Very Computer

by **Andrew Paxto** » Sun, 12 Nov 2000 04:00:00

Currently, I have a server (redhat linux box) connected to a Cisco 1600
router. The server has a multiple rs232card with 6 terminals attached.
What I want to do is to to dump the terminals and replace them with PCs. As
the cisco has NAT capability, it occurs to me that I can connect everything
through a hub and assign private IP (eg 10.0.0.x) addresses to the PCs so
that they can access the internet.
The problem is that the server has a valid non-private IP address (I mustn't
change that), but the pcs need to talk to it. Can I assign a second
(private) IP address to the its ethernet interface? Would all the macine on
the local lan be able to talk to each other and access the internet, and
would the server be accessible from the outside using its non-private
address? Any alternative suggestions?
Any help appreciated.
AndyP

by **David K. Mean** » Mon, 13 Nov 2000 04:00:00

Quote:> Currently, I have a server (redhat linux box) connected to a Cisco 1600
> router. The server has a multiple rs232card with 6 terminals attached.
> What I want to do is to to dump the terminals and replace them with PCs.
As
> the cisco has NAT capability, it occurs to me that I can connect
everything
> through a hub and assign private IP (eg 10.0.0.x) addresses to the PCs so
> that they can access the internet.
> The problem is that the server has a valid non-private IP address (I
mustn't
> change that), but the pcs need to talk to it. Can I assign a second
> (private) IP address to the its ethernet interface? Would all the macine
on
> the local lan be able to talk to each other and access the internet, and
> would the server be accessible from the outside using its non-private
> address? Any alternative suggestions?

While the Cisco 1600 does have a NAT facility built into it, you are
probably better off doing the NAT (aka masquerading) on the server, or on
a second machine connected to the network segment inhabited by the router
and the server.
The reason is that you not only would need to make NAT work, but you would
also have to overlay the *real* IP subnet on the same physical segment in
the
scheme you suggested; at the expense of an extra ethernet card in your
server,
you could keep your current setup, get masquerading and firewalling
capabilities,
and have a less complex setup to debug.
This alternate scenario is described pretty fully at
http://www.digitalelephant.org/computing/fire/firewall.html

Very Computer

NATing

NATing

NATing