Public IP on VMG3925 B10B

I just upgraded from the TG582 to a VMG3925 B10B after getting VDSL. With the old router you could assign the connection's static IP to a single local device so it wasn't behind the NAT. That was handy for me because I sometimes run a public HTTP server on my computer for web development.

Is there a way to do this with the Zyxel router?

I found the DMZ feature but with that turned on my computer still gets assigned a local IP, and when I access the public IP to use the development server I get the router's admin interface.

Anyone know how to set this up?

IPv4 or IPv6? You have a /48 IPv6 block so could permanently assign a static one to the device. Preferably from the initially assigned /64 for the line to save complication.

This sounds like a form of bulk port-forwarding so that all incoming connections from the internet are directed to one internal IP address.

You may find the VMG3925 uses different terminology (I've see Internet Server used) or only supports a protocol by protocol ( HTTP, SSH, TELNET, FTP ) mapping and you may have to create multiple mappings.

In reply to a post by bsdnazz:

This sounds like a form of bulk port-forwarding so that all incoming connections from the internet are directed to one internal IP address.

I think that's what it amounts to, but the Technicolor router actually assigned the public IP via DHCP to a particular device you could nominate (by MAC address), yet would still support other devices behind the NAT, so that's what I was trying to reproduce.

In reply to a post by RobertoS:

IPv4 or IPv6? You have a /48 IPv6 block so could permanently assign a static one to the device. Preferably from the initially assigned /64 for the line to save complication.

Unfortunately the server needs to be accessible by people other than me so IPv4 is still a requirement.

Looking at the online manual I found Chapter 11 on Network Address Translation and 11.2 the Port Forwarding screen looks to be a good starting point.

It looks like you have to add a rule per service rather than being able to map everything to one IP address. It's more flexible but also more fiddly.

Two things to consider here:

1. Do you get the web GUI for the router if you access the public IP from outside your network (regardless of DMZ settings etc)? Hopefully no.

2. Putting your development PC in the DMZ in order to run the webserver is unnecessary and opens up security issues. You just need to set up a port forward to port 80 in the router NAT settings.

Your more than likely can't test from within your network as the router may not support hairpin NAT. Make sure all your testing is from outside your LAN.

Why not just ask for a /29 or/30 public allocation and route that through directly rather than going to the trouble of spoofing the router's public IP?