VLAN / Static Public IPs / Subnets?

Question

Hi Experts,

I need some help with our network setup. Here are some facts before I ask questions: -

1. My ISP provided a static public IP (and a subnet mask) that I set as WAN-facing on my router.
2. The router uses DHCP to NAT to several LAN devices. All devices are able to access internet without problems.
3. All LAN devices are on same LAN subnet.
4. We have leased 5 additional public static IPs for use with our 5 servers. These servers are required to be publicly accessible without having to go through VPN.
5. These static public IPs are on a subnet that is different (again, different) from subnet in fact# 1 above.
6. ISP refuses to provide static IPs that are on same subnet as in fact#1.
7. My router supports VLAN.


Now the questions: -
1. How should I configure my router to accommodate the 5 public servers? I know every router is different but a simple 1-2-3 in English will be helpful.
2. I have 5 public IPs but what should be the subnet mask and gateway to be set on each of the 5 servers?

Thanks for reading.

Answer 1

Its at little weird that they would give you IP's that weren't in the same range as your WAN connection and not a whole subnet. All you have to do is create static 1 to 1 NAT translations. I really can't give you specifics, as you didn't provide any, but in a 1 to 1 NAT you configure your router to always translate a particular public IP to a particular private one, and vice versa. The ISP is providing the routing to the public address of the server, so that wouldn't be a concern. So to answer your questions directly:



1) Your servers will be privately addressed. This can be on the same subnet as all your other devices, but I'd recommend putting them on a separate network (different VLAN). This way your can apply separate security policies to that network easily (among other things). The servers will need to have static addresses. On the perimeter router you will set your NAT policies to map a single server's private address to a single public IP. Router configurations are different, so you might need two policies for each server, one mapping the private IP to a public IP for outbound traffic and another the public IP to the private IP for inbound traffic. Some routers will only require one command to do both directions, read the manual for your router.



2)This method will not be using the IP addresses in an actual network, so no subnet or gateway information will be set. If your ISP isn't giving a whole subnet then they must be handling the routing so the NAT is all you have to do.



Hope this helps.

Answer 2

I suggest making use of http://www.vpnmaster.org to unblock web sites. I am using their services for more than 2 years without having difficulties.

Answer 3

My spouse and i highly recommend making use of VPNPower to be able to unblock web-sites. I have been using them since four years. http://www.vpnpower.net