2

I need to setup up an enterprise router and a cable modem. The cable company has provided me with a /28, say 66.1.1.240-255 with a gateway address -- 66.1.1.241 -- as part of the /28.

The router has two ethernet ports, one of which will have the cable modem directly attached. I assume the ip address of the modem is 66.1.1.241.

The workstations behind the firewall will have addresses from .242 - 254.

How do I configure the router, specifically the ip address of eth1 to which the modem is attached and the ip address of eth2 which will handle the workstations? Can eth2 be ip-less and simply have a default route to eth1?

Do the client workstations have their gateway set to the ip of eth1 or the ip of the cable modem?

As a note, I've never done this with this kind of setup. Usually, I'm setting up fiber connections such that I have a separate subnet for eth1, usually a /30 and eth1's gateway is the remote fiber switch.

Thanks for any input.

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Apr 1, 2018 at 21:23

2 Answers 2

Reset to default
2

Routers route between networks, not from a network back to the same network, so each router interface must be in a different network.

There are a couple of ways to handle this, but the easiest would be to simply set up a transparent firewall between the cable modem and the workstations.

If you need a router because you will have several networks behind it, then you can use private addressing and one-to-one NAT for the workstations that are going to use the public addresses.

The most awkward way would be to subnet your public address block because that would waste addresses on network and broadcast addresses for each subnet.

Improve this answer
2
  • Can you explain what a transparent firewall is? I don't have to use a cisco router. I can use something like the enterprise-level mikrotiks instead. Still the same setup -- incoming and outgoing Ethernet, etc. It seems to me that routing would still be involved but I'm open for anything!
    – Chris
    Feb 25, 2018 at 16:57
  • This is a quote from Cisco ASA 5500 Series Configuration Guide: "Traditionally, a firewall is a routed hop and acts as a default gateway for hosts that connect to one of its screened subnets. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a "bump in the wire," or a "stealth firewall," and is not seen as a router hop to connected devices."
    – Ron Maupin ♦
    Feb 25, 2018 at 17:00
1

Here is how I solved this:

I set up a bridge between ether1 (outside world) and ether2 (inside world).

Ether1 is connected directly to the cable modem. Ether2 was assigned a public ip address from the subnet the cable company provided and connected to the main switch. This essentially assigned an IP address to the bridge with a gateway address the cable company assigned (.241, in this case, which is the cable modem IP).

Each workstation was then assigned another public ip address from the list with the same gateway. The only physical path to the gateway from the inside world is through ether2->ether1 via the bridge and the converse from the outside world.

The firewall, NAT and Mangle rules, previously using "In. Interface" and "Out. Interface", were changed to use "In. Bridge Port" and "Out. Bridge Port", essentially providing the same functionality as I had before. Traffic from the outside world hits the cable modem, then ether1->Mangle/NAT/Filter->Ether2->Switch.

I even set up some packet marks and Queues to prioritize our VoIP traffic and a few other things and those are working perfectly.

Now, I am not sure if this is what was referenced above as a "transparent firewall". It's simply a firewall over bridging.

Improve this answer
3
  • Actually, MikroTik does not offer optional, paid support, so its products are off-topic here.
    – Ron Maupin ♦
    Apr 7, 2018 at 17:46
  • This was not a Mikrotik-specific issue. I just happened to solve it using RouterOS rather than Cisco IOS. I could have easily used the exact same setup on any commercial-grade router. In fact, I'll probably do that in the next few weeks. It was the process, not the platform, that was important to understand. I'll edit my answer to remove the single reference to Mikrotik.
    – Chris
    Apr 7, 2018 at 22:40
  • "This was not a Mikrotik-specific issue." I understand that, which is why I made the comment and didn't close the question. Also, bridging is layer-2, which is what the quote I provided says: "A transparent firewall, on the other hand, is a Layer 2 firewall..."
    – Ron Maupin ♦
    Apr 7, 2018 at 22:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.