1

I have a Draytek Vigor 2920, Juniper SRX 210 router, and Cisco SC300-10 switch. I am very confused; how can I set it up so that I have a public IP address on my Dell R310?

1 - My ISP, Telenet from Belgium, has given me 8 Public IPs to use in my Dell R310 server but their setup is very disturbing.

I have to setup 213.x.x.254 on my WAN interface in my Draytek router. After that, I have to setup VLAN 1 to get the public IP of 82.x.x.17/29.

After that, I have to do a ip route 0.0.0.0 0.0.0.0 213.x.x.253 for my default route.

2 - I have completed the steps above, but the problem is following: Dell R310 has network interface eth0 with IP 192.168.1.10 and in the router I have a DMZ from 84.x.x.1 to 192.168.1.10

All of my problems start from here, because when the SIP Protocol sends traffic, it uses 192.x.x.x, not 84.x.x.x; a result of NAT problems.

Question: How can I have my Dell R310 with a real public IP? So that eth0 isn't configured like this: 192.168.1.10. Rather, a static IP set as: 84.x.x.1 (I have NAT problems for this reason)

enter image description here

EDIT: Draytek Vigor 2920 series i have: setup the WAN IP but how can i assign the WAN Public IP to VLAN or Local interface 1?

ISP wants me to keep this setup in my DrayTek: http://fpaste.org/69305/13899673/

enter image description here enter image description here

EDIT: FYI

a) Thank you to the excellent answer after doing them correctly its working.

b) DrayTek router is NOT consumer/residential routers/low quality router they have been used in many many Enterprises, Telecom sectors, and many large enterprises.

c) DrayTek router was designed to make easy/quick configurations (compared to Cisco/Juniper complex)

Following setup specially IP routed subnet module has resolved my problem, which is allowing me no NAT but straight public IP to my LAN interface without having any firewall/blockage.

Setup the Public IP WAN Tunnel Setup DHCP server + wifi + Public IP for manually to setup Setup Public IP's without NAT enter image description here

EDIT: Draytek supports reply (hope it helps others)

You are not supposed to set the external IP address from your provider as the LAN address of the DrayTek. To achieve this situation, you have to use a function called 'Public Routed Subnet'. We have a dutch manual available for using this function. Please refer to the following manual: http://www.draytek.nl/files/Public%20routed%20subnet_1.pdf

  • Draytek Vigor has many enterprise module i am using one of them: draytek.com/… – YumYumYum Jan 17 '14 at 13:48
  • 1
    @YumYumYum Are you required to use 192.168.1.x? – Ryan Foley Jan 17 '14 at 13:58
  • @Fizzle: ISP has given me this: fpaste.org/69305/13899673 , nowhere they mentioned to use 192.168.1.x and ISP is doing clear in/out packet bypass they told me and told me i have to setup it in my DrayTek or Dell R310. I am not forced to use 192.168.1.x (if this answers your question? please). – YumYumYum Jan 17 '14 at 14:04
4

I’m trying to understand what you’re asking, and based on how you described the network setup, there isn’t any good reason to use private addressing; even if you need to use separate network for other functions. The link you provided in the comments advertises that it handle multiple subnets.

I would start with setting your Draytek Vigor up as a DHCP server that assigns the public address space (84.x.x.*) you have been allotted. This will take away the NAT and allow inbound requests to your public addresses with relative ease.

If you want to keep your private IP address space intact, then you would set up your server (192.168.1.10) as the DMZ for your WAN address (212.x.x.x).

  • Excellent. I think its the best answer. 84.x.x.* i can put in my LAN as DHCP server and that solves my problem of NAT . Many thanks. – YumYumYum Jan 17 '14 at 14:38
5

You are probably better off with not using NAT for the server. I don't know how to configure the Draytek, but your Juniper SRX is certainly able to do the following:

  • Your WAN address of the router/firewall is 213.x.x.254/30
  • The default gateway of the router/firewall is 213.x.x.253

Telenet will route 82.x.x.16/29 to 213.x.x.254. From the /29 subnet you will be able to use addresses 82.x.x.17 - 82.x.x.22. I'm using the first available address as the router/firewall address. That leaves 82.x.x.18 to 82.x.x.22 for other devices.

Because you probably have both devices that have to be reachable from the internet with their own public address and devices that don't need that it is useful to create two internal networks: a DMZ and a LAN. The public addresses are routed to the DMZ and the rest of the devices (your office?) is connected to the LAN. The LAN uses NAT to save IP addresses.

First the DMZ:

  • Your DMZ address of the router/firewall is 82.x.x.17/29
  • Your server's address can be anything from 82.x.x.18 to 82.x.x.22
  • Your server's default gateway is 82.x.x.17
  • You configure all of this this statically

And the LAN:

  • Your LAN address of the router/firewall is (for example) 192.168.1.1/24
  • Your devices use 192.168.1.1 as their default gateway
  • The router/firewall runs a DHCP server to supply all necessary information to connected devices

You now have to configure a firewall policy on the router/firewall that allows all the traffic. An example:

  • Allow everything from the DMZ to the internet without NAT
  • Allow everything from the LAN to the internet using NAT
  • Allow everything from the LAN to the DMZ without NAT
  • Allow nothing from the internet to the LAN
  • Allow (almost?) nothing from the DMZ to the LAN
  • Allow only the publicly available services from the internet to the DMZ

For the DMZ and LAN you can use either physically different ethernet ports and ethernet switches, or you can use VLANs to be able to implement it on a single switch. You could even make the DMZ and LAN one network, but then you cannot protect the LAN from the server (in case someone breaks in or finds an exploitable bug).

  • Here i have one problem. if the LAN is 192.168.1.x then remote servers cant send traffic properly cause a Audio problem with SIP. Cause of NAT. – YumYumYum Jan 17 '14 at 14:42
  • 1
    Then don't use a LAN and put everything in your DMZ :-) – Sander Steffann Jan 17 '14 at 14:43
  • DMZ i set 192.168.1.10 so that all incoming traffic goes to Dell R310 which is fine. But Del R310 when sending out traffic it has header stamp as: 192.168.1.10 which cause TurnSErver/ ICE server failure. (but i tested other servers which has eth0 public ip then they works). – YumYumYum Jan 17 '14 at 14:45
  • 2
    I think you misunderstand what a DMZ is. It is a separate network that is separate from your LAN to be able to have separate security zones. What you describe sounds like what some vendors (inappropriately) call a 'DMZ host' feature, which is just a kind of wildcard port forwarding through NAT. That is definitely not what you want. In a real DMZ your server has a real public IP address, not a private one that is NATed. – Sander Steffann Jan 17 '14 at 14:49
  • I understand now. its very confusing inbound and outbound traffic all works. Only i am facing the problem with SIP RTP media, where remote users cant listen any audio from the Dell server 192.168.1.10 – YumYumYum Jan 17 '14 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.