I just transitioned my home server from and older desktop with two LAN ports (Server B) to a new low-power one (Server C) with only a single LAN. I get three IP addresses from my ISP and me and my room mate shared them like this:

External Network:
Internal Network:

Coaxial---[Modem]---[10/100 Switch]
                    |  |   \------Server  B eth0              (External IP #1)
                    |  \----------Desktop A eth0              (External IP #2)
                    \-------------[E3000 Router]              (External IP #3)
                                  | | \--------Server  B eth1 (Internal IP)
                                  | \----------Desktop B eth0 (Internal IP)
                                  \------------Other Stuff    (Internal IPs)

Server B eth0 gets replaced with Server C eth0.

--Router A - Cisco E300
--Desktop A - Not important
--Server A - Not important
--Desktop B - 1 Ethernet, plenty of PCI-E, high power consumption
--Server B - 2 Ethernet, moderate power consumption, replaced with Server C
--Server C - 1 Ethernet, No PCI-E, low power consumption
--Switch - Layer 2

In my old setup (above) I routed all outbound traffic from my server (B) out of the external interface (eth0). However, incoming connections from the internal interface (eth1) would also exit that interface. By this method I could have a Samba share with all my media on my server (B), but keep torrent traffic off the broadcast domain of the other equipment.

In my new setup, the lower-power server (C) only has one LAN port (eth0) and no internal expansion (USB 2/3 is available, but no PCI[-E]). Is there a way I can continue to have my Samba share, but without the server's internal interface? Is there a cheap and reliable way to add another LAN interface?

Edit: Cisco Router is a consumer model, and is not flashed with DD-WRT or likewise because it is my room mates. I have an older WRT54G with DD-WRT at my disposal if needed. (it is a bit flaky) The switch is a Layer 2 switch with no administrative interface

Edit: The server needs to be external to the E3000 router as my room mate has a habit of deleting the port-forwarding settings on the E3000.

  • Does the server OS support VLAN tagging? If the switch is unmanaged then it won't support trunking, but you could perhaps get a cheap managed switch. – Paul Feb 3 '12 at 3:53
  • The server OS is debian-based linux so that is an option, my major problem (that I forgot to mention, but was kind of implied by consumer model) is that the router is NAT'ing. This adds complexity to any Samba setup. – Huckle Feb 3 '12 at 4:03
  • The internal router is NATting, but surely that is a routing concern? DNS should be enough to ensure everything can see each other from a Windows domain perspective. With a switch that supports vlan trunking you can duplicate your original setup with a single LAN Port + vlans wiki.debian.org/… – Paul Feb 3 '12 at 4:31
  • Maybe I'm not understanding what you're suggesting. When my windows desktop sends out a broadcast request for shares (on the packets will get as far as the NAT'ing router. At this point they've hit the end of the broadcast domain and will be dropped before entering the network. – Huckle Feb 3 '12 at 5:00
  • Hi, can you please detail these points: How many ethernet ports does your modem have? What OS is running on your server C? On which machine do your run Bittorent? Your desktop or your server? – Olivier S Feb 12 '12 at 12:37

Add the server name to your %WINDIR%\system32\drivers\etc\lmhosts file and point the name to the public IP address.

  • Interesting, I was aware of a hosts file but this is new. I added an entry but will have to get back to you on whether it works. – Huckle Feb 7 '12 at 2:57
  • @Huckle, lmhosts is for resolving lan manager names ( the circa 1995 protocol underlying samba ) to IP addresses. Come to think of it, adding the name to hosts ( which is for all IP name resolution ) should work as well, as does setting up a WINS server, which is Microsoft's lan manager equivalent to DNS. – psusi Feb 7 '12 at 4:29
  • I was leaning more in this direction, but after further thought I realize that this would be something of a large security issue. Having a windows share open to the public internet, even on a *nix system, should probably be avoided. – Huckle Feb 11 '12 at 19:36
  • @Huckle, that's what passwords are for. You might want to use something like fail2ban though to block anyone trying to brute force it. Also it isn't accessible from the Internet unless you configure the router to forward the SMB port. – psusi Feb 11 '12 at 22:42
  • @Huckle, I forgot you wanted the server to be connected to the switch. In that case, you can configure samba to only accept connections from the public IP address of the router, then only your stuff behind the router can access it. – psusi Feb 11 '12 at 22:47

It is unlikely that just any a consumer model router can do the job. For a better opinion we would require to know its exact model.

DD-WRT can do this using One-to-one NAT. This requires using firewall rules to NAT these external IPs to your internal IPs, which will also involve making static these internal addresses.

As all computers are now on the same network, you could use Quality of Service (QoS) to limit torrent traffic.

Some helpful user-cases can be found in the thread multiple external IP addresses.

  • So you're saying that I'd move all units to be behind the router, they'd all get local addresses. The router would then listen for multiple addresses on its WAN interface and depending on the IP, will port forward to a different local IP? This is a possible solution, but it would require reflashing his router. I'll keep this in mind for now and see if anyone can offer any experiences with USB-ethernet dongles. – Huckle Feb 6 '12 at 23:58
  • You could try it out on the old WRT54G with DD-WRT before flashing. – harrymc Feb 7 '12 at 7:48
  • Due to internal power struggle issues I'd not bother everyone with, I'd like to maintain at least one unit outside the NAT-wall as a stable point of contact. This idea has a lot of merit, but I don't think it will work for me. – Huckle Feb 8 '12 at 4:36
  • If you would like to partition the network, you could use the two routers: Flash the new one with DD-WRT and parameter as above, and configure the old DD-WRT router to create an internal segment of the network to contain torrent traffic (or use the switch which is however not parametrable). But I am sure that you can achieve an equivalent architecture by correctly setting up NAT and QoS using one router with DD-WRT. QoS will be far more effective than any artificial division between virtual networks. – harrymc Feb 8 '12 at 10:50
  • 1
    As Server C has USB, you could maybe use a USB Ethernet Adapter : see on amazon. – harrymc Feb 10 '12 at 6:57

One thing I didn't consider and no one suggested was running a VPN server. I'm looking into it and will update this answer with information as I go.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.