How can i make Public IP of this ISP given information?

Question

I have a Draytek Vigor 2920, Juniper SRX 210 router, and Cisco SC300-10 switch. I am very confused; how can I set it up so that I have a public IP address on my Dell R310?

1 - My ISP, Telenet from Belgium, has given me 8 Public IPs to use in my Dell R310 server but their setup is very disturbing.

I have to setup 213.x.x.254 on my WAN interface in my Draytek router. After that, I have to setup VLAN 1 to get the public IP of 82.x.x.17/29.

After that, I have to do a ip route 0.0.0.0 0.0.0.0 213.x.x.253 for my default route.

2 - I have completed the steps above, but the problem is following: Dell R310 has network interface eth0 with IP 192.168.1.10 and in the router I have a DMZ from 84.x.x.1 to 192.168.1.10

All of my problems start from here, because when the SIP Protocol sends traffic, it uses 192.x.x.x, not 84.x.x.x; a result of NAT problems.

Question: How can I have my Dell R310 with a real public IP? So that eth0 isn't configured like this: 192.168.1.10. Rather, a static IP set as: 84.x.x.1 (I have NAT problems for this reason)

EDIT: Draytek Vigor 2920 series i have: setup the WAN IP but how can i assign the WAN Public IP to VLAN or Local interface 1?

ISP wants me to keep this setup in my DrayTek: http://fpaste.org/69305/13899673/

EDIT: FYI

a) Thank you to the excellent answer after doing them correctly its working.

b) DrayTek router is NOT consumer/residential routers/low quality router they have been used in many many Enterprises, Telecom sectors, and many large enterprises.

c) DrayTek router was designed to make easy/quick configurations (compared to Cisco/Juniper complex)

Following setup specially IP routed subnet module has resolved my problem, which is allowing me no NAT but straight public IP to my LAN interface without having any firewall/blockage.

EDIT: Draytek supports reply (hope it helps others)

You are not supposed to set the external IP address from your provider as the LAN address of the DrayTek. To achieve this situation, you have to use a function called 'Public Routed Subnet'. We have a dutch manual available for using this function. Please refer to the following manual: http://www.draytek.nl/files/Public%20routed%20subnet_1.pdf

Answer 1

I’m trying to understand what you’re asking, and based on how you described the network setup, there isn’t any good reason to use private addressing; even if you need to use separate network for other functions. The link you provided in the comments advertises that it handle multiple subnets.

I would start with setting your Draytek Vigor up as a DHCP server that assigns the public address space (84.x.x.*) you have been allotted. This will take away the NAT and allow inbound requests to your public addresses with relative ease.

If you want to keep your private IP address space intact, then you would set up your server (192.168.1.10) as the DMZ for your WAN address (212.x.x.x).

Answer 2

You are probably better off with not using NAT for the server. I don't know how to configure the Draytek, but your Juniper SRX is certainly able to do the following:

• Your WAN address of the router/firewall is 213.x.x.254/30
• The default gateway of the router/firewall is 213.x.x.253

Telenet will route 82.x.x.16/29 to 213.x.x.254. From the /29 subnet you will be able to use addresses 82.x.x.17 - 82.x.x.22. I'm using the first available address as the router/firewall address. That leaves 82.x.x.18 to 82.x.x.22 for other devices.

Because you probably have both devices that have to be reachable from the internet with their own public address and devices that don't need that it is useful to create two internal networks: a DMZ and a LAN. The public addresses are routed to the DMZ and the rest of the devices (your office?) is connected to the LAN. The LAN uses NAT to save IP addresses.

First the DMZ:

• Your DMZ address of the router/firewall is 82.x.x.17/29
• Your server's address can be anything from 82.x.x.18 to 82.x.x.22
• Your server's default gateway is 82.x.x.17
• You configure all of this this statically

And the LAN:

• Your LAN address of the router/firewall is (for example) 192.168.1.1/24
• Your devices use 192.168.1.1 as their default gateway
• The router/firewall runs a DHCP server to supply all necessary information to connected devices

You now have to configure a firewall policy on the router/firewall that allows all the traffic. An example:

• Allow everything from the DMZ to the internet without NAT
• Allow everything from the LAN to the internet using NAT
• Allow everything from the LAN to the DMZ without NAT
• Allow nothing from the internet to the LAN
• Allow (almost?) nothing from the DMZ to the LAN
• Allow only the publicly available services from the internet to the DMZ

For the DMZ and LAN you can use either physically different ethernet ports and ethernet switches, or you can use VLANs to be able to implement it on a single switch. You could even make the DMZ and LAN one network, but then you cannot protect the LAN from the server (in case someone breaks in or finds an exploitable bug).