How do I use two different Public IP to add a new server to the DMZ? [closed]

Question

My network looks something like this;

INTERNET»»ROUTER»»ASA FIREWALL»»»INTERNAL NETWORK

Right now, we are using a public IP in a range like for instance of 50.224.157.105, which we are using in the router, asa, and for two servers on DMZ. But now, those blocks of public ip are finished, and we added some other services that we will have a web server on the DMZ, which will need to be reachable both from the Internet and from internal users.

So how can I do this configuration for those new servers in the DMZ, so they can be accessed from outside users, but still having their gateway the same as the others server which is a public IP in a range of the 50?

Remember that the new servers will have their public IP in the block of 197.200.4.1 for instance.

Can anyone help me on how to do that? What type of protocol should I use?

Do I use PAT for port redirection? or subinterface? or should I use static nat?

Answer 1

If the new services introduce new ports range that is distinct from existing services, then I'd establish local persistent SSH tunnel between old and new DMZ servers with mapping new ports on old DMZ server to the new one. Then any external request will arrive to old DMZ directed to the new ports, so will be further mapped through SSH to the new DMZ server and handled there by the new services.

Even if new ports range overlaps with the existing ports layout, then it's still possible to introduce another unallocated ports range on old DMZ as source-side of the tunnel and map them back to new desired range as destination side of the tunnel.

Apart from somewhat restricted independency of the new services, the solution would work transparently for them, as well as for external users.

P.S. I've seen advanced routers that had ability to route individual ports directly to specified LAN destinations but not all routers have the feature, so my solution is for this inadvanced case.