My ultimate goal is to run a VPN through my Cisco Router, which to me means getting the Comcast Gateway out of the way. To this end, I would like to place my Cisco Router (and/or Switch) logically closer to the WAN and remove my Comcast Modem as a logical device. I cannot really remove the modem (it provides the WAN access, after all), however, I do not need its DHCP, NAT or firewall services. I'd like configuration advice.


Here's my current network setup:

Comcast Gateway - Cisco Router - Cisco Switch < LAN & Wifi (Ruckus)

  • Comcast Modem: TC8305C
  • Cisco Router: 1941-sec/k9 + ehwic-4esg
  • Cisco Switch: 2960S 48TS-L (Multi-layer switch, VLANs, etc.)

Modem runs as DHCP Server, NAT and firewall with inside address The Router's WAN port is connect to it with a dynamic address (DHCP client). On the Router's LAN side, it is also running NAT (yes, double NAT'ed, for now), DHCP Server, DNS, NTP.

My thoughts on options are:

  1. Run Modem in Bridge Mode.
  2. Place Router in Modem's DMZ.
  3. One variation on 1&2 is to connect Modem to switch.

Modem In Bridge Mode

I tried to set the Modem into Bridge mode and had a very unpleasant 90 minute period where my internet access was down and had to endure some very angry users. I'm guessing I failed to configure the Router WAN port correctly. Probably because it was in DHCP mode. I'd like to try to set it to a static address (e.g., however I'm a little gun shy about Bridge Mode, right now. Google generates plenty of hits when searching for "Comcast Bridge Mode", however I haven't been able to make much use of what I found. I haven't been able to find a good incantation for Router WAN port configuration with Comcast Bridge mode.

As an aside, the Comcast bridge isn't entirely transparent, the Modem retains its IP address ( to which I can connect via http and reconfigure (fortunately) when I attach a laptop directly to it Port 1 on the Modem. So, my laptop understands how to deal with the Modem in bridge mode, even if the Router does not.

I'm also confused how in Bridge Mode the Router gets dynamic settings from Comcast ISP (for DNS and default Gateway, etc.) like it would with DHCP. Or, if these are not really dynamic and I should just hard code them in the Router configuration file.

I believe this is the best option for the network because the Modem steps out of the way completely and the Router can run security, VPN, DDNS, etc.

What should I be doing to make this work?

Router in Modem DMZ

Here, I can finese whatever configuration problems I might be having and just drop the Router (with a static IP of, say, into the Modem's DMZ and let all internet traffic be forwarded to this. There's not a whole lot different between this configuration and the one above, except that the Modem is still acting like a Layer 3 device (well, even more like a Layer 3 device). I'm fairly certain I can get this working and I see no reason why I couldn't get VPN working through the Router.

The one drawback here is that the Modem only provides for dyndns.org for running Dynamic DNS. I have no opinion about this organization as a DDNS provider, however, I'd like a choice of vendors, something the Router would allow. Also, the engineer in me wants as little unnecessary processing on the WAN path, so bridging the Modem just feels better.

Run Modem through Switch

When I chatted with a Network Engineer a while back, he suggested that I could run the Modem directly into the Switch. We didn't go into details regarding the configuration. My assumption is that either of the above scenarios (Bridge or DMZ) could work just as well into the Switch directly with the following provisions:

  1. Proper ACL set up on the Switch/Modem Port to prevent external attacks.
  2. Separate VLAN for Modem & Router communication to forward incoming DMZ traffic to the Router. Incoming traffic should be limited to VPN traffic. All other traffic (TPC, UDP, ICMP) would be blocked for security purposes. The same ACLs that would be on WAN side of Router.

I'm guessing he recommeneded this set up because by placing the Modem on the Switch directly, you take advantage of the Switch's ability to short cut IP packets after connection establishment. That is, once an internal device connects through the Modem (presumably, connection establishment started with VLANs on the Router), the Switch recognizes this and routes all relevant IP packets directly between the internal device and the modem, skipping the Router. This cannot occur in the physical configuration under which the Modem and the Switch are on Router ports.

Wrap Up

  1. What should my Router's WAN Port configuration look like to ensure it works with a Comcast Modem in Bridge mode? Are there any other config options I should look out for (like DNS servers)?
  2. Alternatively, should I settle for placing the Router in the DMZ?
  3. Is it worth reconfiguring and moving the Modem to a Switch Port for either #1 or #2?
  • Have you considered buying your own modem? Comcast maintains a list of compatible modems, and most in the list do not do routing, DHCP, DNS, etc. This seems to be what you want. You will need to inform Comcast when you want to use your modem, and they will need model an MAC address information.
    – Ron Maupin
    Nov 18, 2015 at 17:58
  • @RonMaupin Thanks. I have. I think at the moment, I'm still gun shy about Bridge Mode and am looking for some guidance on the Router's Port configuration. What I mean is, vendor router or owned router, I'm still unclear on Router port set up. Perhaps, I need to experiment more with configuring that port while the modem is in Bridge Mode? Nov 18, 2015 at 18:01
  • When you own the modem, you just need to set up NAT on your router, and control everything from the router. Unless you run Comcast's modem in bridge mode, you will not be able to avoid its layer-3 control.
    – Ron Maupin
    Nov 18, 2015 at 18:05
  • I believe I understand that. The problem isn't getting the Modem into Bridge Mode, the problem is no network connections through the Router when I do that. Something's wrong with my Router's WAN Port configuration (and possibly other parts of its configuration) such that when I put the Modem in Bridge Mode, there's no internet connectivity. A laptop attached to the Modem while Bridged can contact the internet. Nov 18, 2015 at 18:07
  • When you have the modem in bridge mode, you need to configure your router to take over the modem functions like NAT, DNS, DHCP, etc. Your router's WAN port will need to be set for DHCP as its IP address.
    – Ron Maupin
    Nov 18, 2015 at 18:10

4 Answers 4


When you have the modem in bridge mode, your laptop works because it is using DHCP to get its IP address and other information from Comcast. You will need to set the router to do the same thing.

