Home network routing: Avoid routing via Internet for server attached to cable modem

Question

I'm painfully unfamiliar with routing and have always been annoyed by an inefficiency in my home network's layout: all traffic to my (local) server via its public IP has much less bandwidth than traffic on the local network only. Here's a diagram of my network structure:

                         +----------+
                         | Internet |
                         +-----+----+
                               |
                      +--------+--------+
                      |   Cable Modem   |
                      | (Cisco DPQ2935) |
                      +---+---------+---+
                          |         |
 +------------------------+--+   +--+----------+
 |          Router           |   |   Server    |
 | (Netgear WNDR3700-100NAS) |   |  (eddings)  |
 +-------------+-------------+   | (public IP) |
               |                 +-------------+
       +-------+-------+
       |  Workstation  |
       |    (feist)    |
       | (192.168.1.x) |
       +---------------+

Running iperf between feist and eddings, I'm told that the bandwidth is 372 Mbits/sec. Running it between feist and another workstation connected to the router, I'm told that the bandwidth is 937 Mbits/sec. In addition, any time my internet connection goes out, I'm unable to connect to eddings without munging around the cabling and network configuration (haven't had this happpen here yet, but it was definitely a problem at my previous location with a different cable modem).

One option I've played with in the past is the fact that eddings has dual NICs: I've connected the second NIC to the router and given it a 192.168.1.x address, as well. However, managing the split DNS this necessitated proved to be a PITA, especially for any laptops that I took out of my network, which would end up trying to unsuccessfully use the local IP for eddings until I remembered to flush their DNS cache.

I guess I'm just hoping that there are some other, brilliant options available here that I'm not aware of. For instance, could I instead connect eddings to the Netgear router and somehow manage for it to use its public IP through the router, but have the router configured such that local workstations don't touch the cable modem to get to it? Any suggestions would be much appreciated.

Answer 1

You can give the server (eddings) two IPs. Either both on on the same NIC, or by using two NICs.

One would be your normal public IP, the other IP would be on the same network as your workstation (192.168.1.0/24). If you have a second NIC (and give it 192.168.1.x) then you can plug that into a switch (LAN, not WAN) port of the Netgear. If you only have one NIC then we will need to configure proper routing in both the Cisco DPQ2935 and in the Netgear WNDR3700.

In the latter case we indeed need more information on the Netgear's firmware and settings.

Answer 2

You could move your server (eddings) to be connected to the router. Then set up your cable modem to have no firewall, and let the router do the fire walling. This is sometimes called 'passthrough mode', but I'm sure if you muck around in the cable modem's settings interface you'll find it. Basically this means any incoming connections from the internet get passed straight through the cable modem to the router.

On the router, you have two options.

1. You can set up eddings (or it's static IP address) as the default DMZ (demilitarized zone) server. Incoming connections arriving at the router that are designated to go somewhere else specific by other options on the router will be forwarded to the designated DMZ server (now eddings). Eddings will function as if it was connected directly to the internet, but will only need a local IP address within the router's subnet. This can be static or DHCP, but if DHCP should be a reserved address.

2. The more secure option is to only forward the specific ports to eddings from the router that eddings is actually interested in, e.g. only SSH and HTTP(S). There should be a port forwarding interface on your router's configuration web page. Again, Eddings will function as if it was connected directly to the internet where the forwarded ports are concerned, but will only need a local IP address within the router's subnet. This can be static or DHCP, but if DHCP should be a reserved address. Eddings will still be fully available locally though in this case, unless you have a firewall on eddings itself.

As a bonus, setting things up in this layout means that your local traffic to eddings (from feist for example) will no longer go through the cable modem. Judging by the information you've given regarding throughput speeds, I'd guess that currently your traffic is not being routed via the internet, but that your cable modem is slower than your router, which is not unsurprising since in normal cases it only needs to bridge a slow internet connection with the intranet, not carry large volumes of intranet traffic.

Finally, if you use a dynamic DNS service (doesn't sound like it, but just in case) get your cable modem to run the update if its firmware allows it, otherwise, if eddings runs an update script, you may have to jump an additional hoop to get the actual public IP you've been assigned to submit to the DNS service.