What's the use of "Sharing a public IP address" vs "Distributing a range?

Question

Level 1

1 points

What's the use of "Sharing a public IP address" vs "Distributing a range?

Now, despite all the magnificent documentation on the AEBS and how to activate/tweak its various settings, there is one basic thing that I cannot figure out. It concerns the three available options for "Connection sharing". "Bridge" is clear enough, but why would one want to use the option of "Sharing a public IP address" vs "Distributing a range of IP addresses"? What are the uses of the two different options? As far as I understand the documentation, "Sharing a public IP address" activates DHCP and NAT, whereas "Distributing a range of IP addresses" activates only DHCP - but why would one want to deactivate NAT?

Macbook Pro 2.16 Ghz, Mac OS X (10.5.7)

Posted on Jun 8, 2009 7:29 AM

Reply

Answer 1

Tesserax

Level 10

158,202 points

Jun 8, 2009 11:18 AM in response to Gijs Kessler

Now, despite all the magnificent documentation on the AEBS and how to activate/tweak its various settings, there is one basic thing that I cannot figure out. It concerns the three available options for "Connection sharing". "Bridge" is clear enough, but why would one want to use the option of "Sharing a public IP address" vs "Distributing a range of IP addresses"?

To best understand these options, you just need to understand what they basically do to the AirPort's configuration.

o Share a public IP address = NAT & DHCP services enabled
o Distribute a range of IP addresses = NAT disabled; DHCP enabled
o Off (Bridge Mode) = Both NAT & DHCP

What are the uses of the two different options?

The first option is the one most typically used when both the AirPort is the primary router connected to the Internet service AND the ISP is providing a single dynamic or static IP address.

The second option is typically used when your ISP provides you with a number of static IP addresses that you want the AirPort DHCP service to distribute to your local network clients. Since NAT is not provided, all of these local network clients would have public IP addresses and fully exposed to the Internet.

The last option is used when there is another router/gateway/etc. in the network upstream of the AirPort and you want the AirPort to "pass through" that upstream router's NAT & DHCP services.

Reply

Answer 2

Gijs Kessler Author

Level 1

1 points

Jun 8, 2009 11:55 AM in response to Tesserax

Thanks, this is really making up for the lack of such systematic information in all the documentation available for the AEBS.

Let me explain my situation: ISP provides, though Ethernet connection, three public IP addresses which are allocated to my three Macs (through a switch) on the basis of their MAC addresses. So far this was all a wired network. Now, I bought a AEBS to replace the switch in order to have the following additional functionality:

- WiFi
- A way to shield my local network from the larger network of the ISP so as to be able to add a network storage disk and a shared printer without all the people on the ISP-wide network having access to them.
- Additionally, I would like to be able to remotely access one of my Macs through FTP, which in the old set-up did not function, probably because the router on the ISP-network was not set up accordingly.

Now, so far I have been able to set-up the AEBS only in two ways:

1) as a bridge, in which case it merely functions as the old switch I had, with Internet access restricted to the three machines whose MAC-addresses are registered with the ISP. This defies the whole point of the exercise.

2) Registering the AEBS Ethernet MAC address with the ISP, allocating it to one of the public IP addresses provided and sharing this address to the other computers on my network, using DHCP and NAT. This works, but how to set up FTP access in this case, now that the iMac concerned has "lost" its public IP address?

I tried to use the third option, of having AEBS distribute my range of IP addresses, but could not get it working. Probably, though, it is of little use to me, because it would not shield my home network from the wider ISP-network, isn't it?

Reply

Answer 3

Tesserax

Level 10

158,202 points

Jun 8, 2009 1:10 PM in response to Gijs Kessler

Thanks for the additional details!

A way to shield my local network from the larger network of the ISP so as to be able to add a network storage disk and a shared printer without all the people on the ISP-wide network having access to them.

In order to do this, the AirPort (or any router) would have to have NAT enabled. As mentioned before, only the "Share a public IP address" provides this option. As you already found out the other two options won't work for your particular networking requirements.

Since network isolation is a priority requirement, I suggest that you configure the AEBS with the "Share a public IP address" option, and then, configure its port mapping (port forwarding) feature to allow communication to hosts on the local network.