I have this same setup with a my cable Internet provider with a Cisco ISR G2 router:

interface GigabitEthernet0/0
 description WAN
 ip address dhcp
 ip access-group WAN_Firewall in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip inspect WAN_Inspect out
 ip virtual-reassembly in
 ip verify unicast source reachable-via rx allow-default 100
 load-interval 30
 duplex auto
 speed auto
 no cdp enable
 service-policy output QoS-WAN-Out

You need to have your router receive DHCP for its WAN address. You will also need to configure NAT and DHCP (unless you have that on another server) on the router.

The full configurations for your firewall, NAT, DHCP, etc. are too broad to cover.

  • Actually, the laptop didn't get its address from DHCP. It set its address to a link local address 169.254.X.X. I'm suspecting the reason this works for you is that the Modem gives you a proper Bridge Mode and you pick up the DHCP Server from your cable provider. Whereas, the less than true Bridge Mode on my modem means I need to set that Port as a static IP. I really do believe the remainder of my internal network is configured just fine. A show xxx on the Router for arp, dhcp bindings, nat, etc. has everything you'd expect. I'm not relying on Modem for anything but WAN access. Nov 18, 2015 at 18:32
  • If the laptop worked when it was set to DHCP, that's what you need to do for your router. Do You have an assigned, static, public IP address from Comcast? If so, you use that, if not, you must use DHCP. Questions from end-users of ISPs are specifically off-topic, so you will need to deal with Comcast about that. This is really pretty easy, you either have an assigned public IP address which you must use, or you connect via DHCP.
    – Ron Maupin
    Nov 18, 2015 at 18:36
  • I'm not asking about the Modem connection to the ISP, I'm asking about the Router connection to the Modem in Bridge Mode. In that mode, DHCP client requests are not handled. Furthermore, in Bridge Mode, the Modem itself has a WAN assigned IP (provisioned by DHCP) and a LAN reachable IP, therefore my Router cannot request anything as a DHCP client. From this discussion, I'm guessing I really need to make a static IP assignment on the Router WAN Port and test with Modem Bridging. Nov 18, 2015 at 18:44
  • What I have explained a couple of times is that you have two choices for your router WAN configuration: a static address assigned by Comcast, or DHCP. Those are your two choices. You can work with Comcast to determine the appropriate choice. This is really very simple, and people do this everyday. You wanted this from someone who does this, and I do this. If you want to eliminate the modem as a network device, you can set it to bridge mode, or you can get your own. I really don't understand the problem. If it works, there is no real reason to change it since you don't gain anything tangible.
    – Ron Maupin
    Nov 18, 2015 at 18:50
  • Thanks, but I need to run VPN into the Router, so the Router (and not the Modem) needs its external face available. Thanks. You moved my understanding a bit further down the road. I'm not sure I fully understand, yet. If I see other answers here or when I finally get it working, I will post something. Nov 18, 2015 at 18:53

First off, you shouldn't need to place your modem in "bridged mode" or even mess with it, as Comcast keeps this under lock anyway. From the router enter the configuration example that Ron placed above. So for example, the Gi0/0 should be your outside interface it is the ISP/Internet facing interface- i.e., Comcast - and your Internal interface is Gi0/1 the commands are no different except the descriptions and "IP Nat overload" if you are doing PAT as Comcast only gives you 1 IP address so using 1 to 1 maybe more helpful to you. interface command - after you created a DHCP & NAT Pool according to your public IP addressing scheme. Good luck Brother!

  • I've reached detente with my box, but I need to revisit this. Been having some problems with connection drops for SSL connections through my Router. I think I need to upgrade ios version. I also think it might be related to the double NAT (double PAT) through cable and Router. I don't want cable box handing out IP addresses. I really would like to not have cable box PAT'ing or otherwise in the way. Still working through all of this, but it hasn't been a high priority. When I finally figure it out, I plan to post back here how I solved it. Oct 17, 2016 at 23:25

You can typically log into the customer premise equipment (CPE) by connecting to it via your web browser. (Yours is done like this). So, look at what your DHCP provided ip default gateway is (in windows open command prompt type ipconfig/all). Plug that IP address into your browser to connect. You may need to add /admin after the address. Search based on your model CPE.

Once in there, most CPE's allow you to assign your single public IP address to a device in your home network. You would apply that IP address to your router. From there, configure it as you wish.


Honestly, if you want to get out from under Comcast's thumb, replace router modem. You can have all the other devices you like (Switch, Router, etc.), but the main connection and control of that connection happens at the modem. There are Comcast compatible modems for sale on Amazon and they are not expensive (I bought one and it works great!). The type of modem you need to purchase depends on what services you have from Comcast. For example, if you have Comcast Voice, you will need to get a modem with Phone port (rj-11), as well as the normal Ethernet (rj-45). This is the modem I have, it does not have a Phone Port, but this one does.

In the end, purchasing a modem to replace Comcast's will save you the monthly rental fee they charge you, give you more control over your network and hopefully out-preform Comcast's. Hopefully it will open up new ways of being able to get the setup you want. Good Luck!

P.S: Comcast Modems are actual Modem/router combos so you technically have 2 routers including your Cisco one. Turning the modem into Bridged Mode basically just removes the router.

Pic of My Modem


Since you have a router externally as well, there really is no need for 2 routers. That's where literal signals get crossed. I am sticking with my original recommendation to save yourself some money and take back control of your network. (Notice Xfinity's Modem has several important options greyed out)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.