10

Next week I'm getting a new internet connection installed. It comes with 5 static IP addresses by default.

Now, I would like to use some of these IPs on my systems. However, I have more than 5 devices to connect, so I would like to use NAT on one of the IP addresses.

I would like to know if there are devices available that function as a NAT gateway/router, while also functioning as a plain network switch. I have 3 physical locations where I want to connect devices on the wired network, as well as desired support for WLAN (ideally also integrated in the device I'm looking for)

Since I have a few existing cables running through my house, I would like to use those. Basically, I need a device that offers NAT, but is smart enough to properly route other traffic as well.

Note: the Juniper router is owned by my ISP and I'm not allowed to connect more than one device

Network Topology

I'm thinking this might just work out-of-box, but I haven't ever tried it. Thoughts?

3
  • Not an answer, but, I planned something similar ages ago... then... I got lazy and just used nat for everything as it was only one or two services that needed to be published... good question +1 Jul 7, 2011 at 12:57
  • I have identical services running on multiple machines. Without dedicated IPs I would need to assign non standard port numbers, so I won't give up as easily :)
    – Thorarin
    Jul 7, 2011 at 16:38
  • Thorarin: I've previously dealt with the wanting to share the same ports between multiple machines in the past by employing a reverse proxy. Though I've only really done that for http(s) traffic. Though apparently it can be done at the TCP/IP & DNS level, rather than service level. Jul 12, 2011 at 17:08

2 Answers 2

4
+50

What you are after is a Multi-Nat switch. Netgear ships the rather excellent FVS338 Firewall. It's a SPI Firewall + Multi-NAT + 8-port switch, as you can see from the description. The price is very affordable; under 200 USD on most locations.

The switch itself will assign one of your public static IP addresses to its WAN interface. Multi-Nat will then take hold of your remaining IP addresses (4 on your case), if you so wish, by NATing them to internal addresses and maintaining proper connections between NATs with the help of the firewall component. The firewall component is an essential part of this type of configuration and you can establish separate inbound rules to host multiple public IP address and associate those addresses with any local server.

Your drawing would work perfectly and it's basically all you need. That switch closest to your ISP router is what you want to replace with the FVS338.

Alternatively, you can go with a home-made recipe. If you can afford to dedicate an old computer to act as a firewall/switch, you can install Linux on it and use SmoothWall, with the SmoothHost module (which is precisely a multi-nat module). I'm thinking SmoothWall because it's a rather easy to configure firewall solution. But depending on your confidence level in Linux, there's plenty of other options. It remains however the idea that, other than buying an actual device, this can also be made in-house in an old computer.

Best of luck. And have fun!

4
  • Your answer does seem best.. I was thinking for another cheap solution to use www.dd-wrt.com , as because it offers MUCH more in-depth customization for routers/switches/wan/etc.. This is what I have running at my house. Jul 17, 2011 at 17:39
  • In my old network setup, I had a Linux box running for all my NAT / QoS needs (as well as other stuff). Actually, that's what the "server" in my drawing was. I was hoping to do without it this time. I'll take a look at your suggested device.
    – Thorarin
    Jul 18, 2011 at 12:32
  • Do you know if the FVS318G (netgear.com/service-provider/products/security/…) also supports the same features? I was hoping for a gigabit switch as the top speed of my internet connection currently is 80 Mbit.
    – Thorarin
    Jul 18, 2011 at 12:39
  • @Thorain It sure does. If you look at the specifications it supports "Many-to-one Multi-network Address Translation (NAT)". You can also see this more clearly noted, if you download the manual (warning, PDF file) and read in Chapter 1 - Introduction: "[...] provides support for Stateful Packet Inspection, Denial of Service (DoS) attack protection and multi-NAT support"
    – A Dwarf
    Jul 18, 2011 at 12:55
2

What you are describing is called a One-to-One NAT. Your Static-IP boxes will be given local IP addresses, but depending on what router you have, you can route all traffic from your static IPs.

Here is an article and a forum post describing the process for setting up one-to-one NAT on a DD-WRT router. If your router is supported, you can install the DD-WRT firmware with no need for additional hardware.

1
  • Interesting option. Unfortunately I don't have any of those routers lying around, but I'll keep it in mind :)
    – Thorarin
    Jul 18, 2011 at 12:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .