Two IP addresses, two routers

[mikeprism]

Hello everyone,

I've got ESXi 4.1 U1 (I believe) installed with Windows SBS 2011 on one virtual machine and Debian 6 installed on another virtual machine. My server has two gigabit ethernet ports.

Both SBS 2011 and Debian 6 will be serving webpages on port 80, so they both need there own IP addresses.. not a problem I have a couple IP addresses to use. I know the easiest and probably best way is to get a layered 3 switch that I can setup a couple vlans on, but I'm using the equipment I already have.

This is how it looks right now

Modem---> Small gigabit switch------> router 1 wan port set to one public ip address

                                               |

                                                ---> router 2 wan port to one other public ip address

I am currently only using one router, but I think I would need both to do get two public IP addresses without a dual WAN switch or router of some sort.

My main question is, how would I get my two guest OS's to be connected to their own public IP addresses? Would I just plug each router into an ethernet port on my server and then set the appropriate gateways in each guest?

I guess I maybe am over-complicating things.

Any ideas are welcome!

Thanks, Mike

[DSTAVERT]

You need to add the addresses from within the OS just like you would do with a physical machine.

If you can use multi NAT on the router both addresses would be on the WAN side of the router and would forward to the internal non routeable IPs on the VMs.

[mikeprism]

You need to add the addresses from within the OS just like you would do with a physical machine.

Oh so you mean my public IP address, say xx.76.86.96, would be set as the main IP address of the guest OS? That doesn't seem right to me did you mean something else?

[DSTAVERT]

http://www.vmware.com/technical-resources/virtual-networking/

[mikeprism]

Also, maybe let me go back a bit and re-think this all. I've been doign a lot of google researching so I'm getting a little confused about some things.

I have one business modem that has one ethernet port on it. I have a few static public IP addresses from my ISP. I also have two ethernet ports on my server. I have Windows SBS 2011 domain controller and Windows server 2008 which is a "terminal server" to my SBS 2011 installed as virtual machines on ESXi. Those combined can use one public IP address. But the debian 6 virtual machine needs it's own public IP address as it is going to act as a web server, and port 80 is already being used with SBS 2011 among other ports as well.

So, what would any one else do to solve this problem? Get a switch capable of creating VLANs?

[J1mbo]

Is it specifically the web serving that is causing the issue?  In that case adding a reverse proxy would resolve the issue:

http://blog.peacon.co.uk/reverse-proxy-get-more-from-your-ip-and-bandwidth/

If you want to split the load between links then just set the default gateways differently in each VM, i.e.

external IP1 -> DSL router 1 -> internal network interface say 192.168.1.1

external IP2 -> DSL router 2 -> internal network infertace say 192.168.1.2

Then the VMs:

VM1, to route through external IP1, would use 192.168.1.1 as its default gateway

VM2, to route through external IP2, would use 192.168.1.2 as its default gateway

HTH

[mikeprism]

I am not trying to achieve load balancing, I just want my windows  servers and my debian server both behind a router (for the firewall,  etc) but the windows servers need to have one static public ip address  and my debian server needs another static public ip address.

external IP1 -> DSL router 1 -> internal network interface say 192.168.1.1

external IP2 -> DSL router 2 -> internal network infertace say 192.168.1.2

However, I do have a question about your reply that I think might help me with this diagram you showed. So I've got these 2 "DSL routers," what do I do with them? Connect one router to one ethernet port on my host and the other router to the other ethernet port and that's it?

Thanks!

[J1mbo]

I was assuming that the external Internet connection comes in to some kind of routers provided by your ISP(s) like home-spec DSL routers.  In my example, everything internally is on one subnet (192.168.1.0/24, in my example) and firewall NAT rules on the routers would provide traffic forwarding accordingly.

IF that is the way that you want to run it then it doesn't actually matter what is plugged in where.  If these routers were simple "home spec" routers as I had assumed, with integrated 4-port switch then connect them both together and into ONE ethernet port on your ESX host.  Attach both VMs to one vSwitch, and you're pretty much done.

