2

Let's say I have a /27 allocation from my ISP, and let's call it: 90.10.200.32/27

The ISP have their router set up as my gateway on address 90.10.200.33. The range 90.10.200.34-62 are free for me to allocate. I need to add a routed subnet behind this network, that is reachable from the internet. Can I do this by dividing my prefix? Something like this:

  1. I connect a router to the ISP network and give it the address 90.10.200.34/28, and set it's gateway to 90.10.200.33
  2. I configure another interface of the route for the address 90.10.200.49/28, and connect devices to this interface, assigning them addresses in the 90.10.200.50-62 range.

I do not have control over routing tables on the ISP router (90.10.200.33). Is it possible to do this, or something like it without BGP? As far as I can tell, outbound routing would work fine, but I am confused as to whether to ISP router, which obviously only knows about the /27 will be able to direct packets to 90.10.200.34 for the 90.10.200.48/28 network.

Is there another way to do this that does not involve BGP or having the ISP alter the configuration of their router?

Edit: Just to make it clear, the question is whether this is possible without the ISP changing the routing table on their equipment. As such, what I really want to know is whether this form of subnetting can be done "transparently", so to speak, without altering the configuration of the next upstream device.

2

You can subnet the /27 into /30 for the WAN link. That will leave you with another /30, a /29, and a /28 for you to assign on your network.

Like this:

  • 90.10.200.32/30 for the WAN, use 90.10.200.33 for the ISP and 90.10.200.34 for your WAN interface
  • 90.10.200.36/30 for a subnet with 2 hosts
  • 90.10.200.40/29 for a subnet with 6 hosts
  • 90.10.200.48/28 for a subnet with 14 hosts
  • But I would still need to have the ISP alter the routing table on their router, right? Suppose someone tries to address 90.10.200.50. The ISP router will think that the final destination for the packet directly connected by L2 to it, and thus won't forward it to the correct router, even though I subnetted it. Or am I missing something? – Mark Qvist Sep 21 '15 at 20:23
  • No. They will be sending any traffic destined for the /27 to you. How you break it up is entirely up to you. – Ron Maupin Sep 21 '15 at 20:26
  • How does their router (on 90.10.200.33) know that it's supposed to send all traffic to 90.10.200.34, instead of just directly to 90.10.200.50 for instance? Sorry if I'm being dense here, but this the only point I don't understand! How can I just do this, without the ISP telling their router it has been done? What mechanism makes it work? Thanks for your answers! – Mark Qvist Sep 21 '15 at 20:31
  • 1
    That's why we have proxy arp. – Ron Maupin Sep 21 '15 at 20:32
  • Brilliant! That was the missing piece for me! I just read up on proxy arp, and now it all makes sense. Thanks a lot for your insight! – Mark Qvist Sep 21 '15 at 20:45
1

You must ask your ISP to adjust the netmask (say: /29), so the network between ISP-Router and Your-Router is

90.10.200.32 /29 255.255.255.248 0.0.0.7 net-to-isp
90.10.200.33 default-gw for you, ISP-Router
90.10.200.34 (free for future)
90.10.200.35 (free for future)
90.10.200.36 (free for future)
90.10.200.37 (free for future)
90.10.200.38 Your-Router
90.10.200.39 broadcast

Let your ISP route the other adresses route to Your-Router, that ist

ip route 90.10.200.40 255.255.255.248 90.10.200.38
ip route 90.10.200.48 255.255.255.240 90.10.200.38

Also, change netmask on the ethernet interface to /29. Your default-route will be

ip route 0.0.0.0 0.0.0.0 90.10.200.33

The remaining /29 and /28 may be used in the following way:

The first may be used as the interface to Your Firewall(s), You will route the second onto the firewall (to give it a DMZ with real-not-natted ip-adresses).

ALso, you have some ip-adress-space for more devices or hardware-redundany, say two routers, firewall-cluster, ...

1

What does stop you from bridging these two interfaces? Simple transparent bridge.

In this case you save 1 IP address. For all internal devices the GW is the IP of the router. For external devices, everything behind the router is visible, but you may adjust it with some filtering policy.

0

Edit: Just to make it clear, the question is whether this is possible without the ISP changing the routing table on their equipment. As such, what I really want to know is whether this form of subnetting can be done "transparently", so to speak, without altering the configuration of the next upstream device.

Yes

What you need is "proxy arp". When the ISP router arps for an address in one of your subnets your router responds to the arp request as-if it was a host. It will then receive the traffic from the Internet and be able to route it as desired.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.