Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a subnet of public IP addresses that my ISP has provided me with. They are routed through my router (how profound) that has a static IP. I have successfully assigned the IPs from that subnet to various devices on my network. This works just fine, they get their own public IP, they can access the Internet, and the Internet can access them. However, I would like to also assign some private IPs on my network through that same router and put them behind NAT. Is this even possible? Could a VLAN be of use? I would like to avoid putting another router on the network, which makes this is quite an awkward question.

share|improve this question
2  
Stop assigning public ip addresses to your internal devices. Assign private addresses to all of your internal devices and use NAT and port forwarding to allow access to only those internal services that are needed. –  joeqwerty Oct 21 '12 at 14:50
    
That doesn't work when you're trying to run multiple web servers from your network. Port 80 can only be forwarded to one device. –  Andrew Larsson Oct 21 '12 at 18:21
1  
@joeqwerty It's not NAT that you need, but firewalling. Please don't confuse the two. –  Michael Hampton Oct 21 '12 at 18:40
    
I'm using a firewall. I want to have the private IPs NAT to the public static IP that my ISP assigned to my router. At the moment I can do one or the other, but not both. My subnet is routed through that static iP. –  Andrew Larsson Oct 21 '12 at 19:05
    
NAT-->Outbound traffic. Port Forwarding-->Inbound traffic. –  joeqwerty Oct 21 '12 at 19:11

1 Answer 1

up vote 2 down vote accepted

You can do it. To limit layer 2 broadcast domain size, it is recommended that a VLAN be used, but this would be of very limited use unless your network has more than a few hosts and switches.

To do this, you can configure your router with two addresses (on one interface, or if you are using VLANs, on a subinterface on each VLAN). It will route packets for public IPs other than its own, and NAT+route packets for its own IP. You can then create a DHCP pool with reservations to dole out the public IPs, or just configure them statically on the hosts that need them.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.