My ADSL provider is providing me with a routed subnet over ADSL.

I have two IP address ranges: the PPP range (to estabilish the PPP connection between the modem and the ISP) and what they call the LAN range, a /30 which is the publicly routable subnet that they route to the modem.

Now, in the default setup they gave me, they assigned the second LAN address to the router and the third LAN address to a NAT. So, basically, all I really have is just one public IP which I use to surf the Internet through NAT.

Since I want to use all the four IP addresses they are routing to me, without caring for the fact that they are a subnet, I'd like the modem not to have an IP address and to just "reroute" all the four IPs to a firewall such as pfSense.

How can I do this?

  • 1
    Your WAN link is probably /30, but what size is the LAN network?
    – Ron Maupin
    Feb 24, 2017 at 3:01
  • There's no LAN network here, just a range of publicly routed IP addresses that my ISP calls "LAN range". These are the actual addresses that are being routed to my modem through the PPP connection, and there are four of them (a /30). The PPP link is also on a /30. Feb 24, 2017 at 3:04
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 17, 2017 at 3:32

2 Answers 2


Apparently, the LAN network range the ISP is giving you is /30. There really are not four usable addresses in a /30 network, there are only two. That means you assign one address to a router LAN interface, and one address to something like a server. You only have two usable addresses, and that is it.

What you need to do is have two LAN networks: one private network as large as you like, and one public network with two usable addresses (router and some other device).

  • Yes, I understand this, but why is this the case? E.g. let's say I have is the network id and is the broadcast address, so you may say I can't really use them. Fair, but still, both those IP addresses are still being routed to my modem, so what stops me from "faking" that, for example, I own the block instead of the block? If I set the mask on my interfaces to /16 instead of /30 and assign the previously "invalid" and addresses, wouldn't my router respond to these as if they were usable, making them, in fact, usable? Feb 24, 2017 at 3:18
  • You need the broadcast address as a broadcast address. Trying to kludge up something like you suggest will just lead to grief. If you need more addresses, then you need to get your ISP to assign a larger address block.
    – Ron Maupin
    Feb 24, 2017 at 3:22
  • Again, fair enough, but what if I really do not need the broadcast address? What if I'm happy with singularly re-routing the four addresses to four different servers and use all four as single fixed addresses? Isn't that what, for example, OVH does when you buy a dedicated server with a single public static IP address? Or, even, what if I'm happy with routing all four to a firewall and then assign one for NAT and the other three for 1:1 NATting? I'm not trying to challenge you, I'm just trying to understand why I should basically discard half the IP addresses I'm given. Feb 24, 2017 at 3:27
  • Unfortunately, that is how IPv4 is. You simply cannot use the network or broadcast addresses. The waste of half the addresses in a /30 network is why RFC 3021, Using 31-Bit Prefixes on IPv4 Point-to-Point Links was developed. Unfortunately, and despite being around for over 16 years, not all device vendors support it, and no ISPs I have ever seen. You could try to set up two /31 networks instead, and you would have two router addresses, and two device addresses.
    – Ron Maupin
    Feb 24, 2017 at 3:36
  • Isn't that specific to point to point links? How does it apply to my public block? Feb 24, 2017 at 3:38

It's difficult to be more specific without knowing exactly what equipment you have but afiact if you can add static routes on the ISP router the following should be possible.

  1. Add the IPs as "loopbacks" on your firewall box. Since these are loopbacks and not assigned to a network there is no need for "network" or "broadcast" addresess.
  2. Use private IPs for the link between your firewall and the ISP-supplied router
  3. Add a static route to the ISP supplied router to forward the "LAN range" to your firewall box.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.