Airport Extreme and Static IP

[matt-w]

Alright so this morning i had a new internet connection installed with a block of 5 IPs i am trying to configure a couple devices with static IPs from the block but the rest share a single with NAT can i accomplish this within the router or do i need to get another router?


also i have a OSX server can i add another ethernet interface so i can communicate both within my local network and also external?

 

[thankins]

Alright so this morning i had a new internet connection installed with a block of 5 IPs i am trying to configure a couple devices with static IPs from the block but the rest share a single with NAT can i accomplish this within the router or do i need to get another router?


also i have a OSX server can i add another ethernet interface so i can communicate both within my local network and also external?

No you can't and not the safest method either. Your ISP modem is the gateway - lets say for example 171.122.1.122

Your 5 IPs are usually below that so they would be 171.122.1.116-121

you configure your router with on of those IPs and then all your machines internally are on a internal LAN subnet (192.168.1.X)

You configure your router with the Static IP and then add ports to pass through the services you need.

Don't give one of your machines a static and then plug it into the ISP modem. that is asking for travel.


No one needs 5 static IP unless they are running multiple mail servers on different domains. Also not sure why you think that your local machines need a static ip

 

[matt-w]

No you can't and not the safest method either. Your ISP modem is the gateway - lets say for example 171.122.1.122

Your 5 IPs are usually below that so they would be 171.122.1.116-121

you configure your router with on of those IPs and then all your machines internally are on a internal LAN subnet (192.168.1.X)

You configure your router with the Static IP and then add ports to pass through the services you need.

Don't give one of your machines a static and then plug it into the ISP modem. that is asking for travel.


No one needs 5 static IP unless they are running multiple mail servers on different domains. Also not sure why you think that your local machines need a static ip

Yes i'm aware of it however i am used to cisco equipment that can do Static NAT assignments, that is why i was asking but the main reason i am assigning local devices a static is so that i can assign my various DVR for security cameras, a OSX server, and a security system which all 4 use TCP port 80 so i cannot forward the port and still allow all devices to work externally. this is a small business and i dont have the budget to change it all out. i am thinking a small router to set as bridge and then use the airport as a secondary network off of it. so it would go Modem> Router1> Airport Extreme.

Any other thoughts?

 

[belvdr]

No you can't and not the safest method either. Your ISP modem is the gateway - lets say for example 171.122.1.122

Your 5 IPs are usually below that so they would be 171.122.1.116-121

you configure your router with on of those IPs and then all your machines internally are on a internal LAN subnet (192.168.1.X)

You configure your router with the Static IP and then add ports to pass through the services you need.

Don't give one of your machines a static and then plug it into the ISP modem. that is asking for travel.


No one needs 5 static IP unless they are running multiple mail servers on different domains. Also not sure why you think that your local machines need a static ip

Not necessarily. Cable modems are nothing more than a bridge and do no routing.

I can think of many uses of a block of IPs that don't require mail services.

Yes i'm aware of it however i am used to cisco equipment that can do Static NAT assignments, that is why i was asking but the main reason i am assigning local devices a static is so that i can assign my various DVR for security cameras, a OSX server, and a security system which all 4 use TCP port 80 so i cannot forward the port and still allow all devices to work externally. this is a small business and i dont have the budget to change it all out. i am thinking a small router to set as bridge and then use the airport as a secondary network off of it. so it would go Modem> Router1> Airport Extreme.

Any other thoughts?

There are a few of ways to do it:

1. ARP the additional IPs on the firewall so all IPs come back to it.
2. Have the ISP add a static route pointing at your firewall. Since you are paying for static IPs, I'm guessing they would work with you on this.

I'm not sure the AEBS would like either of those options, but a Cisco ASA or Check Point firewall would be okay with it. A Cisco ASA 5505 can be purchased for about $1,000. You can even get them with SSL VPN licenses so you don't need to manage a VPN client.

The third option is to use a different outside port for each of those services:

A. Port 8080 for DVR A
B. Port 8081 for DVR B
C. Port 80 for your web site (assuming this is sitting on the OS X server)
... and so forth.

Either way, it would be prefereable to have all devices behind a firewall that can detect malicious traffic, especially for a business. Exposing your security DVRs is quite a risk to take, as most security camera systems are not that hardened.

A fairly simple solution would be to put a firewall in and have the users who need access to restricted services connect via VPN.

 

[matt-w]

Not necessarily. Cable modems are nothing more than a bridge and do no routing.

I can think of many uses of a block of IPs that don't require mail services.



There are a few of ways to do it:

1. ARP the additional IPs on the firewall so all IPs come back to it.
2. Have the ISP add a static route pointing at your firewall. Since you are paying for static IPs, I'm guessing they would work with you on this.

I'm not sure the AEBS would like either of those options, but a Cisco ASA or Check Point firewall would be okay with it. A Cisco ASA 5505 can be purchased for about $1,000. You can even get them with SSL VPN licenses so you don't need to manage a VPN client.

The third option is to use a different outside port for each of those services:

A. Port 8080 for DVR A
B. Port 8081 for DVR B
C. Port 80 for your web site (assuming this is sitting on the OS X server)
... and so forth.

Either way, it would be prefereable to have all devices behind a firewall that can detect malicious traffic, especially for a business. Exposing your security DVRs is quite a risk to take, as most security camera systems are not that hardened.

A fairly simple solution would be to put a firewall in and have the users who need access to restricted services connect via VPN.

I agree its good to have everything protected behind a firewall or some kind the problem with port forward is the DVR and the webserver all use port 80 for a web page to display so i have to have the separate IP(think of it like 3 separate web servers)

i have a PIX 501 sitting in my basement i didnt think about but i will take that to the site and use it even though i know i cant use the VPN on it for IOS devices which sucks but not a big deal


Thanks for all the responses You all are always a great help!!

 

[jackrv]

I've always been a fan of port-forwarding than static 1-to-1 NAT. Static NAT basically eats up the entire port range for an IP to one internal server. By using port forwarding, you can, on a single IP, send requests to port 80/443 to a web server, port 25 to a mail server, 1494 for Citrix, etc... You can make 5 static IPs cover many more services than 5 servers alone.

We do a similar thing at my work. We replaced a T1 with a /28 subnet (14 IPs) with multiple consumer services with static IP ranges (Cable, FiOS, and a cellular service) for redundancy. On each, we have 5 static IPs (except for cellular, which is only for communication backup), and we can serve all of our public servers (9 total) with those 5 IPs and port NATing.

And I agree with the above posters as well. Both 1-to-1 NAT and assigning public IPs to servers both in a way create a DMZ (or in the case of 1-to-1, what my old boss called a service net). 1-to-1 Natting is even worse since those servers are internal to your network. The burden then falls on you to secure all unnecessary ports via locking down the server and/or via the firewall. Port forwarding only exposes specific ports that you specify.