Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My company currently has a single IP address assigned to a server which is the entry point to our local network, i.e. outside connection -> modem -> server -> LAN. If I were to add another server that would to "sit along side" the current server, with its own non-local IP address, what kind of device would I need to place in front of both servers to allow them to function with this configuration? A router, a switch, or something else? Would there by any special configuration or feature that this device would need?

share|improve this question
It depends on what your existing server does. – mfinni Sep 12 '11 at 0:38

It depends on how, on your diagram, your server communicates with the modem, what your modem is able to do, and how your ISP will provide multiple routable IP addresses.

If you have static addresses, your ISP may assign you a small subnet and route everything trough a single PPP session. In that case you need a master device to handle the PPP session and act as a router for the other publicly-reachable machines. I have not seen typical home grade modem/router combos do this, except when running a custom Linux-based firmware (then it works great). A server could also handle this job (or a separate router device) as long as the modem can act as a PPP endpoint (i.e. providing PPPoE). Most home modems must be put into "Bridge mode" to provide PPPoE.

It may also be possible to provide each public IP in a separate PPP session. If it is the case, and if you have a PPPoE modem, you may hook up your servers directly to the modem (optionally trough a switch) and run a PPPoE client on the servers.

Lastly, you may have a modem/router under control of your isp, and provide public addresses trough its DHCP, in which case it is their job to ensure your addresses get correctly distributed, and you would just need a simple switch.

share|improve this answer

I would suggest running "something" as a NAT firewall on your public IP address rather than using your OS-X server as the firewall. This could be a dedicated device such as a Cisco ASA, Sonicwall or Watchguard, or a firewall distribution like ipcop or pfsense. You could then setup port forwards as required for each service that you want to be made accessible on each server.

With a single public IP address you will only be able to port forward port 80 to a single server, but you could use a reverse proxy such as haproxy to then forward based on the host header.

share|improve this answer

What are you serving? If you have dissimilar services, you just forward the port for service A to server 1 and service B to server 2, so they'd look like they have the same single IP address and it can be done from just about any firewall/router from low-end SOHO routers to high end stuff.

If you have two servers serving the same service, i.e., two web servers, you would need multiple IP addresses, or consider finding a way to virtual host the different domains. Or find a way to move one service to another non-standard port (i.e., one SSH server is on port 22 and another on port 222) then use the previously mentioned port-forwarding technique to differentiate them (so your one IP address would have ports 22 and 222 open and forwarding to the two different servers internally.)

EDIT: If you're planning on using services that should be kept internal, like Active Directory, you might want to instead set up a VPN server that would allow people to create a tunnel for accessing AD and such. Some services are normally fine, but why expose your internal-only websites and thing like that to the Internet if you don't need to? With VPN's, you don't need to worry about open ports; they connect and get full access to the servers with their actual IP's and you don't need to worry about exposing more of your servers to possible attacks than necessary.

share|improve this answer
Currently the one server we have is an OS X 10.6 Xserve that provides all the services (VPN, SSH, file sharing, firewall, Open Directory, some non public web sites) for our small company (40 people). I'm looking to setup the additional server as an Active Directory server, with the hope of not disrupting the current server and services as little as possible, and possibly migrating some services over to the new server down the road. – kwoodfriend Sep 12 '11 at 1:24
You are going to expose AD to the Internet? I'll edit a bit of my answer... – Bart Silverstrim Sep 12 '11 at 10:55
Thanks for the tips about how you should keep AD private. The plan for the server was to allow me to learn AD first before fully implementing it. The intent was to have this AD server be the PDC, as we do not have anything at the moment. – kwoodfriend Sep 13 '11 at 12:56
AD doesn't really have the concept of a PDC because it's distributed. Every AD server should be able to take over for another, while BDC's and PDC's are previous-generation directories that had to be more hands-on when one failed. Your best bet for learning AD before implementing? Get a decent box to run VMWare on (something like ESXi, it's free) or another hypervisor and set up a group of self-contained VM's and network them together virtually. – Bart Silverstrim Sep 13 '11 at 13:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.