

If you have static addresses, your ISP may assign you a small subnet and route everything trough a single PPP session. In that case you need a master device to handle the PPP session and act as a router for the other publicly-reachable machines. I have not seen typical home grade modem/router combos do this, except when running a custom Linux-based firmware (then it works great). A server could also handle this job (or a separate router device) as long as the modem can act as a PPP endpoint (i.e. providing PPPoE). Most home modems must be put into "Bridge mode" to provide PPPoE.

It may also be possible to provide each public IP in a separate PPP session. If it is the case, and if you have a PPPoE modem, you may hook up your servers directly to the modem (optionally trough a switch) and run a PPPoE client on the servers.

Lastly, you may have a modem/router under control of your isp, and provide public addresses trough its DHCP, in which case it is their job to ensure your addresses get correctly distributed, and you would just need a simple switch.

Answer 2

I would suggest running "something" as a NAT firewall on your public IP address rather than using your OS-X server as the firewall. This could be a dedicated device such as a Cisco ASA, Sonicwall or Watchguard, or a firewall distribution like ipcop or pfsense. You could then setup port forwards as required for each service that you want to be made accessible on each server.

With a single public IP address you will only be able to port forward port 80 to a single server, but you could use a reverse proxy such as haproxy to then forward based on the host header.

Answer 3

What are you serving? If you have dissimilar services, you just forward the port for service A to server 1 and service B to server 2, so they'd look like they have the same single IP address and it can be done from just about any firewall/router from low-end SOHO routers to high end stuff.

If you have two servers serving the same service, i.e., two web servers, you would need multiple IP addresses, or consider finding a way to virtual host the different domains. Or find a way to move one service to another non-standard port (i.e., one SSH server is on port 22 and another on port 222) then use the previously mentioned port-forwarding technique to differentiate them (so your one IP address would have ports 22 and 222 open and forwarding to the two different servers internally.)

EDIT: If you're planning on using services that should be kept internal, like Active Directory, you might want to instead set up a VPN server that would allow people to create a tunnel for accessing AD and such. Some services are normally fine, but why expose your internal-only websites and thing like that to the Internet if you don't need to? With VPN's, you don't need to worry about open ports; they connect and get full access to the servers with their actual IP's and you don't need to worry about exposing more of your servers to possible attacks than necessary.