Building a custom Router

Question

I need to create the network below: Diagram

Facts:

The router is a Linux box (don't care about the flavor), it has 2 NIC's.
The switch is unable to support VLAN's.
The servers need a WAN-IP. NAT is not an option.
This is all I get to work with (yeey budget-cuts).

How do I go about building this router (that isn't always a router)? Some of the servers need an IP that is assigned by the ISP based upon the MAC-address but the DNS-discovery doesn't travel over the router. Is there any way I can tell dhcpd to pass these requests to the ISP? Will I have a problem with routing?

I've looked into virtual nics but couldn't find a solution for my problem. I'm open to all suggestions at this point.

@pauska, I assume he's got a residential grade connection, the IPs are assigned by DHCP and tied to a particular MAC for the duration of the lease. Sound all shoestring and duct-tape... — Chris S, Mar 14 '11 at 14:09
@Chris S: Unfortunately, you're right. Nothing I can do about it though. — Bart De Vos, Mar 14 '11 at 14:13

Chris S · Accepted Answer · 2011-03-14T14:07:43.247

4

NAT Forwarding - Put all the external IPs on the router, then forward the appropraite IP:Port combinations to the correct internal server. All internal computer use a 10.x.x.x IP. Almost any router platform can do this except the cheapest SOHO routers. pfSense, M0n0wall, or a generic Linux or BSD distro would work fine (Even Windows can do this with the right software).

The wrong way to this this - Setup the router with a very small external address range. If you got a /27 from the ISP, use a /30 for the external and the upper /28 for the servers. This wastes a lot of IPs, and you'll have Internet traffic commingling with your internal traffic. Give the clients 10.x.x.x IPs, the router should have some really good firewalling going on to make sure the right ports are exposed on the Extern IPs, while the Internal network can still access appropriate services on the server too. vLanning would be a good idea; using two switches to create a DMZ/Perimeter network would be a better idea; The NAT Forwarding above would be the best idea given your requirements.

edited Mar 14 '11 at 14:07

answered Mar 14 '11 at 14:01

Chris S

77,337
11
120
212

Sorry, NAT is not an option because the ports change all the time. Some applications on the servers need WAN-IP's. – Bart De Vos Mar 14 '11 at 14:05
2

If you forward the IPs, there are no TCP/UDP ports involved in the NAT process. – Antoine Benkemoun Mar 14 '11 at 14:07
@TiZon, you could just forward ever port to the appropriate server. – Chris S Mar 14 '11 at 14:08
@Antoine Benkemoun #@Chrus S: Didn't know that. I'll look into that. – Bart De Vos Mar 14 '11 at 14:10
1

Some people call it static NAT. – SpacemanSpiff Mar 14 '11 at 14:15
It looks like the servers would still get a Class C network. That wouldn't work with our App Servers. I do know every MAC-adress that do needs to get a Class C-address, if that helps... – Bart De Vos Mar 14 '11 at 16:35
There are not classes anymore; they were obsoleted 17 years ago. Why wouldn't that work though? – Chris S Mar 14 '11 at 17:58
The apps perform a check and if it fails, they won't run. Something else I can't do anything about. :( – Bart De Vos Mar 15 '11 at 18:21
1

For reference, it's called '1:1 nat' too – 3molo Jun 27 '11 at 13:04

Building a custom Router

1 Answers1

Linked