This question seems to be similar to others, but I'll take a shot anyway. A client recently switched ISPs from TDS to Comcast Business Class. Before the switch, they had 5 static IP addresses assigned. Now they'll have a single dynamic IP address.

The issue is that this internet connection will be shared among two companies, both having (and wanting to keep) their own private subnets. Because TDS was supplying multiple IP addresses to the one location, this allowed me to put each router on the switch. Now, with Comcast, they only get one IP address, meaning there has to be a main router before the subnet routers. Luckily, the cable modem has a built-in router, which I would like to connect to each company's router, and still have DHCP enabled on all accounts.

Question: What do I need to do to the subnet routers to keep them separate from each other, but still allow internet access from the main router. I would love to say "I tried this", and give you links, but everything I find on the internet only mentions daisy-chaining routers with DCHP disabled.

  • Comcast Business Class IPs aren't dynamic. Sure they didn't switch to a consumer plan? – Chris S Jun 24 '11 at 15:53
  • This I did not know. I will make the appropriate edit. Thanks. (They did, in fact, get Business Class.) – joe Jun 24 '11 at 18:18

The general idea is you have your cable modem getting its external IP from the ISP, and you create an internal network that accesses that. The primary router(your modem) gets the larger net, we'll use a big one for simplicity ...

WAN: assigned via comcast

Connect your modem/router to the subnet routers. If it's one of those SOHO things with multiple ports, those ought to work, if not you'll need a switch in between. Configure each router to be in the same subnet as the big one. to have a static IP in the subnet.

LAN: DHCP scope: -
LAN: DHCP scope: -
LAN: DHCP scope: -

/16 and /24 are and respectively. You should also not use the IPs I gave, security through obscurity thing.


I'd approach this from a different direction, sure you could do all manner of routing but why not pay Comcast to give you two static IP's - it won't cost too much more and you can just carry on as you were.

  • You, sir, are quite right. That is fail-safe choice if I can't find a solution to this issue. +1 to you. – joe Jun 24 '11 at 13:58

Connect each subnet router's WAN interface to a switch. Connect the Comcast router's LAN interface to this switch. Configure the WAN interfaces on the subnet routers and the LAN interface on the Comcast router to be on the same subnet (something other than what's in use already. Set each subnet router's DG to be the LAN interface of the Comcast router. Configure each subnet router to act as a DHCP server for it's respective subnet.

This is assuming that you don't need to allow any inbound services to either subnet.

  • This is ... probably far more clear than my answer ^_^ – Daniel B. Jun 24 '11 at 15:15
  • @joeqwerty, I edited my answer ... if you get a chance make sure I'm not giving bad info? Also, why would inbound services not get to the subnets? – Daniel B. Jun 24 '11 at 15:42
  • @Daniel: +1 on your answer. It looks like you and I are basically saying the same thing, although you're saying it a little more eloquently. Inbound services might get tricky depending on what services need to be forwared inbound. For instance, trying to forward HTTP traffic to a web server on both subnets is going to prove a little tricky with only a single public ip address. – joeqwerty Jun 24 '11 at 16:29
  • @joeqwerty Hm. I could see working around that with nonstandard ports but if they're portioning it out to clients that wouldn't work... what about doing somethings with port forwarding and DNS to make it work properly, i.e. have the DNS send requests for client1.domain.com to port 2000, client2.domain.com to port 3000 and then have the router forward those to the proper subnet on port 80? I may be overthinking it ... – Daniel B. Jun 24 '11 at 17:09
  • Oh I see the flaw there ... that wouldn't only work for a single port. Huhm. I guess that'd be OK so long as they only wanted a small number of services, or broke it down further to, say, web.client1.domain.com. – Daniel B. Jun 24 '11 at 17:14

Is your configuration like this:

       Rtr A
      /     \
     /       \
  Rtr X       Rtr Y

Company X Company Y

I'm also assuming that there are only a few hosts at each company and that 'Rtr A' is already doing NAT. If these assumptions are correct and you want to keep company X and company Y completely separate from each other why not enable DHCP on routers X & Y (using different IP ranges)? Putting in appropriate routes so that the routers know where each subnet is should finish off the job. Unless I have entirely misunderstood your requirements!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.