Is it possible to have two routers in the public accessible subnet?

                         ->forward all traffic for [177.x.x.{3,5,7}]
 Internet --- [177.x.x.1] ------------------------------------ [177.x.x.3]
              /    |    \                                      /          \
             /     |     \                                    /            \
  [177.x.x.2] [177.x.x.4] [177.x.x.6]                [177.x.x.5]      [177.x.x.7]

The main router (177.x.x.1) is connected to WAN and forwards all the traffic (with destination IPs 177.x.x.3, 177.x.x.5, 177.x.x.7) to the second router (177.x.x.3), to which are connected several Machines, so that this second router (177.x.x.3) could route the traffic within (177.x.x.3, 177.x.x.5, 177.x.x.7 - number of single public IPs) as it normally would the main router (177.x.x.1) do? Besides that all the 177.x.x.2, 177.x.x.4, 177.x.x.6, 177.x.x.8 ... will be still managed by the main router (177.x.x.1). So I could isolate this three machines (177.x.x.3, 177.x.x.5, 177.x.x.7).

All this unusual structure because I have three public single (not a whole subnet - too expensive) IPs and a host, which I would like to do to the second router (177.x.x.3) and install virtual machines (177.x.x.5, 177.x.x.7). So the main router (177.x.x.1) is on the provider's side and I have no access to them, but I would like to manage my VMs with public IPs separately from the whole subnet (broadcast messages only between these three IPs, outgoing traffic rules only on the second router, etc.). All the other IPs in the subnet are foreign. So the bridged mode is not the solution, because then the main providers router will manage my whole part of network. It is more needed a routed mode, but I cannot find a good tutorial for doing this.


Your picture and first paragraph make sense and is doable.

However, with no access to the main router:

So the main router (177.x.x.1) is on the provider's side and I have no access to them

SCENARIO #1 (full routing between the two routers)

you would need the provider/support to modify the main router's config to route traffic destined for the subnets hanging off router #2 over to it.

You would also require the provider to modify the main router (or the edge firewall) to allow for the proper inbound NAT rules and outbound NAT rules for both the incoming traffic and outgoing traffic from the subnets on router #2.

You can put outgoing traffic rules on the second router if you want, but you can't solely manage it from router #2. There will need to be at least a default route on Router #2 over to the Main router (to get to the other subnets and the internet).

You'll also need routes on the Main router (and possibly ACLs if it is doing firewall duty) to allow for its lan subnets to reach the subnets on router #2.

SCENARIO #2 (double NAT and isolation of networks)

You would ask the provider to modify the main router to NAT inbound traffic from the WAN IPs you want to "isolate" over to router #2 and then you'd NAT them again. They could allow for "ANY ANY" rules to your Router #2 and then you'd firewall/acl what you wanted yourself. Allowing you to modify those ports/rules at any time. There wouldn't be routes/rules to go between the two routers other than the ones needed for this 2nd NAT.

| improve this answer | |
  • it sounds I need to ask the provider to change something on their router? Strange is that they provide some tutorials about doing about the same: [wiki.hetzner.de/index.php/KVM_mit_Nutzung_aller_IPs_aus_Subnetz/… and [wiki.hetzner.de/index.php/Zusaetzliche_IP-Adressen/en] under the "Routed" variant. They writing nothing about changing something on the main router. But neither of them works. – static Jul 18 '13 at 13:43
  • Hetzner is a little different then my scenarios. I was referring to actual hardware based routing and equipment. You should contact them and work through the issues. There are also other "Hetzner" routing questions here on SF where we've worked through a few of the issues similar to this. – TheCleaner Jul 18 '13 at 13:50
  • :) they answer "sorry, we cannot offer support here. please look the wiki pages for the information" (wiki pages announced in the last comment). But they are ambiguous and confusing. I already asked different queston here on SF, but either somebody says it is simple and provides obvious configuration, which doesn't work or saying ask the provider, what is rather not really supportive... – static Jul 18 '13 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.