IP addessing of external interface

If the external side is the internet, you'll simply end up with not globally routeable packets, and even when providing a wrong but routeable address your ISP would filter it out either.

man IP-based loadbalancing

You won't have Internet. Packets with private IP addresses MUST NOT be routed over public networks.

I'd suggest to get a second router and have either connected to one ISP.

[...]

Back to the drawing board.

cu

59cobalt

I see all of your points. As a basic rule, the private addresses are not routed. However, my firewall is going to do NAT to set the source address of the outgoing packets to a public IP, which is routable on the Internet. So, I still do not see the why it fails when I use private IP addressing between my firewall's external interface and ISP's routers's interface facing to my firewall!

Thanks!

Ansgar -59cobalt- Wiechers wrote:

Ah, finally a clearer description of what you mean. Still it's lacking details.

I guess the following diagram and question summarizes my question (please forget about two separate ISP connections mentioned in my original message):

Internal LAN | ----- | (F1) Firewall (F2) | ----- | (R1) Router (R2)|

------> Internet

Internal IP space 192.168.10.x/24 F1 - Firewall's internal interface: 192.168.10.1 F2 - Firewall's external interface: ? R1 - Router's internal interface: ? R2 - Router's external interface, which I am not interested in Firewall: Checkpoint express, doing NAT (both hide and static NAT). It maps Internal LAN to a block of ISP assigned public IP addresses.

Question: If I were to use a private IP subnet (let's say

192.168.11.0/24) for the network between Firewall and the Router, namely for the F2 and R1 interfaces, what would happen? Am I going to use Internet connection for incoming or outgoing or both? Any reasoning for your comment?

Thanks!

Sebastian Gottschalk wrote:

It would work the same way as before assuming that the router is properly configured to do the NAT magic as well.

In any case I wonder what the router is actually supposed to do there if it's only forwarding anyway...

I'm still thinking about why you're asking that...

You would need an extra NAT router.

Yours, VB.

If your provider supports that: fine. If not, his router won't send any packets to your router, thus devoiding you of Internet connectivity.

Even if your ISP were to support private IPs (which would be okay if his network is not public) *his* router would have to do the NATing, in which case you wouldn't need a public address at all.

What are you trying to achieve anyway? (besides shooting yourself in the foot I mean)

cu

59cobalt

Media or link-layer conversion?

It is an SDSL router, which connects us to our ISP.

Walter Robers> >

friend,

But u have to define a stastaic path for it,,,,,,,,, try it,,,,