Network topology for multiple external IPs

[theystolemyname]

NAT can eat a bag of hell. My ISP gives us 3 external IPs for free, and I think it's time to start taking advantage of this.

I've got the following:


network hardware:
1x linksys wrt54gl running dd-wrt
1x gigabit switch that I will buy based upon recommendations


machines:
1. NAS box that needs external IP (for torrenting legal linux isos of course).
2. Gaming box that needs external IP for occasionally running a small game server.
3. xbox 360 that could be wired to the switch on my wrt54gl and set to DMZ in order to get around NAT.
4. small number of wireless devices that do not need to be on DMZ on the wrt54gl, as they play nice with NAT.



I would like the NAS box and gaming box to be able to share files at 1 gigabit speeds. It is not critical, but I would also like the wireless devices to be able to access the shared files on the NAS box - obviously at slow 802.11g speeds. The boxes that aren't protected behind the routers firewall will be running software firewalls.


Please halp.

 

[Captain Colonoscopy]

NAT can eat a bag of hell. My ISP gives us 3 external IPs for free, and I think it's time to start taking advantage of this.

I've got the following:


network hardware:
1x linksys wrt54gl running dd-wrt
1x gigabit switch that I will buy based upon recommendations


machines:
1. NAS box that needs external IP (for torrenting legal linux isos of course).
2. Gaming box that needs external IP for occasionally running a small game server.
3. xbox 360 that could be wired to the switch on my wrt54gl and set to DMZ in order to get around NAT.
4. small number of wireless devices that do not need to be on DMZ on the wrt54gl, as they play nice with NAT.



I would like the NAS box and gaming box to be able to share files at 1 gigabit speeds. It is not critical, but I would also like the wireless devices to be able to access the shared files on the NAS box - obviously at slow 802.11g speeds. The boxes that aren't protected behind the routers firewall will be running software firewalls.


Please halp.

I would keep all my boxen behind the hardware firewall. if you want to take advantage of the multiple external IPs then do static NAT translations and ACLs on the firewall to the internal boxen. Much more secure that way. I hope you weren't really thinking about plugging a windows box with a software firewall directly into the internet tubes...

 

[Orinthical]

What problems are you running into? Maybe we can help with that more directly.

As for the Xbox360, if you aren't using it as a media extender or want/need it to access your internal boxes, you could get a switch and put it before your router --- then plug the xbox 360 into the switch instead of the router.

So...

Modem ---> Switch1 ----> Router ----> Computers
..................Switch1 ----> XBox360

I, like the poster above me, would never recommend putting a windows workstation ("secured" or not) directly on the internet unless there was a really good reason to do so.

I think a better solution for you is really going to be getting a better router. Have you tried DD-WRT? It might breath some life into that old WRT54GL. The alternative to a new off-the-shelf router with more horsepower, would be using some older hardware and with something like pfSense. All you need is an old pentium/II/III box with two NICs.

 

[nessus]

I would keep all my boxen behind the hardware firewall. if you want to take advantage of the multiple external IPs then do static NAT translations and ACLs on the firewall to the internal boxen. Much more secure that way. I hope you weren't really thinking about plugging a windows box with a software firewall directly into the internet tubes...

People do it all the time, kind of like how MS hosts microsoft.com now with directly attached 2k8 boxes(now 2k8R2 x64 running in Hyper-V, but originally all but one box was moved to 2k8 at the beta2 stage), and 2k3 boxes before that? http://blogs.technet.com/windowsserver/search.aspx?q=microsoft.com+hosting&p=1

A properly configured server behind a software firewall is not any more exposed than the same server behind a hardware firewall with the same firewall rules.

 

[Orinthical]

A properly configured server behind a software firewall is not any more exposed than the same server behind a hardware firewall with the same firewall rules.

Agreed, many of the top companies in the world also use ISA running on a windows server but there's a huge difference between a properly secured server OS and a desktop OS with or without a software firewall product.

Regardless, my point was that there's something else causing the OP his woes... it's not NAT.