I have a small network with a business-class cable modem. I have a *.192/29 block assigned to the internal side of the modem. The first usable IP, .193, is assigned to the cable modem interface. I have no access to the config on the cable modem - that belongs to the ISP.
As I see it, I have two options. One is to subnet the /29 into two /30s. The problem with that is that it will give me two essentially point-to-point connections. .193 on the modem connected to .194 on my router, then .197 on another interface on my router connected to a device using .198. Once I do that, my IPs are exhausted and I only have one device, other than the router, online.
The other option is to put the modem and any other devices on a common segment prior to the router. (This is the setup I currently have, using a Cisco 2651XM router with a NM-16 switching module.) This allows me to use .194 through .198 for active devices. The issue that I have with this solution is that I have no way to put a firewall access list on the traffic. I have a server running on IP .195. Traffic from the Internet to that server comes from .193 on the modem and goes directly to .195, staying within a single VLAN on the switching module. The interface connecting the modem is a layer two port and won't take an ACL. It doesn't go through a routed interface, and so won't go through any access lists. The server is wide open to the Internet with no control of traffic hitting it. I'm not intimately familiar with VACLs, which might work, but they seem to only be supported on high-end switches, and aren't available on the NM-16.
One possible solution would be to put a private IP on the server and use NAT to send the Internet traffic to the server but that causes issues with inside devices trying to reach the server, since their traffic won't be coming in through the outside NAT interface. This seems like it should be a common problem but I can't find anything on the 'Net discussing it. Am I missing something simple?