Static IPs on Airport Extreme with Hub 3

[iainH]

Today we have the Airport Extreme in Bridge Mode to avoid Double DHCP, but really we'd prefer to use the Business Hub 3 just as a modem so that the Lion Server can manage the Airport Extreme's firewall settings. This can only be done if the Airport Extreme is doing the DHCP and NAT rather than the BT Business Hub 3 doing them. 

(We are readying ourselves to switch over to Infinity soon).

I have tried every combination I can think of, but have been unable so far to get the right settings where the Airport Extreme's Router Mode is anything other than Off (ie explicitly in Bridge Mode)

Today the Airport Extreme is connected to the BT Hub 3 using a static address as follows:

The Airport's IPv4 Address is set to 81.xxx.xxx.120 (the basis of our static IP range)

Subnet Mask 255.255.255.248 (same as for Hub 3)

Router and DNS: 81.xxx.xxx.126 (same as for Hub3)

We have two servers, each with its own static WAN IP Address on the LAN (a "Split Horizon" topology?).

Other devices come and go with IP numbers  chosen from a local DHCP pool (by the BT Hub) 

The Airport Extreme won't connect to the Internet unless the BT Hub has DHCP enabled.

We also our Router's Static IP number set in the Hub 3 with the accompanying Static IP switch checked on.

People report on the Residential BT forums that they have the Airport Extreme in use with the BT Home Hub 3's DHCP disabled ... so I'm assuming that our Static IPs are complicating our case as the Home Hub 3 doesn't deal with static WAN IP numbers. This infers that their Airort Extremes are doing the LAN's DHCP.

I'd imagined that, by disabling the BT Hub's DHCP, that the Airport Extreme would contact the next computer up the chain (in BT's infrastructure); a DHCP server assigning us our (static) IP addresses?

[knobbster]

"I'd imagined that, by disabling the BT Hub's DHCP, that the Airport Extreme would contact the next computer up the chain (in BT's infrastructure); a DHCP server assigning us our (static) IP addresses?"

Sounds about normal operation. As long as this is on the same subnet, any DHCP server active should hand out IPs. Are these private or public?

[iainH]

Part of the answer lies in putting the BT Business Hub 3 in bridging mode - tucked away on the Advanced Settings >> Broadband >> Routing page where it helpfully explains that "Bridging Enabled = Routing, NAT, DHCP Server, Local DNS - Disabled" which is exctly what I was lookig for.

When the Airport Extreme Base Station (AEBS) is connected (after having been reset) it asks you to log in with your PPPoE credentials (XXX@hg52.btclick.com or whatever) which then shows the IP Address dynamically allocated to this connection.

So far so good - although disconcertingly the broadband light on the Hub 3 cycles through different colours apparent to indicate that it is no longer a router but "merely a modem".

BUT ... the AEBS indicates that it is not connected (Internet amber) and none of AEBSs clients can access the interner either.

So now it's a question of experimenting with what'll allow the AEBS to manage both our static WAN  IP numbers and, with DHCP, its local subnet IPs; and to properly connect to the internet. 

(I can't believe I'm the only person who's been through this ... but there doesn't seem to be anything else on this forum about it)

[iainH]

Short answer: the Apple Airport Extreme won't fit in with what we want and (to my surprise) the BT Business Hub 3 will fit in very well.

Longer answer:

Despite a very helpful conversation with one of the Mac-savvy guys at the BT Business Broadband help desk - encouraging my Airport-centric attempts - accompanied by a great many hours experimentation with the BT Business Hub 3 (BTBH3); the Airport Extreme Base Station (AEBS); trying different network configurations having one or other of my servers acting as a gateway; and a rather terse conversation with the Apple Server / Airport Support Team I discovered - somewhat contrary to my expectations - that

1. the AEBS is quite restricted in what it can do as a router and
2. that the BTBH3 is actually very capable as a router for our network.

Whilst I am disappointed that I cannot take advantage of the AEBS's firewall being automatically managed by the OS X Lion Server - there are about 30 incoming ports routing to the services that the Lion Server provides (see http://support.apple.com/kb/TS1629) - it's a one-off task using the rather awkward UI  opening the ports on the BTBH3.

It's no use putting the BTBH3 in bridge mode - reducing it to a modem - as the AEBS is not capable of routing the 5 public IP numbers when accessing the Internet at the PPPoE interface offered by the BTBH3 'modem'; it can only route the single parent IP number allocated dynamically upon PPPoE authentication and there is no interface with which to add the public IP numbers to the routing table. The AEBS can only route the public IP numbers when in bridge mode itself and thus cannot do DHCP and NAT. The AEBS only offers the close-coupled firewall management to the OS X Server when doing DHCP (and NAT). You can see the DHCP, NAT and Port mapping through the firewall 'pin holes' are closely related to the business of managing routing tables when you look at the 'Routing' page of the BTBH3's 'Broadband Settings' section.

All-in-all I am very impressed by what the BTBH3 can do for us (I came with low expectations after an unsatisfactory port mapping experience with the BT Home Hub 3).

With the BTBH3:

• you can manually edit the static routing table yourself if you really find a need to;
• you can manage a table of host /domain names to resolve locally - this takes the functionality that /etc/hosts file has for dammars in Linux;
• the Static IP s can either be allocated via the BTBH3's UI or will automatically be recognised from the static IP numbers in the /etc/network/interfaces declarations in Linux or the System Preferences. This is a particularly important feature when a single server's interface listens for more than one public IP number when, for example, several https sites are being served behind a single interface, each with its own SSL certificate.
• And then, the BTBH3 does DHCP to manage a subnet of machines plugging in Ethernet or attaching wirelessly. 

The last two things I need to consider before going live using the BTBH3 as the router in this way are:

1. to see how easy it would be to open the local subnet to vulnerabilities behind the public-facing interfaces. (Since I am in sole control of the way the BTBH3 is set up I am optimistic about being able to satisfy myself that this will be safe enough)
2. check that each host with a static (public) IP really can have it's own 'firewall pin-hole' as is implied by being able to map a single port number to more than one host.

If this checks out I really will be impressed!