Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Broadcom BCM5352 router running DD-WRT firmware and four external IPs. In my network config at home I have first a router, and then a switch connected to the router (to avoid multiple cables through the whole appartment.

A server is connected to the switch, and if possible, I would like to give that server a different external ip (that is, tell the router to route all traffic to the specified external ip to the server and vice versa). I don't have static IPs, my ISP only offers DHCP.

So is there anyway to configure this? The firmware supports iptables, so if it can be done with iptables, then that is a solution. It is possible to do with pf, where the feature is called bidirectional nat mapping (1:1 mapping).

share|improve this question
Your ISP would have to assign you two IPs. – Brad Gilbert Jul 19 '09 at 19:10
What I would do is setup port forwarding. – Brad Gilbert Jul 19 '09 at 19:10
He is allowed by his ISP to allocate up to 4 IP addresses via DHCP, the question is just if this is possible to do on the same machine (via virtual interfaces or something like that of course). – Mikael Auno Jul 19 '09 at 20:34
Didn't realize that that was the case. – Brad Gilbert Jul 20 '09 at 1:59
up vote 2 down vote accepted

First, as mentioned above by another - I have never heard of an ISP giving out multiple IPs with DHCP. You might want to check on this.

None of this is DD-WRT specific:

... If they do really hand it all out on DHCP, then you will need multiple MACs on one interface card, or you will need 4x NICs all plugged into a switch which is then plugged into your ISP router. That's b/c the DHCP server will keep handing you the same IPs no matter what if its all on the same MAC. I dont think Linux has anyway to do multiple MACs on the same NIC.

After this, its pretty easy:
- Use 'ip addr X.X.X.X dev eth0 (or whatever NIC you use on that side) for each IP you want to be.

You will need to setup NAT as usual in iptables

Then you will need to configure DNAT (port forwarding) to direct incoming traffic to the server. Your will setup those rules to forward to the internal IP of the server...

If you want that server to always come from that IP, then you also need to use SNAT to do this, and you will need to mark the packet in the mangle table, and then setup an 'ip rule' command for that.

We do all this on our router here...

2    80 DNAT       tcp  --  eth2   *            x.x.x.74        tcp dpt:53 to:10.10.x.5:53 
0     0 DNAT       udp  --  eth2   *            x.x.x.74        udp dpt:53 to:10.10.x.5:53 
1197 60064 DNAT       all  --  eth2   *            x.x.x.73        to:10.10.x.9
Chain POSTROUTING (policy ACCEPT 2686 packets, 403K bytes)
 pkts bytes target     prot opt in     out     source               destination         
14613  903K SNAT       all  --  *      eth0             to:xx.x.x.75 
    0     0 SNAT       all  --  *      eth2    10.10.x.98           to:xxx.x.x.xx.69 
  178 11500 SNAT       all  --  *      eth2    10.10.x.8           to:xx.xx.219.xx 
    0     0 SNAT       all  --  *      eth2    10.10.x.9 
    1    60 SNAT       all  --  *      eth2    10.10.x.18           to:xx.x.x.70 
    0     0 SNAT       all  --  *      eth2    10.10.x.5           to:x.x.x.74 
14327  871K SNAT       all  --  *      eth2             to:x.x.x.66 

and here is what the iproute2 rules would look like:

0:  from all lookup local 
18: from all fwmark 0x4 lookup T1 
19: from all fwmark 0x3 lookup T1 
20: from all lookup main 
21: from x.x.x.0/20 lookup cable 
22: from x.x.x.64/27 lookup T1 
1000:   from all lookup 110 
2000:   from all lookup main 
32766:  from all lookup main 
32767:  from all lookup default 

and the mangle table - this makes certain machines use those first to rules, so they exit out the right IP/interface:

Chain PREROUTING (policy ACCEPT 1921K packets, 1149M bytes)
 pkts bytes target     prot opt in     out     source               destination         
   10  1304 MARK       tcp  --  eth1   *       10.10.x.18           tcp dpt:25 MARK set 0x3 
    0     0 MARK       tcp  --  eth1   *       10.10.x.9           tcp dpts:1719:1720 MARK set 0x4 
    0     0 MARK       tcp  --  eth1   *       10.10.x.9           tcp spts:60100:60200 MARK set 0x4 
    0     0 MARK       udp  --  eth1   *       10.10.x.9           udp spts:60100:60200 MARK set 0x4 

Notice how we mark TCP 25 to always go out a certain route. That's your mail will get bounced if you dont have it going out the IP that the MX record states on many receiving SMTP server.

share|improve this answer
BTW - you can get multiple NIC on BRCM device if it has the 5 port bridge on the back. Each of these is a addressable ethernet device (like eth0:1, eth0:2 or something) search DD-WRT on this. – user13587 Jul 20 '09 at 5:16

Yes, it is possible to do with iptables, however you need to have two IPs assigned to you from your ISP. I'm 99% sure the only way to get that is with static IPs, I've never heard of an ISP giving two IPs via DHCP.

share|improve this answer
He is allowed by his ISP to allocate up to 4 IP addresses via DHCP (which is almost always the case in Sweden), the question is just if this is possible to do on the same machine (via virtual interfaces or something like that of course). – Mikael Auno Jul 19 '09 at 20:35
I can confirm the same policy here in Portugal, we're allowed to have multiple IPs over DHCP. (No restrictions in numbers). – TCB13 Sep 11 '13 at 12:04

I think you can do it with iptables but it will be a bit hard, I don't remember but I was looking into this ages ago and someone showed me a few samples with dynamic IPs. Then I switched to a couple of virtual server firewall instances instead so I have one per external dynamic (dhcp) ip - all through a single external host NIC (and yes they run Microsoft ISA right now but that doesn't really matter). This seemed way more easy and I like running my firewall and NAT-router on a generic server OS for some reason ;)

Many ISPs in Sweden hand out more than one public dynamic IP via DHCP - 5 is a very common default amount though sure not all do. That way you don't really need to bash your head against the horrors of NAT to support more than one host at home... though consumer-level edge firewalls normally can't handle that I guess...

share|improve this answer

Have you searched the DD-WRT forums? Here
I run DD-WRT on my router and have an ISP that assigns 5 DHCP IPs. However I took a different and simpler route. I have my internet connection go directly into a switch that then plugs into my servers and into my DD-WRT router. Each device gets its own DHCP IP as if it was on its own network connection. However I can still talk to my servers at the full 100Mbps (The speed of my switch) vs the speed of my internet connection.

Another option is to just hook your server into your Router and make it a DMZ server, this would have a similar effect but your router and server would share an IP.

A fourth and much more complicated way of doing this would be to use 2 NICs in your server and have you server add a virtual interface on its outgoing connection and bridge that virtual interface to your router. Then both devices would have their own IP. ( In this case the server would be doing what you stated you wanted the router to do )

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.