1

I am using a Peplink Balance 30 router. Right now I have only one public IP. I have set up the LAN for 192.168.8.1. I have five devices on the LAN side, including two Ubiquiti Rockets and three IP cameras. My question is: Should I be using NAT with only one public IP address? I have configured port forwarding rules and am using high-numbered ports to access port 80 for management of the devices on the LAN side. For example publicIP:55000 is port forwarded to 192.168.8.2:80, etc.... What is the best practice to do what I want to do?

Improve this question
5
  • 1
    "Should I be using NAT with only one public IP address?" I'm not sure I understand the question because you do not have a choice if you have only one public IP address. If your business needs more than one public IP address, then you need to negotiate that with your ISP. Also, unless you have a good firewall with proper source restrictions, you should not forward to the management of your devices. As soon as you connect to the public Internet, you are being attacked by thousands of bots that are looking for an opening into your network (just look at your logs).
    – Ron Maupin ♦
    Dec 2, 2022 at 2:28
  • I guess I should clarify. This router is located at a remote location and I have firewall rules that only allow access to it from my network here at home. I am not sure what you mean by "you do not have a choice"? I can either enable NAT or not. But what is the best practice?
    – Eric
    Dec 2, 2022 at 3:34
  • If you only have one public address, you can only assign that address to the Internet facing router. To get to anything behind the router, or for any device behind the router to use the public Internet, you must use NAPT, else it is one public address, only one device can use the Internet.
    – Ron Maupin ♦
    Dec 2, 2022 at 3:46
  • It seems to me that I can set up the single public WAN IP on the router and then set the LAN to the 192.168.X.X range, leave DHCP turned off. Use static IPs on all of my LAN side devices. Set up port forwarding rules such as PublicIP:55000 = 192.168.8.2:80 & PublicIP:55001=192.168.8.3:80. Any reason why that wouldn't work as desired without enabling any NAT?
    – Eric
    Dec 2, 2022 at 20:35
  • You cannot source packets from private addresses onto the public Internet. You must use NAT (Network Address Translation) to translate the private addressing to your public address to use the public Internet.
    – Ron Maupin ♦
    Dec 2, 2022 at 20:53

2 Answers 2

Reset to default
3

... set up the LAN for 192.168.8.1 ... Should I be using NAT with only one public IP address?

If your devices require Internet access with IP4 you need to use source NAT/NAPT. Destination NAT is required when you need to provide access from public addresses to private addresses inside your network.

The best way to use NAT is to avoid it wherever you can. NAT is a crude kludge, breaks various things and is at its best when it's absent. For communicating between private networks, VPN is the best choice.

A VPN tunnel not only allows transparent addressing between the networks, without mapping between public and private addresses, it also provides encryption. That way, no sensible data can be overheard from the outside (maangement/user credentials, etc).

Note that for devices to be on topic here, the vendor needs to offer optional, paid support.

Improve this answer
2

With only a single public IP address on the internet service, and the desire to use more than 1 device on the network that uses that internet service, you MUST use NAT to share the single public IP address for multiple devices.

As for providing remote access to manage the devices on the LAN inside the router, you can either do port forwarding as you describe or simply use VPN service to be able to connect a VPN session to the router which would be configured to allow access to whatever devices you want on the inside LAN.

Improve this answer
2
  • I appreciate your comments. I can not use VPN as I have traffic through the port forwarding from various other locations/IPs. They are all firewalled but each may have different privledges.
    – Eric
    Dec 2, 2022 at 20:30
  • Then it sounds like you are all set if you already have port forwarding working.
    – FrameHowitzer
    Dec 3, 2022 at 6:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.