The following would be the basic steps to configure a host FTP server, using port mapping:

To setup port mapping on the AEBS, either connect to the AEBS's wireless network or temporarily connect directly, using an Ethernet cable, to one of the LAN port of the AEBS, and then use the AirPort Utility, in Manual Setup, to make these settings:

1. Reserve a DHCP-provided IP address for the FTP server.
Internet > DHCP tab
o On the DHCP tab, click the "+" (Add) button to enter DHCP Reservations.
o Description: <enter the desired description of the host device>
o Reserve address by: MAC Address
o Click Continue.
o MAC Address: <enter the MAC (what Apple calls Ethernet ID if you are using wired or AirPort ID if wireless) hardware address of the host computer>
o IPv4 Address: <enter the desired IP address>
o Click Done.

2. Setup Port Mapping on the AEBS.
Advanced > Port Mapping tab
o Click the "+" (Add) button
o Service: FTP Access (Note: The correct port (21) will be populated for the Public & Private TCP ports. You are free to change these as required.)
o Private IP Address: <enter the reserved DHCP IP address created from above>
o Click "Continue"

Reply

Answer 4

Gijs Kessler Author

Level 1

1 points

Jun 8, 2009 1:21 PM in response to Tesserax

Thanks a lot for this! I feel I am getting at the gist of things now - I can follow the logic of your instructions. Two more questions:

o Service: FTP Access (Note: The correct port (21) will be populated for the Public & Private TCP ports. You are free to change these as required.)
o Private IP Address: <enter the reserved DHCP IP address created from above>
o Click "Continue"

1) What are the Public & Private TCP ports, and should I change them?
2) At what address will people from outside be able to reach the FTP server? The public IP allocated to the AEBS?

Reply

Answer 5

Tesserax

Level 10

158,202 points

Jun 8, 2009 2:47 PM in response to Gijs Kessler

1) What are the Public & Private TCP ports, and should I change them?

The "Public" or WAN-side is "seen" from the Internet; the "Private" or LAN-side is "seen" from your local network behind the NAT firewall. You would want to change them only if your network requirements mandate using something other than the "standard" ports for these services, otherwise, I suggest using the recommended ports.

2) At what address will people from outside be able to reach the FTP server? The public IP allocated to the AEBS?

Yes. In turn, any FTP requests coming from the Internet, will be port mapped to the private FTP server on your local network. Only these ports would be "open" to the Internet instead of all of them when a local device was configured with a public IP address. You can still employ additional safety measures by using either OS X or Windows (as appropriate) software firewalls on the individual hosts.

Reply

Answer 6

Gijs Kessler Author

Level 1

1 points

Jun 9, 2009 2:32 AM in response to Tesserax

Thank you so much. I guess I will manage now configuring this set-up. Exactly ho safe is it to open up a computer on your network for FTP access?

Yes. In turn, any FTP requests coming from the Internet, will be port mapped to the private FTP server on your local network. Only these ports would be "open" to the Internet instead of all of them when a local device was configured with a public IP address. You can still employ additional safety measures by using either OS X or Windows (as appropriate) software firewalls on the individual hosts.

And, just for the record - what is the use of creating a default host in your network, i.e. having all internet traffic initially routed to one machine? As far as I understand this means it fully exposes the machine to the outside world, i.e. effectively eliminates the NAT firewall for that machine, so what are the benefits?

Thanks again for your help. Much appreciated!!!

Reply

Answer 7

Tesserax

Level 10

158,202 points

Jun 9, 2009 8:08 AM in response to Gijs Kessler

Exactly ho safe is it to open up a computer on your network for FTP access?

Much safer compared to having the computer configured with a public IP address, but there are always risks involved with exposing a computer to the Internet. Firewalls (hardware & software), anti-virus & intrusion detection programs are just a part of modern life.

And, just for the record - what is the use of creating a default host in your network, i.e. having all internet traffic initially routed to one machine? As far as I understand this means it fully exposes the machine to the outside world, i.e. effectively eliminates the NAT firewall for that machine, so what are the benefits?

Typically, but not limited to, placing a computer in a DMZ (what Apple calls a Default Host) is desired when you want unrestricted access to this device from the Internet. An example would be a server hosting on-line multiplayer gaming.

Reply

Answer 8

Gijs Kessler Author

Level 1

1 points

Jun 9, 2009 8:17 AM in response to Tesserax

Aha, I see. Would that also be the preferred setting for a Mac which has personal web sharing enabled, or only in case you intend to do real serious web-hosting?

Typically, but not limited to, placing a computer in a DMZ (what Apple calls a Default Host) is desired when you want unrestricted access to this device from the Internet. An example would be a server hosting on-line multiplayer gaming.

Reply