Subnet

rjel · 01-26-2006, 11:42 PM

Our ISP have provided us the following:
net segment 62.95.3.112/28;
ISP gateway 62.95.3.113.
free ip 62.95.3.114-126
broadcast adress 62.95.3.127

What I want to do is to take some of the free ip-adresses and use it for a server in our DMZ. What I did is configuring our firewall/router with

external interface
IP: 62.95.3.114 netmask 255.255.255.252

DMZ interface
IP 62.95.3.121 netmask 255.255.255.252

Server on DMZ
IP 62.95.3.122 netmask 255.255.255.252

But it doesn't work when trying to ping the server i get either time outs or Destination host unreachable.

What is wrong? Do I have to talk to my ISP or set up extra routing in my OpenBSD router/firewall?

wastedtime · 01-27-2006, 12:47 AM

I don't know how much help I'll be with this but doesn't the "ISP gateway" have to know that it's netmask is /30, so if it is set to 28, superneting of that IP range would not be possible. Other then that just make sure proper routing is done(if needed as I don't know all of your topology).

rjel · 01-27-2006, 01:20 AM

Yes, I understand that, but can it be solved in some way?
I can't have the same net on both the external interface and dmz or?

One way to solve it is to use aliases on the external net eg add 62.95.3.122
and then NAT the dmz and use redirecting on the external interface, but im not sure how that will work when trying to access the dmz:a from the network where my workstations are.

wastedtime · 01-27-2006, 01:55 AM

You can see if your ISP will work with you. Other then that depending on what your hardware will let you do is set up a static nat for your server(s) on the dmz area, and nat the rest the way you want(static, dynamic, overload).

01-26-2006, 11:42 PM	#1 (permalink)
rjel Registered User Join Date: Jan 2006 Posts: 2 OS: XP	Subnet Our ISP have provided us the following: net segment 62.95.3.112/28; ISP gateway 62.95.3.113. free ip 62.95.3.114-126 broadcast adress 62.95.3.127 What I want to do is to take some of the free ip-adresses and use it for a server in our DMZ. What I did is configuring our firewall/router with external interface IP: 62.95.3.114 netmask 255.255.255.252 DMZ interface IP 62.95.3.121 netmask 255.255.255.252 Server on DMZ IP 62.95.3.122 netmask 255.255.255.252 But it doesn't work when trying to ping the server i get either time outs or Destination host unreachable. What is wrong? Do I have to talk to my ISP or set up extra routing in my OpenBSD router/firewall?

01-27-2006, 12:47 AM	#2 (permalink)
wastedtime Registered User Join Date: Jan 2006 Posts: 79 OS: win2k	I don't know how much help I'll be with this but doesn't the "ISP gateway" have to know that it's netmask is /30, so if it is set to 28, superneting of that IP range would not be possible. Other then that just make sure proper routing is done(if needed as I don't know all of your topology). Last edited by wastedtime : 01-27-2006 at 12:51 AM. Reason: fixing some grammer

01-27-2006, 01:20 AM	#3 (permalink)
rjel Registered User Join Date: Jan 2006 Posts: 2 OS: XP	Yes, I understand that, but can it be solved in some way? I can't have the same net on both the external interface and dmz or? One way to solve it is to use aliases on the external net eg add 62.95.3.122 and then NAT the dmz and use redirecting on the external interface, but im not sure how that will work when trying to access the dmz:a from the network where my workstations are.

01-27-2006, 01:55 AM	#4 (permalink)
wastedtime Registered User Join Date: Jan 2006 Posts: 79 OS: win2k	You can see if your ISP will work with you. Other then that depending on what your hardware will let you do is set up a static nat for your server(s) on the dmz area, and nat the rest the way you want(static, dynamic, overload).