Kathleen FitzpatrickAug 10, 2025
I have been fighting with the process of setting up a server on my home network for what is now literally months. (I keep having to walk away from the project because of that whole “day job” thing, plus travel and so forth.) If anyone has advice to offer, it would not be unsolicited! https://kfitz.info/networking-continued/ #homelab #dns #proxmox #nginx
Networking Continued

The long-running and erratically updated blog of Kathleen Fitzpatrick.

Show threadDrScriptt

@kfitz I saw your #dns tag last night and have read your Networking Continued post. I want to read more of your blog for history, but I figured I'd throw this out there:

I have a BGW320(-505) from AT&T and I have public access working to things in my network without any problem.

I'm on a residential account with an 8-block of globally routed IPs. No business account required.

I find the BGW320 to be annoying to work with and occasionally feel like "what am I going to break now?". Take screen shots. You should always be able to reset it and get back to what you have now. It's annoying to recover from, but definitely possible to do.

Firewall - Status:
- Packet Filter: Off
- IP Passthrough: On
- NAT Default Server: Off
- Firewall Advanced: On (I've not found how to turn it off.)

Firewall - Packet Filter:
- No Filter Rules...

Firewall - NAT/Gaming:
- Nothing configured

Firewall - Public Subnet Hosts:
- (nothing, no public subnet defined)

Firewall - IP Passthrough:
- Allocation Mode: Passthrough
- Default Server Internal Address: Private IP on the LAN inside of the BGW320
- Passthrough Mode: Manual
- Passthrough Fixed MAC Address: MAC address of device with the private IP
- Passthrough DHCP Lease: 0:0:10:0

Firewall - Firewall Advanced:
- Drop incoming ICMP Echo requests to LAN: Off
- Drop incoming ICMP Echo requests to Device LAN Address: Off
- Drop incoming ICMP Echo requests to Device WAN Address: Off
- Reflexive ACL: Off
- ESP ALG: Off
- SIP ALG

Firewall - Security Options:
- Parental Controls Status: Disabled

Home Network - Subnets & DHCP:
- Device IPv4 Address: private IP I chose
- Subnet Mask: 255.255.255.0
- DHCP Server Enable: On
- DHCPv4 Start Address: private IP I chose to start at
- DHCPv4 End Address: private IP I chose to end at
- DHCP Lease: 0:8:0:0
- Public Subnet Mode: Off
- Allow Inbound Traffic: Off
- Public Gateway Address: (blank)
- Public Subnet Mask: (blank)
- DHCPv4 Start Address: (blank)
- DHCPv4 End Address: (blank)
- Primary DHCP Pool: Public
*** Cascade Router Enable: On
*** Cascade Router Address: 0.0.0.0
*** Network Address: Network (0th) address of my 8-block of globally routed IPs
*** Subnet Mask: 255.255.255.248

What this does is to cause the BGW320 to *route* IPs to the globally routed 8-block to my internal router connected to the BGW320 via a cross over cable using a private subnet between them. -- My personally provided router than actually has the WAN IP and an IP from the private subnet bound to it's outside interface. -- I can then do whatever I want to because MY ROUTER HAS FULL CONTROL AND RESPONSIBILITY FOR THE 8-BLOCK OF GLOBALLY ROUTED IPS. (emphasis, not yelling)

My firewall is the security entry point to my network, not the BGW320.

I view the BGW320 as upstream ISP equipment and mostly ignore it. I do all of my filtering on my router behind the BGW320.

I have actually manged to have fun with all 9 of the globally routed IPs from AT&T. Yes, nine, the number between eight and ten. The full 8-block plus the globally routed IP that AT&T sends traffic to. }:-) How I do that will be a future message

Aug 13, 2025 at 2:05amWeb
Show threadDrScripttAug 13, 2025

@kfitz Also, MORE POWER TO YOU (yes yelling this time)

#hazFun #learnNewThings 😄

Show threadDrScripttAug 13, 2025

@kfitz (reading your Networking post.

- Kudos for turning of the WiFi in the BGW320.

- It's possible to use all eight of the IPs in the 8-block if you're willing to think outside of the box. (I promise I'll share more later.)

- I'm not familiar with the Eero. So I cna't speak to how to do anything on it. (I use a stock / generic Linux system as my router.)

- Assigning a static globally routed IP t the NAS probably removes it from the private network behind the Eero. I'd bet that any connections to it will eventually stop working some time in next double digit minutes to single digit days.

- I think that putting the Eero in bridge mode and letting the BGW320 handle things will leave you with a similar but different problem. Different subnet on different devices. You just move the boundary from the Eero where (I assume) you have full control over to the BGW320 where you have less control.

- The public vs private subnet is probably and the routing between them is the problem I was alluding to in the last bullet point.

- Pausing, thinking, and trying is good. Like I mentioned in previous post, take screen shots of things. You should be able to factory reset and get back to where you were when you tried something. Definitely annoying, but not project ending must call tech support territory.

Show threadDrScripttAug 13, 2025

@kfitz Here's a brief description of how I'm using all eight IPs of the 8-block.

But I did say 9 IPs.

Since the WAN IP is on my Linux router, I can re-use / abuse that IP as a NATed / MASQUERADEd IP for low value traffic.

I can also do port forwarding on my Linux router.

}:-)

It helps if I include the link: https://oldbytes.space/@drscriptt/115019087279023743

DrScriptt (@[email protected])

Here's how I use all eight (8) globally routed IPs that are in the 8-block from my ISP. No more network / broadcast / gateway taking my IP addresses!!! No, I'm not BSing you, hear me out. How? Don't use the /29 (for the 8-block). Use something larger that gives you space on both sides. -- I just use the /24. I configure my 192.0.2.17 IP address as a /24 on my server. My gateway is anything I want inside of the larger /24 that is outside of the /29. This means that I can configure 8 devices with the globally routed IPs. The gateway address is outside of the original /29, so it's not taking up a valuable IP. The systems with the valuable /29 are configured with the /24 so they can get to the gateway anywhere in the /24. The gateway routes the IPs to the upstream router and out to the Internet. Things on the Internet come in from the upstream, via my router and go to any of the 8 globally routed IPs. It works. Well. I've not had any problems.

OldBytes Space - Mastodon