External (Real ISP Static) IP and Internal (Private local) IP setup

[ChillyTwoface]

Hello everyone,

At work, the network is currently set up as follows:

Router 1: ISP provided us with a static IP and it is set up on that router.

Router 2: a different line providing internet access but has no static IP.

Load Balancer: Takes router 1 and router 2 and merges them into one network

Router 3: takes the above-mentioned network and creates a wireless network that we all mainly use and our server computers are connected to it with LAN cables for internal office use.



--------------------------------------------------------------------------------------------------------------------------------------------



We are trying to make a Windows Server 2012 Datacenter virtual machine (hosting an enterprise application) on one of the servers have both the REAL STATIC IP (so that it's accessible for us to work from home and also for customers to access the application with the real IP), and also the PRIVATE local LAN IP to be working simultaneously.



The Server Computer is running ESXi and has virtual machines on it (one of which mentioned above). This server has 4 Ethernet ports (NICs).



--------------------------------------------------------------------------------------------------------------------------------------------



What I tried:

Going into VMware Vcenter to manage my virtual machine, adding a new (2nd) network adapter, and giving this 2nd adapter the REAL STATIC IP.



It doesn't work.

Either the private local IP works (if set up on the first NIC) or the REAL STATIC IP works (if set up on the first NIC) But not both at the same time.



I'm not a networking expert so I'm coming to you guys for input.

Please let me know.

Thank you

Edit: Here's a diagram

 

[beers]

That sounds extremely kludgey.

If you only have one 'real static IP' then it would have to reside on the same broadcast domain as the ISP. Otherwise you would need to assign it to the router and then port forward, which would forward any requests that arrive on static IP for certain ports toward the private IP on the ESXi server.

 

[ChillyTwoface]

That sounds extremely kludgey.

If you only have one 'real static IP' then it would have to reside on the same broadcast domain as the ISP. Otherwise you would need to assign it to the router and then port forward, which would forward any requests that arrive on static IP for certain ports toward the private IP on the ESXi server.

Yeah, kludgey sounds about right. It's a small company that I recently joined and I don't know who had this set up.

My task is to now make the web-app which resides on a VM inside one of our servers to be accessible online with a real IP. Someone elsewhere recommended I use NAT. Would they be wrong then? Only way to do this right now is to port forward?

 

[beers]

Port forwarding is a type of NAT. It really just depends on what your ISP can give you. If they can route you additional IPs, then you can route or 1:1 NAT those to internal addresses. If it's just the router interface IP they give you then you're somewhat forced to port forward if you wanted to use that address.

I'd also make sure anything directly internet facing is in a segregated dmz zone that can't initiate connections to the internal piece of the network.

 

[ChillyTwoface]

Port forwarding is a type of NAT. It really just depends on what your ISP can give you. If they can route you additional IPs, then you can route or 1:1 NAT those to internal addresses. If it's just the router interface IP they give you then you're somewhat forced to port forward if you wanted to use that address.

I'd also make sure anything directly internet facing is in a segregated dmz zone that can't initiate connections to the internal piece of the network.

I'm sure the ISP can give me more IPs but I don't think my company even wants that. They'll probably just want to stick to the one. The IP they gave me is set up on the router now yes. So I'll look into port forwarding to make it work for our needs I guess. Any links to useful port-forwarding guides for my specific scenario? I'll take a look around too.

I'll also look into firewalls and dmz to make sure it's not vulnerable. Thank you!