multiple IP addresses over one PPPoE connection

[Alicia da Conceicao]

Greetings:

A Japanese Internet provider (OCN) has given me a block of 8 consecutive
public IP addresses, and a sDSL modem, for my high speed fiber connection
in Akihabara.

With PPPoE support in my NetBSD kernel, I have no problems configuring
pppoectl to authenticate and establish a PPPoE connection for any one
of the 8 public IP addresses, as described in the NetBSD PPPoE doc:

http://www.netbsd.org/Documentation/network/pppoe/

But how do I get my NetBSD router to route for 5 other machines on a
DMZ with the 5 other usable public IP address, over the same (single)
PPPoE link? The DMZ would be on a /29 (netmask 255.255.255.248) subnet,
with the router as the gateway for the DMZ.

The configuration I want would be something like this:

NetBSD_Router: pppoe0 with 123.123.123.249 via fxp0 (on sDSL)
fxp1 with ???.???.???.??? (on DMZ)

Server_1: fxp0 with 123.123.123.250 (on DMZ)
Server_2: fxp0 with 123.123.123.251 (on DMZ)
Server_3: fxp0 with 123.123.123.252 (on DMZ)
Server_4: fxp0 with 123.123.123.253 (on DMZ)
Server_5: fxp0 with 123.123.123.254 (on DMZ)

or if you prefer some bad ASCII art:

<--[DSL_Modem]--[NetBSD_Router]--[DMZ Switching_Hub]
| | | | |
[Server_1]--+ | | | |
| | | |
[Server_2]--+ | | |
| | |
[Server_3]--+ | |
| |
[Server_4]--+ |
|
[Server_5]--+

Could I set up a pseudo bridge interface between the pppoe0 and fxp1
(sDSL & DMZ) interfaces? Is there a better way to do this? I am
running NetBSD 3.1 (i386) on the router.

Note that all of the machines in the DMZ have public addresses, and
that no NAT is used.

Any suggestions are greatly appreciated.

Thank you in advance,
Alicia.

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Martin Husemann]

Post by Alicia da Conceicao
Could I set up a pseudo bridge interface between the pppoe0 and fxp1
(sDSL & DMZ) interfaces? Is there a better way to do this? I am
running NetBSD 3.1 (i386) on the router.

There are several ways to do that. I guess the most simple is to just use you
routers public address both on pppoe0 and fxp0, turn on ip forwarding and set
apropriate netmasks, and double check routes (especially the default route,
so it goes out of pppoe0).

I have a similar setup, where I (mostly for historical reasons combined with
administrative laziness) use NAT to do it: the internal network interface has
a 192.168.x.x number, all public servers too, and I map those internal
numbers via NAT on the router to the public address. This made filtering
rules pretty easy in my case, but I'm not sure I would choose this aproach
again for a from-scratch setup, especially if IPv6 would be involved and
NAT could be avoided (in my current setup I need NAT for other reasons
anyway).

Martin

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de