1

I'm considdering getting a static ipv4 for my home connection. Looking at the offerings i can get I wonder: Why would I choose a /30 subnet over a single static IP?

I'm confident that I know what the difference is in terms of how the gateway router gets configured in both cases.

But I don't see what I can do more, better or more cleanly with a /30 vs. a single static IP.

For perspective: I'm currently running a simple homeserver with VPN access and fileserver but plan to add more services. Some services I want to be reachable from the internet. I also plan in the near future to get a managed switch to do VLAN subnetting and put VMs in different subnets based on whether they should be reachable from the internet or not.

Improve this question

2 Answers 2

Reset to default
2

For as far as I'm aware, you don't need more than one IP for any of your services, unless you plan to run multiple services on the same port. The only reason I can imagine for why you'd want a /30 subnet is to either:

  1. Have multiple services running on the same port - They would obviously require a separate IP then
  2. Separating public services (VPN, website, etc.) and regular outgoing connections. So (for example) the stuff you can use from outside your network uses the IP 1.1.1.1 while your home computer has the public IP 1.1.1.2 when you browse the internet
  3. Server with dedicated IP
  4. Showing off to your friends ("Hey guys, guess who has two IP addresses?")

I would personally setup something similar to use-case 2 above, where services are all hosted on one IP address, and your "regular" traffic stays on the other IP. This might also help with firewalling, but I'm not sure about that.

3: Server with dedicated IP
I imagine you have some server sitting at home that runs all your different services, if this is the only machine that offers stuff to the public internet (web hosting, vpn, etc.), I would give that machine the extra IP for itself, so that you don't need to do a lot of firewall magic and let the server handle its port assignments and stuff by itself.

This also applies to the VMs inside a VLAN. You could assign the VM host server a dedicated IP, and then let it figure out the NAT forwarding etc. by itself. That way you could also easily cut off all public services without breaking your own internet connection by simply disabling the public IP.

EDIT: I believe this answer on the unix stack exchange gives a lot of valid reasons to have an extra IP - Except for the hosting of multiple SSL sites, since I don't believe that's a big issue anymore, with most browsers now supporting SNI

Improve this answer
2
  • Just to verify I inderstand correctly. For usecase 2 and 3 one of the IPs in the /30 subnet would be assiged to the machine running services I want accessible from the public internet. Traffic from my laptop, smartphone, smart tv etc. would be NATed behind the external IP of the gateway router that connects to my ISP.
    – PixelSupreme
    Nov 7, 2016 at 12:36
  • @RetoScheidegger exactly!
    – Cas
    Nov 7, 2016 at 12:37
-1

The most important part is HTTPS.

You can easily host more than one HTTP host on a single IP, but hosting multiple HTTPS hosts one a single IP is a road filled with tears.

This is true for all services, that use TLS and certificates from different domains.

Improve this answer
8
  • 3
    Honestly, I don't think hosting multiple HTTPS sites on a single IP is an issue for anyone using a browser newer than IE6 on Windows XP. Shared hosts do it all the time (I have a single IP serving about 30 HTTP and HTTPS domains). Have a look at SNI
    – Cas
    Nov 7, 2016 at 10:41
  • If you are willing to cater to e.g. older Androids, then things look quite different.
    – Eugen Rieck
    Nov 7, 2016 at 10:43
  • 2
    Alright, Android Gingerbread (2.3) or earlier, or iPhone OS 3 (They didn't even use iOS then) and earlier don't support SNI. We're talking about alienating about 3% of Android users and less than 0.1% of iOS users.
    – Cas
    Nov 7, 2016 at 10:47
  • 1
    I guess it highly depends on who you're serving indeed. I personally never ran into this issue and didn't consider companies (I assume?) using older Android or Blackberry devices.
    – Cas
    Nov 7, 2016 at 11:06
  • 1
    I do not quite understand how this issue is relevant to a /30 subnet in particular. Since a /30 only has 2 usable host addresses and one of them would be configured on the LAN interface of the gateway, that still leaves only one IP for any https host. At last that is how I understand it. So to give multiple https hosts their own public IPs I would need at least a /29 (or larger) subnet.
    – PixelSupreme
    Nov 7, 2016 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.