Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My network currently looks like this (simplified):

enter image description here

Note that Router #2 is connected to the LAN interface of Router #1. This should be familiar to anyone who has seen a standard static-IP setup with an additional firewall for a residence or other small building. Router #1 is actually my cable gateway, but since it is a fully functional router/firewall, I am going to refer to it as a router.

Now, I need to open various ports in both firewalls for incoming communication to my server - port 80 is a good example. So I've opened up port 80 in Router #2, and so far all incoming traffic at the public IP X.X.X.129 is being routed correctly.

The problem is that I also need my server to respond to incoming traffic at the public IP X.X.X.130 on the WAN interface of Router #1. Naturally, I can't just tell Router #1 to forward port 80 to another public IP. Port forwarding is only supported when the traffic is being directed to the LAN subnet.

I am willing to restructure my network topology if required, with the following conditions:

Router #1 cannot have its WAN IP reassigned - X.X.X.130 is mandatory.  
Router #1 cannot be moved or disconnected from the cloud.  
The server cannot be given a second IP address.  
I would prefer the server to have a private IP address - e.g.  
I'd like to keep Router #2, but it can have a private IP - e.g.

Following these rules, I need to get my server to receive incoming traffic on port 80 from both public IP addresses. Does anyone on SU know if this is possible? So far my only theories have been to set up a static route on either router, or to somehow combine my two subnets into a single subnet.

I have altered my diagram to depict Fred's solution. Seeing that I'm going to have to compromise somewhere, I figure the smallest and simplest compromise would be the most efficient. And while giving my server two IP addresses will certainly complicate the server configuration, the resultant simplicity in the network topology would be a pretty fair trade-off.

enter image description here

This solution will allow both public IP addresses to remain publicly visible, while allowing both routers to forward ports directly to my server's local IP addresses. Furthermore, everything on my network that is connected to Router #2 will be able to access Router #1's subnet, so the server will maintain local visibility from both local IP addresses as well (nothing else is connected to Router #1, besides Router #2 and the server).

My server motherboard does in fact have an integrated gigabit dual-NIC, so my hardware can handle this without any problems. I am going to attempt to configure my server to respond to both NICs today, and we'll see how it goes from there - but at this point I don't forsee any better solutions coming to light, and any further problems caused by this compromise can most likely be solved when they arrive. Of course, if there are any errors in the above network layout, please let me know.

Thanks a ton, guys!

share|improve this question
Your diagram suggests that Router #1 has a switch. Why does it assign a LAN address on some ports and a static (.1.129) IP to Router #2? Why not force Router#2 to take a LAN address, like or something outside R#1's DHCP assignments? That way, you can port forward to it. – hyperslug Mar 18 '10 at 0:48
Both routers are switches. But I have two public IP's that need to be available. One public IP is assigned to Router #1, and the other public IP has to be assigned somewhere. I've also been considering 1-to-1 NAT as a possible way of doing this, but I'm not sure how to make Router #1 point a public IP to a computer on Router #2's subnet, not to mention how unsecure that would be. The whole point of this is to get two public IP's pointing to my server, while keeping my server behind a firewall at all times. I don't want to have my server visible on the internet, apart from a few ports. – Giffyguy Mar 18 '10 at 2:31
Why do you need two layers of NAT for this? – Hasaan Chop Mar 18 '10 at 8:12
Basically, I'm trying to make my one server appear to the public internet as if it were two seperate servers with two seperate public IP addresses. I don't know about other registars, but Network Solutions requires two DNS servers if you want to host your own domain. But you can get away with only one server, so long as it has two public IP addresses. And then of course the reason for the whole mess is security: both public IP addresses need to be firewalled. – Giffyguy Mar 18 '10 at 17:06
+1 for your diagrams. – goblinbox Mar 18 '10 at 18:28
up vote 1 down vote accepted

Leave the setup as you have above, except put a new, 3rd firewall router in the DMZ of Router 1 and direct the .130 traffic to the DMZ where you place Router 3. Router 3 then forwards incoming traffic to the address. The kicker here is the One IP Only requirement for the server. You will not be able to send packets back through Router 3 without a distinct IP on the server for that path (traffic via Router 3). The server's routing table will have a single default gateway for the single assigned IP, so no matter which way the traffic arrives (via Router 2 or Router 3), responses will go out the default gateway and are therefore translated to the public IP of that router. Perhaps UDP would work (traffic goes to .130 and comes back from .129), but I see no way for TCP to successfully make a connection on the IP that isn't routed through the server's gateway. I suggest you think really hard about the Only One IP requirement since allowing 2 IPs would make things much simpler.

share|improve this answer
Giving the server two local IP addresses seems like the most effecient compromise, when all is said and done. I have added some information to my question regarding this. – Giffyguy Mar 18 '10 at 17:54

Ok, assuming that both of your routers have NAT enabled on them, your current setup will not work. The problem you will have is your second IP address(1.129) is not visible publicly and thus can never be accessed from outside your network. The only IP the internet will see is router #1's IP(1.130).

If you want both IP addresses publicly available you will need to put a switch in front of router #1 connecting both router #1 & router #2 to the public internet.

share|improve this answer
Yeah, I wondered about that too. He said it was working, so I assumed it was solved somehow. – Fred Mar 18 '10 at 15:38
Yeah, that's not a problem. X.X.X.129 uses X.X.X.130 as it's default gateway (as opposed to, so as far as the public internet is concerned they are both visible. – Giffyguy Mar 18 '10 at 16:44
Also, I can't move Router #1 - it is my cable gateway. It has to be physically plugged into the coaxial cable. – Giffyguy Mar 18 '10 at 17:08
@Giffyguy, yes X.X.X.129 can access the internet, but is it accessible from the internet? My guess is that if I were to ping X.X.X.129, I wouldn't be able to reach it. Only X.X.X.130 is visible to the internet. – heavyd Mar 18 '10 at 17:21
I see where you are coming from. I have tested for this, and it does work. Furthermore, when Comcast issues a public IP block for my use, they give me one default gateway IP (X.X.X.130) and one "usable" public IP (X.X.X.129). If Router #2 wasn't publicly visible because it's part of Router #1's subnet, it would really defeat the entire purpose of purchasing a public IP in the first place. So I'm not worried about there being any problems there, I just follow the directions Comcast gives for making Router #2 publicly visible. – Giffyguy Mar 18 '10 at 17:26

Set up the second router as a switch instead of a router by disabling the DHCP server (if one is running) and plugging the cable from router 1 to router 2 into one of the second router's LAN ports. You will probably also need to set router 2 to an unused static IP on the 10.0.1.x subnet, and move the server to the 10.0.1.x subnet as well. Then clear router 2's port forwarding settings and tell router 1 to forward to the server's new 10.0.1.x IP, and you should be fine.

share|improve this answer
This is a good idea, but it seems like too much rigamaroll, not to mention lessened security. I'd like to have a physical SPI firewall in front of each public IP address, and removing that from Router #2 seems risky. – Giffyguy Mar 18 '10 at 17:40
You need two public IPs which both point to the same server? That does not make much sense, and I don't really know how one would make it work, sorry... – marcusw Mar 18 '10 at 19:23
Haha, I can't blame you for being confused... I'm trying to cheat Network Solutions, by making it look like I have two valid DNS servers hosting my domain, when in fact I'm not about to spend the time or money building a second server. – Giffyguy Mar 18 '10 at 19:50
Tricky! I hope they don't find out... Though it looks like you managed to fix this from your edits to the question (nice diagrams), glad you got it working. – marcusw Mar 19 '10 at 15:41
Thanks! Yeah, everything is working nicely now. – Giffyguy Mar 19 '10 at 17:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.