Statis IP on Wan Port

[GarageLand42]

Our MX WAN 1 port currently has a /29 subnet mask, and is using one of the IP's.

It is running the VLAN and DHCP for our internal network. I need to statically assign 1 of the available numbers from the WAN  side so I can hook up one an internet facing server.    The server cannot have access access to our internet network.  Is this possible ?  I wanna place a small switch bewtween the ISP and the MX, and connect my statically assign IP address server to that. switch.  

Existing

Proposed

 

Or is there a better way.

[BlakeRichardson]

What you propose is not very secure at all. Why not put the server on its own VLAN so that you can enable external access to it while keeping it segregated from your main LAN.

[PhilipDAth · Accepted solution]

Yes that would work.

To build on @BlakeRichardson's response, you could create a DMZ behind the MX.  Create a firewall rule so it can not talk to the internal network, and then just NAT one of the static IP addresses through to it.

Or - host it in a public cloud provider like Amazon AWS.