IP Subnet Setup Question

[uk26]

I am in the process of moving our BT Net leased line to another office. I have listed below our usage / requirement and would like someone to clarify some questions.

Background info
BT have provided us with /27 (32 Public Routed IPs) this is a wires only service

Current Setup
Core Access Router setup with 3 Vlans / public subnets

Example
195.XXX.XXX.102 / 29 (Gateway for lan2 / Vlan2
195.XXX.XXX.110 / 29 (Gateway for lan3 / Vlan3
195.XXX.XXX.126 / 28 (Gateway for lan4 / Vlan4

Office Router 1 (Our Office)
Office Router (Wan 195.XXX.XXX.125 (Lan4 / Vlan 4 from core router)
Office Lan: 192.168.1.XXX

Public Network (Gateway 195.XXX.XXX.110)
Devices that require routed Public IPs direcly with no nat

Office Router 2(Tenant Office)
Office Router (Wan 195.XXX.XXX.102
Office Lan: 192.168.99.XXX

So my question now comes and hope someone will give me the answer

I have always thought it was best to subnet all separate networks thing up like above, but after rethinking the network design this wastes Public IP Addresses due to additional Broadcast Address.

So my question is this:

Could i get away with just having a /27 255.255.255.224 subnet on the core router
and then on any other connected device / router always set the subnet mask to 255.255.255.224.

by doing this we will free up an additional 6 Public IP addresses.

What are the pros and cons with doing this?

 

[KM-Tiger]

At face value, if you are NAT'ing to RFC1918 addresses then you don't need separate subnets on the WAN side. I presume the LANs are /24 so there is no routing between them? And do you actually need public IPs on the LAN routers?

For the public network, how are you doing that? Proxy ARP? Does it need to be that or could you NAT into a DMZ?

Sorry that's more questions than answers! But my instinct is that you can free those IP addresses, without compromising security.

 

[uk26]

Yes every separate private network will have its own router and /24 private range on the Lan.

To give a bit more detail

Office 1 - Router
Requires 2-3 Public IPs but only on the wan side and can use port forwarding to internal servers.

Office 2 - Router
Requires 4 Public IPs but only on the wan side and can use port forwarding to internal servers.

Public Network
no separate router any devices that needs public IP's connect directly to the core router

However communications between each network may need to be possible. example Exchange server in each office will need to be able to send email to each other.

Our policy to other tenants is internet is provided on a fully routed / unprotected feed only, each end user is to connect their own router to the feed provided.

The idea behind the core router is to have central management of all the ISP Connections and for us to allocate Public IPs directly to required internal routers / services as required. This way we are not responseable for any NAT / Firewalls

For the public network, how are you doing that? Proxy ARP? Does it need to be that or could you NAT into a DMZ?

ARP is enabled on the main access router.

 

[uk26]

And do you actually need public IPs on the LAN routers?

Yes, so we can allocate public IP Addresses on tenant routers to avoid double natting