I just got AT&T U-verse, which delivers Internet, TV (IPTV), and phone (VOIP) service to the home; all this over one pair of copper from the VRAD. My upgrades to the service include HD TV, DVR, and a static IP block for my personal servers. This article sheds some light on some peculiarities about how the 2Wire 3800HGV-B (“Residential Gateway”) they provided behaves when a public/static IP block is involved.
What made this setup interesting to me (from a networking perspective) was that it forced me to compromise on keeping my private network separate from my public network…
This first diagram, below, represents how I would typically set up small network with public IPs.
Just as most people do, I have my workstations behind a typical residential gateway (viz., a “wireless router”). What’s just a bit atypical is that I have two servers that each have two network interfaces and participate in both the Internet and intranet networks.
Because all devices that participate in both networks are smart enough (operate on the third network layer or above) a packet never makes it from one network to the other unless it needs to, which is pretty much only when a workstation is communicating with the Internet (through the residential gateway).
Thus, the Internet subnetwork and intranet subnetwork are on different broadcast domains. Anything broadcast onto the intranet (whether by a workstation or server), such as an ARP request, will only be heard by the other devices on the intranet.
Two Networks on One LAN
Things got a bit more complicated when I got AT&T’s U-verse. The key difference that this Residential Gateway introduced is that it joined my two networks into one broadcast domain. This is because the Gateway’s internal network interface has an intranet IP address, 10.0.0.1/24, so that it can send IPTV to the private network TV set-top-boxes that are hooked up via Ethernet, and the Gateway is routing the public IP addresses (“a.b.c.x”) for the servers, so the Gateway’s internal network interface also has an IP address of a.b.c.7.
So, my 3800HGV-B Gateway is participating on both networks on one interface (technically, on two ports of its built-in layer-2 switch). Now, all devices, whether public or private, are able to communicate with each other. They usually ignore each other, but they will all hear broadcasts from any device. For example, if Workstation1 sends out a broadcast packet (such as an ARP request), it will reach the Linux server on both its Internet and intranet interfaces (because switches, including the Gateway’s built-in switch, will propagate it out to all attached networks. This is not usually a problem, except that the Linux server was confusing the Gateway.
Network summary for the overly curious
(actual IPs partially masked)
- AT&T U-verse’s local router (my Gateway’s gateway) is: 99.27.aa.bb
- My Gateway’s external interface IP is: 99.27.aa.cc (intranet devices NAT’d traffic appears to come from this IP)
- My Gateway’s internal interface IP for intranet: 10.0.0.1 (workstation and other devices have this as their default gateway)
- My Gateway’s internal interface IP for Internet servers: 99.65.dd.ee (servers with public/static IPs have this as their default gateway)
- Server IPs look like: 99.65.dd.ff/29
- workstation and other device IPs look like 10.0.0.gg/24