Network Configuration for Fios Business Account with Multiple Static IPv4 Addresses

MuscleCarResearchLLC

I have a Fios business account with a single static public IPv4 address. I'm using a Verizon CR1000A Wi-Fi router. I need to add another server to my network that needs to be accessible using a different domain name and public IP address. I can get a block of 5 static IPv4 addresses from Verizon, but I don't see any way the CR1000A can be configured to support more than one WAN address. I've been exploring other options. Would a setup like this work?

Run the WAN cable from the ONT to a multi-port switch like the Netgear GS308.

Run one cable from the GS308 to WAN port on the CR1000A, configured to support my existing LAN with one of the static addresses.

Run a second cable from the GS308 to the WAN port on a new router, like the TP-Link ER605. Configure the ER605 to support a second LAN with another one of the static addresses. As a plus, the ER605 can be configured to support multiple WAN input ports, letting me create multiple LANs without having to buy a third router.

This sounds like a workable solution. Am I missing anything? Is there a simpler way? I know I can configure my second server with a static address and plug it directly in the GS308, but I'd like to take advantage of the ER605's VPN and firewall features to protect the server somewhat.

Capricorn1

This should work the way you have planned it, but I don't think a single CR1000A can handle this setup. When you get a block of five IP addresses, that is actually the usable portion of a /29 network. That is, there are eight IP addresses dedicated to your account. However, in IPv4, the first and last IP addresses are reserved for network and broadcast addresses, respectively, leaving only 6 usable IP addresses. The first of those IPs will be needed by Verizon's upstream router that directs traffic to your ONT. (This is not your CR1000A router.) That leaves you with five public IP addresses being routed to your ONT. What you need is a way to separate (at least) two of those IP addresses to (at least) two networks for your business.

What may be the easiest for you is to connect the Ethernet cable from the ONT to a switch. Then, from the switch, connect Ethernet cables to the WAN ports of a pair of routers - one of which would be the current CR1000A. You would need a second router (another CR1000A/B [or another brand like the TP-Link ER605]) to handle the second network. (There are higher-end commercial routers that can handle doing this in a single physical device, but the costs and setup are more complex.)

Next, you would need to set up the public IP addresses on each of those routers. This is where a site like the IP Subnet Calculator comes in handy. Let's say Verizon assigns you the address range 71.171.103.162-71.171.103.166. If you plug 71.171.103.162 into the site (choose Class C and the /29 subnet), it will return that 71.171.103.160 is the Network Address, 71.171.103.167 is the Broadcast Address, and the usable IP range is 71.171.103.161-71.171.103.166. Verizon's upstream router is at 71.171.103.161. On the existing CR1000A router, set the static public IP address to 71.171.103.162 and the public IP address on the second router to 71.171.103.163 (.164, .165, or .166). You would use the calculated network address and subnet mask. If you need to register the services with a static or dynamic DNS server, these are the addresses you would use for each service.

Your servers will still connect to their respective routers either directly via the LAN ports or a switch connected to a LAN port. You can also use the wireless LANs, but each network should have its own SSID and password. The servers will use their respective routers' DHCP services to obtain internal IP addresses (e.g., 192.168.0.2). You probably want to use a different private LAN range on each router. (I.E., set one to use 192.168.0.x and the other to use 192.168.1.x or some other private IP range) Each network will appear to have a unique public IP address on the Internet.

You will likely need to set up port forwarding rules on the router for the server behind it. You should also be able to send traffic between the two LANs, but that may require port forwarding.