So:

ISP1 -> router 1 WAN port

ISP2 -> router 2 WAN port

Then internally,

router 1 LAN port 1 -> router 2 LAN port 1

router 2 LAN port 2 -> ESX NIC

For IP addressing,

router 1 internal address 192.168.1.1

router 2 internal address 192.168.1.2

(ESX management interface could be 192.168.1.3)

VM1 192.168.1.10 gateway 192.168.1.1

VM2 192.168.1.11 gateway 192.168.1.2

And for firewall rules, add port forwarding and access control rules to router one, for VM1, and to router 2, for VM2.

Hope that helps!

[mikeprism]

Thank you J1mbo, that was very helpful and will get me started.

However, does it change things up that I do not have 2 ISPs? What I have is a T1 connection that comes in internetally to a Cisco IAD2400. I believe our phone system is then hooked up to the Cisco box. There is also an ethernet port on the cisco that provides our internet use with a few IP addresses. Anyway, does that change anything?

Thanks

[J1mbo]

Ah, okay well that makes it all very much easier.

Your ISP will be sending anything for any of your public IPs to the firewall.  And that is hooked up to the internal network, along with one or both of the Ethernet interfaces of the ESX host.  Use a single vSwitch and add both adapters if you like.

Then all VMs would use the same default gateway (the firewall's internal IP) but of course have distinct IP addresses on the subnet, and all that needs to be done then is to create multiple NAT rules on the firewall, so that traffic destined for the external IP address specified in the rule is forwarded to the internal address of the SBS server.  And similarly for the Debian box (but with one of the other external IPs).

Sorry to have confused matters with the prior posts!

Cheers

[DSTAVERT]

This is often called Muliti NAT. It does require that the router support it. I assume that since the ISP is providing the equipment and the addresses that it does support it. You may need to get help from your ISP to configure it but it involves forwarding traffic destined to one of the IPs to the internal IP address of the Windows machine and the other address to the Debian machine. If it is strictly web traffic you may probably to limit the forwarding to port 80 and 443.

[DSTAVERT]

Just saw Cisco. In Cisco speak this is called Static NAT.

[mikeprism]

Then all VMs would use the same default gateway (the firewall's internal  IP) but of course have distinct IP addresses on the subnet, and all  that needs to be done then is to create multiple NAT rules on the  firewall, so that traffic destined for the external IP address specified  in the rule is forwarded to the internal address of the SBS server.

By firewall are referring to a router? (the Cisco router or a "home-spec" router of my own?) Is this like port forwarding, except you can choose which incoming public IP address it would be coming from?

Btw I do not know much about the cisco box I think the only way to edit it's configuration is to use a console port that is on it and even at that I do not know if it has a web based interface or what. I have read from google somewhere that someone things it is basically a router set up for dhcp.

[DSTAVERT]

What is the router you are using? It must support the ability to assign multiple IP address to the WAN interface and allow port forwarding to use those multiple addresses. Different routers may use different mechanisms and different terminology to allow this.

[mikeprism]

I just have two basic gigabit home use combo router/switches. One is a Cisco linksys E3200 and the other is a netgear WPN824V3. Do you have any cheap recommendations for a router that supports multiple wan? That is why I was using two routers hooked up to a switch that was hooked up to the internet connection, to achieve the 2 wans.

[DSTAVERT]

I haven't had a need for one in a while so my direct experience with smaller home devices wouldn't be relevant. I made most of my routers or changed the firmware on store bought routers. If I build today I use http://pfsense.org software which does support mulitple WAN IPs. Netgear does have a couple of router/firewall devices that support multi-nat ftp://downloads.netgear.com/files/Multi-NAT1_JR.pdf You can use multi-nat as a search and should turn up some others. Read the netgear doc to get an idea of how it is used.