We have leased a routed block of public IPs (example:, 987.65.43.21 etc.) that will be used for our 10 public web servers (eventually). These servers need to be placed outside the corporate firewall and should be accessible without using VPN. All these public IPs are on a WAN subnet that is different from subnet of router's WAN. The desired result is that if anyone on the internet accesses or 987.65.43.21 from their browser, that request should hit the respective web server. Can you all please suggest how should the router be configured? Do I need to set up port forwarding?

I understand that all routers are different but a theoretical explanation will suffice. I will be happy to provide more information, if required. I am also open to suggestions to buy a specific make/model of router and/or other networking hardware to resolve this situation.


UPDATE 1: My previous ISP had given a block of public IPs that had subnet mask same as the router's subnet mask. Under that setup, I was able to use a switch between modem and router and connect all my web servers to the switch before hitting the router. So these were truly public servers having their own IP and required no VPN. I'd like to implement something similar with the current ISP that gave me two different subnet masks.

  • How you configured it, depends on how your ISP has provisioned the network. – Zoredache Mar 22 '14 at 0:44
  • A lot of how this could be configured depends on your current network topology and can also depend on the ISP. If your main WAN is, you might be able to set up a static route that lets the other block out the gateway of the first one, This would mean that you'd have to have the interface that the second router is plugged into free of firewall/vpn/vlans. – MaQleod Mar 22 '14 at 0:54
  • ISP provided two subnet masks - one for our router's WAN and another for routed /27 IP block. Does this info sound helpful? – user309223 Mar 22 '14 at 0:56
  • Are you also planning to setup a firewalled DMZ? – Eric G Mar 22 '14 at 1:48
  • @MaQleod, I configured a static route and I am able to reach out to internet from my web server. However, the server itself is not accessible from internet (I have no port forwarding set). Any ideas how to reach the server from my phone (for example)? – user309223 Mar 22 '14 at 1:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.