YesSo, would I set up my WAN port with 220.127.116.11 and then a 'default route' with 0.0.0.0/0 and the Gateway address as 18.104.22.168?
YesThen, would I set one of the 198.7.8.x addresses (such as 22.214.171.124) as the LAN IP address on my router (which would then be the Gateway IP address in the 'devices' on the network?
No, you would change the IP of the device(s) on the network that you want to have public IPs to 198.7.8.x addresses. So they would have 198.7.8.x addresses and would no longer have private IP addresses.And then would I set up routes from my router to each 'device' on the network, to route the public IP addresses to these 'devices'?
Not "each device", but one route for the subnet, yes. However, since you are adding an IP on that subnet onto your router, your router will automatically have a "connected" route to that subnet, so you do not need to add anything. Your provider will have to add a route for that subnet, but I'm assuming they have already done that since they told you what IP to assign to the WAN port of your router.Would I still have to have routes to reach each device from the 'outside world'?
That depends - keep in mind that if you have a router there are probably networks on both sides, so if this is shown for the client router, your diagram would actually look like this:Ok. Now let's expand this a bit.
If the 'device' is another route that's on the other side of another router, like this:
Edge Router --> Router 1 --> Client Router
Then, I would need a route (static or use something like OSPF) in the Edge Router, to route a public IP to the Client Router, since the Client Router is not directly connected to the Edge Router. Is that correct?
Yes, what you say is correct, and that would allow the client router itself to get online, but only the client router itself - any devices behind the client router would not get connectivity because they would be on a network that the other devices do not have routes for.The Edge Router needs a route in place to get incoming traffic to the Client Router, because there's another Router (Router 1) between the Edge Router and the Client Router. Correct?
The Edge Router already knows how to reach Router 1, because they're directly connected (so the route is automatically set up). Correct?
And Router 1 already knows how to connect to the Client Router, because they're directly connected (so the route is automatically set up). Correct?
..These IP addresses will definitely not be 'going to waste'. This is a network for a new WISP network, not a private network.
Yes, obviously, but that direction can be taken care of with default routes in this simple scenario.mducharme, I think I understand what you're saying. I think this again goes back to my background in communications. I'm definitely going to have to 'reshape' my thinking.
And there's obviously going to have to be routes in the Client Router to reach the internet, correct?
YesFrom Site Router 1, I can ping the Client Router. If I understand correctly, this is because there is a route automatically set up in Site Router 1, since the Client Router is directly connected to Site Router 1. Is this correct?
Most likely you are missing the return path in routing. Either you need routes to the specific networks going back in the other direction, or the default gateways need to be set up to carry the traffic in a chain (Client router will have the site router as a default gateway, site router will have the edge router as a default gateway).But I still can't ping 10.1.1.1 from the Edge Router.
What am I doing wrong?
You mean 0.0.0.0/0 don't you? it shouldn't be 0.0.0.0/24. That might be your issue.They are set up as a chain.
Client Router has 0.0.0.0/24 with Gateway as 10.1.1.254 (which is one of the LAN IP addresses on the Site Router).
Site Router has 0.0.0.0/24 with Gateway as 10.0.247.254 (which is one of the LAN IP addresses on the Edge Router).
Client routers have internet access just fine, so I know that the outbound routes are working.
Add two firewall rules to allow all ICMP on input and forward chains and move them to the top of the list on all three routers, then try the ping again.I've typed /24 too many times. Yes, it's 0.0.0.0/0 on all routers.
Yes, exactly. Also as an ISP it makes sense to allow most (if not all) ICMP - it makes troubleshooting much easier.So, other 'regular' traffic should pass then, correct? Unless it's specifically blocked in the firewall of one of the routers. Correct?
You don't configure edge router with the addresses, you only configure it with routes.But, how do I set up the Edge Router with these public IP addresses? Do I put this entire range in the router, with the interface set to the WAN port (for example, Eth1)?
I assume you are trying trying to use the IPs on that 126.96.36.199/29 subnet to assign to various client routers on their WAN ports (one for each)?I think I've got it! That actually sounds pretty simple.
So I just need to set up incoming routes to get traffic to the correct Client Router/Network.
It is highly unusual to do port blocking (except for certain often abused ports) for public IP addresses that are directly assigned to customer routers. Especially if a customer is paying extra for a public IP (or even more for a static public IP) they would probably not expect or appreciate ports being firewalled off before it even gets to their IP. Otherwise they end up losing most of the benefits of the public IP in the first place. If you need to, firewall off NetBIOS (SMB/CIFS) ports and possibly SMTP port tcp/25, but I wouldn't do more than that, and even those may not be necessary.Even with the routes, this incoming traffic will still be going through the firewall/NAT, correct? So I might need to open ports through the firewall for each customer that is using a public IP address, depending upon what they're doing with incoming traffic, correct?
I tend to like to keep ports closed, if I don't have to have them open for a specific reason. I don't have a problem with opening ports for a client (as long as they're not abusing the service), but I like to try to stay a little bit ahead of the hackers.
Right, sorry, misread your last post. I meant 188.8.131.52/29No, the 184.108.40.206/29 range is provided by the upstream provider as a 'transport' only. The client 'block is the 220.127.116.11/29 range.
You would generally do that if you needed to split up the IP addresses across multiple site routers (i.e. having some clients at one site, some at another, etc.). If all of the clients who needed to use those addresses are on the same site router you could simply put the entire /29 on the site router on "Network 2". However, a /29 is rather small (only giving you 5 usable public IPs for clients) so you would practically only be able to split it over two sites and set up one client at each site. Therefore with a subnet of that size I would avoid having to split it up any further.Something else that others, with whom I've spoken to about this subject, had mentioned was the necessity to break the 18.104.22.168/29 block into smaller blocks to assign to each Site Router/area/network.
There are three ways you could split up the /29: you could either use it as a full /29 and put it on one site router, allowing you to connect 5 clients to that site router. Or, you could use it as a /30 and put each /30 on one site router, allowing you to connect one client on each. Or you could split it into 8 /32 networks which you could then assign to client routers wherever they go.If all I have to do is set up one route in the Edge Router and set the Client Router's WAN port to the desired public IP address, then I don't understand why I would have to break the /29 block into smaller blocks and 'pre-assign' the smaller blocks to the Site Routers/areas/networks. It looks like I can just assign public IP addresses to each client, as needed, and not have 'reserved' public IP addresses on networks where I might never actually need them.
If it is a /26, then you can do it the normal way and split that up across multiple site routers - as long as you only have a few "sites", the trade-off is not bad. The advantage is this will work with any router and is the normal way so it is less likely to confuse people. The other options are still available but as I said can be confusing or work only with MikroTik.And I made a mistake. It's 22.214.171.124/26, not /29.
Yes, that is correct, but also keep in mind that you will have to assign the first usable ip of those 6 usable ips to the site router on the interface connected to “network 2” in your diagram from before. This would be used as the default gateway ip for the client routers on the other 5 ips in the subnet.Or would this be more correct:
Edge Router route:
Destination Address: 126.96.36.199/29 Gateway Address: 10.0.247.101 where 188.8.131.52/29 sets up 6 usable IP addresses and routes those to the Network 2 (which is the first Site Router network)
Destination Address: 184.108.40.206/29 Gateway Address: 10.0.247.102 where 220.127.116.11/29 sets up 6 usable IP addresses and routes those to the Site Router 2 Network.
And so on.
Then, in each Client Router would be set with the WAN port to the desired public IP address. No routes would be needed in the Site Router, because it would be connected directly to the Client Router and the Edge Router.
Is this correct?