I have a network from an ISP consisting of eight IP addresses (/29). Let's say it's 1.1.1.0/29. The ISP's gateway is 1.1.1.1. This network should be splitted up so that it can be used by two different companies and both networks are isolated from each other. Also, both companies need external IP addresses. Using NAT is no option, unfortunately.
Can I split up this /29 network so that each of the two companies are assigned a /30 network? Or more precisely: Is it possible to have the following scenario:
- Company 1 and company 2 shall be connected to the Internet
- There is a (managable) networking switch avaliable which can have VLANs
- Company 1:
- Company 1's firewall has the IP address 1.1.1.2
- Company 1's subnet mask is 255.255.255.252
- Company 1's default gateway is 1.1.1.1
- Company 2:
- Company 2's firewall has the IP address 1.1.1.6
- Company 2's subnet mask is 255.255.255.252
- Company 2's default gateway is 1.1.1.5 (which is the VLAN interface address on the switch)
- Switch
- There are two VLANs configured on the Switch
- On VLAN 1, there's the uplink from the ISP and the firewall of company 1 connected.
- VLAN 1 has no interface address.
- On VLAN 2, there's the firewall of company 2 connected
- VLAN 2 has the interface IP address 1.1.1.5/30
- Routing table:
- 0.0.0.0/0 next-hop: 1.1.1.1 (This is the connection to the Internet)
- 1.1.1.0/30 vlan-1
- 1.1.1.4/30 vlan-2
Would such a setup work? Is it possible to split one public /29 IPv4 network into two public /30 IPv4 networks and to have the upload address located in one of the two subnets?
2 Answers
It's definitely possible, but it would be easiest if the ISP gateway was reconfigured to directly handle both VLANs as /30s. (From the technical side this should be a very simple change – at least I would expect from a business-grade router – the difficult part is getting the ISP to actually do it.)
(It would be also okay if the ISP gateway was reconfigured to route the entire /29 via your own router routing switch. Then your routerswitch could do whatever it wants with those packets.)
Finally, splitting the network without the ISP's cooperation is also technically possible. However, as long as the ISP gateway thinks that it's part of a /29 subnet, it will send out ARP queries for all addresses in that /29. And if you move half of them behind another router, something still needs to answer those ARP queries!
This means your 2nd gateway (the 1.1.1.5 routing-switch) will need to lie to the ISP's gateway – it needs to run Proxy-ARP on VLAN 1 and answer ARP queries on behalf of the entire 1.1.1.4/30.
Do not divide the subnet. Assign 1.1.1.2 and 1.1.1.3 to 1st company and 1.1.1.4 and 1.1.1.5 to 2nd company, 1.1.1.6 will be your "hot reserve".
Your router must act as transparent bridge in this case. Moreover, the router not needed, common L3-commutator is enough.
If you want to forbid inter-company access (formally this is illegal, you have no any credentials to filter internet traffic) then you may filter by according deny firewall rules on your router.
2
