[Lore]

Hi all,

I have a problem with my network configuration that I could really use some assistance on. After spending 3 hours reading the various multi-NAT, 1:1 NAT, and multiple public IP address threads, I haven't found anyone who's tried to quite do the same thing that I'm trying to achieve. Everyone wants to isolate networks, I actually want to link them.

Before I get started, here is some background:
1) I want to ensure that all computers in my house route to each other to take advantage of full LAN (100mbit) speeds, while still having access to the Internet.

2) My ISP has a DHCP server; if I plug into any wall jack that's connected directly to them, I can get a DHCP address if I do not specify one of my 5 static IP addresses.

3) I have access to 5 static IP addresses, and an unlimited number of dynamic addresses.

I have a Linux server ("SERVER A") with 4 public IP addresses and a Linksys WRT54G ("LINKSYS") running DD-WRT v23 SP2 with the 5th public IP address. I also have another server ("SERVER B") which is plugged into that wall jack directly to the ISP, and it picks up a dynamic IP because I am out of static IPs.

The goal is to have SERVER A, SERVER B, and LINKSYS all externally facing with their respective static/dynamic IP addresses, but with the ability to transfer data amongst each other at LAN speeds since they will be on the same physical network.

The ideal solution would be to plug SERVER A and SERVER B into two of the LINKSYS ports, assign SERVER A its 4 static IPs, let SERVER B pick up a dynamic IP from the ISP, and let all other computers running behind the LINKSYS pick up internal 192.168.x.x IP addresses while appearing to be the 5th static IP address to the world. And then, the holy grail - having them route amongst each other at full 100mbit speeds.

Does anyone know how we can accomplish this? Many thanks in advance!

In diagram form:

[Lore]

After some playing around, I'm still stuck probably because I don't really know how to use IPTABLES properly.

I've also decided to give up trying to obtain a dynamic IP for SERVER B. I haven't found any literature supporting the ability to do so, so I will -- for now -- assign one of my 5 statics to SERVER B.

Here's what I've got so far. First, alias the IP addresses.

[Carbine]

I PMd you with this already but here's how I did my network which I believe is similar to what you're trying to do:

Okay, the way my network is setup is as follows:

4 servers, each with their own external IP address.
9 workstations all sharing one external IP address.

All boxes, including the servers with their own external IP addresses can be reached by all machines by using their internal IP addresses.

The code below is what I have set up in the startup commands where ***.***.***.*** is an external IP address and XXX.XXX.XXX.XXX is an internal, each of the 4 in the script are numbered:

[ziadsa]

this script is perfect,

But is there anyway to make the public ip on any of the 4 machines that has public IP wide open?

i have my DDWRT doing the pppoe session , and i am getting my static ip from my Provider server.

then i want to assign 2 static IP to 1 server and 1 Router, all my DHCP will be connected to that router and the static has there IP's

bcz if i assign static ip for my second router where all my dhcp client will be connecting, i want that router to be exposed 100% on the WAN and each client connected will do his own routing, if i will use ur method here i will be double nating unless there is a way to tell the main ddwrt router to forward all port range to that specific external ip.

Any help is really appreciated.

Thanks.

[phuzi0n]

The wiki guide explains what you want.

http://www.dd-wrt.com/wiki/index.php/One-to-one_NAT

[ziadsa]

Thanks for the reply,
i have few questions about that wiki

WANIF=`nvram get wan_iface`
WANMASK=`nvram get wan_netmask`
ifconfig $WANIF:1 [PUBLIC_IP1] netmask $WANMASK broadcast [BROADCAST]
ifconfig $WANIF:2 [PUBLIC_IP2] netmask $WANMASK broadcast [BROADCAST]
ifconfig $WANIF:3 [PUBLIC_IP3] netmask $WANMASK broadcast [BROADCAST]


on my computer that has static ip what do i put as gateway and dns? do they have to be the defaut one 192.168.1.1 as gateway and DHCP?

but my provider informed wan ip will 67.44.27.129 and you gateway ip for lan is 67.44.27.128
and on my computer it has to be 67.44.27.130 and gateway 67.44.27.128 which is my switch or lan bridge router .

thanks.

[phuzi0n]

With 1:1 NAT the router will have all of the public IP's assigned to it and it will NAT them to whatever private IP you want it to. You still need to have all your LAN hosts using private IP's and set to use the router's LAN IP as their gateway; DNS can be any working DNS server.

[ziadsa]

i am sharing my success story.
i am using this setup in my ddwrt for over 3 month and its working A+

in command i put this as startup script:

WANIF=`nvram get wan_iface`
WANMASK=`nvram get wan_netmask`
ifconfig $WANIF:1 67.55.33.120 netmask $WANMASK broadcast 67.55.33.125
ifconfig $WANIF:2 67.55.33.121 netmask $WANMASK broadcast 67.55.33.125
ifconfig $WANIF:3 67.55.33.122 netmask $WANMASK broadcast 67.55.33.125
ifconfig $WANIF:4 67.55.33.123 netmask $WANMASK broadcast 67.55.33.125
ifconfig $WANIF:5 67.55.33.124 netmask $WANMASK broadcast 67.55.33.125

i got my broadcast ip by using IP claculator , i know nothing about these stuff i kept reading for over a week :)

http://www.subnet-calculator.com/


now in my firewall rules i created the following:

# WAN .120 -> LAN .2
iptables -t nat -I PREROUTING -d 67.55.33.120 -j DNAT --to 192.168.1.2
iptables -t nat -I POSTROUTING -s 192.168.1.2 -j SNAT --to 67.55.33.120
iptables -I FORWARD -d 192.168.1.2 -j ACCEPT

# WAN .121 -> LAN .3
iptables -t nat -I PREROUTING -d 67.55.33.121 -j DNAT --to 192.168.1.3
iptables -t nat -I POSTROUTING -s 192.168.1.3 -j SNAT --to 67.55.33.121
iptables -I FORWARD -d 192.168.1.3 -j ACCEPT

# WAN .122 -> LAN .4
iptables -t nat -I PREROUTING -d 67.55.33.122 -j DNAT --to 192.168.1.4
iptables -t nat -I POSTROUTING -s 192.168.1.4 -j SNAT --to 67.55.33.122
iptables -I FORWARD -d 192.168.1.4 -j ACCEPT

# WAN .123 -> LAN .5
iptables -t nat -I PREROUTING -d 67.55.33.123 -j DNAT --to 192.168.1.5
iptables -t nat -I POSTROUTING -s 192.168.1.5 -j SNAT --to 67.55.33.123
iptables -I FORWARD -d 192.168.1.5 -j ACCEPT

# WAN .124 -> LAN .6
iptables -t nat -I PREROUTING -d 67.55.33.124 -j DNAT --to 192.168.1.6
iptables -t nat -I POSTROUTING -s 192.168.1.6 -j SNAT --to 67.55.33.124
iptables -I FORWARD -d 192.168.1.6 -j ACCEPT


and i have my dd-wrt set to assign dhcp from 100 to 255
and i dedicated 192.1688.1.2 till 6 for my static ip.

All is working A+
no problem at all.

[kt_haddock]

If you want to do this with MAC-reservation from ISP,
How to config then ?

[ziadsa]

[phuzi0n]

[kt_haddock]

okey thanks !