Mac Mini Server + Time Capsule LAN for Comcast Cable Business

I have a static IP address and a registered domain name as well as a Time Capsule, Mac Mini Server and two iMacs. I want to create a small office LAN with the Mac Mini Server running behind a firewall that is publicly accessible.

Final LAN Configuration:

INTERNET
     |
 /173.nnn.mmm.122 gateway  \
| 255.255.255.252 subntmsk  |- COMCAST SMC 8014 router
| 75.75.75.75     WAN dns1  |  (DHCP / NAT disabled) 
 \75.75.76.76     WAN dns2 /
     |                              
 /173.nnn.mmm.121 Static IP\  
| 173.nnn.mmm.122 gateway   |- Time Capsule ... USB Printer
| 255.255.255.252 subntmsk  |  (DHCP and NAT mode)
| 75.75.75.75     WAN dns1  |
| 75.75.76.76     WAN dns2  |
| ========================= | 
| 10.0.0.1        LAN IP    | 
| 255.0.0.0       subntmsk  |   
 \10.0.0.19       LAN dns  / 
     |
     |-----------------------------
     |              |             |
 / Mac Mini\   / iMac #1 \   / iMac #2 \
| 10.0.0.19 | | 10.0.0.17 | | 10.0.0.13 | < Private IP
| 255.0.0.0 | | 255.0.0.0 | | 255.0.0.0 | < LAN subntmsk
| 10.0.0.1  | | 10.0.0.1  | | 10.0.0.1  | < LAN gateway
 \127.0.0.1/   \10.0.0.1 /   \10.0.0.1 /  < LAN dns
     |
     |                  
 HDMI TV


Configuration Method:
This describes the procedure I followed to obtain the above LAN configuration.

.

Configure LAN

The Mac Mini Server, Time Capsule (TC) and two iMacs were manually configured to a 10.0.0.x subnet with TC as Router and the Mac Mini Server as DNS server. The Private IP address of the Comcast Cable modem/router was changed from the default 10.1.10.1 to 10.0.0.1 to match one of the DHCP ranges available in TC. Note that TC is currently in "Bridge" mode but will eventually be configured for "DHCP and NAT." 
.

Configure DNS

Do not skip DNS configuration. It is absolutely essential to get your LAN working right.

.

Server.app on the Mac Mini Server was uninstalled with this command in Terminal:  

.

sudo rm /var/db/.ServerSetupDone
.

Install Server.app 2.2.1 for a private network. Re-configure DNS service by first deleting all of the zones setup by the installer, then adding a Primary Zone, a Nameserver Record and a Machine Record. The real registered domain name dogfunplaces.com was used to setup DNS service.
.

Test DNS Configuration

From Terminal on the Mac Mini Server run: sudo changeip -checkhostname and verify that the Current HostName and DNS HostName match. From Terminal on one of the iMacs run: sudo dig server.dogfunplaces.com and sudo dig -x 10.0.0.19 to make sure domain names and IP addresses are properly resolved.
.

Disable the Comcast Cable Modem

Port forwarding, DMZ and 1-to-1 NAT were disabled on the Comcast Cable modem. "Disable Firewall for True Static IP Subnet Only" and "Disable Gateway Smart Packet Detection" were checked. "Disable Ping on WAN Interface" was unchecked.
.

Change Time Capsule Router Mode

The router mode of the Time Capsule was changed from "Off(Bridge Mode)" to "DHCP and NAT" via the pull-down menu on the "Network" tab of AirPort Utility. In "Network Options..." choose a DHCP range of 10.0.0.20 to 10.0.0.21. That is the same subnet as the Mac Mini Server, Time Capsule and the two iMacs, but beyond the IP range of those manually configured devices.

Once  changed to "DHCP and NAT" router mode, the TC takes on the LAN IP of 10.0.0.1 (which was configured in the Comcast Cable modem) and the Comcast Cable modem is accessible from its 173.xxx.yyy.122 WAN gateway address only.
.

Enable Services

Go to the Mac Mini Server and add users and groups. Give them access to File Sharing and FTP services. Turn on FTP, Open Directory, Websites and Wiki services on the Mac Mini Server. Go to the Websites tab, Edit "Server Website" and configure a redirect to "Server Website (SSL)."
.

Using Workgroup Manager for Server.app, select the single person button at the top of the left pane, then choose the "Advanced" tab. Select each user and make sure their Login Shell is set to "/bin/bash" using the pull-down menu.
.

Port Settings

"FTP Access" port 21 and "Personal Web Sharing" port 80 were mapped to Private IP 10.0.0.19. "Personal Web Sharing (SSL)" port 443 was also mapped to Private IP 10.0.0.19. The FTP and Wiki site can now be accessed by authorized users from 173.xxx.yyy.121 as well as server.dogfunplaces.com. 

.

Woo whooo!
.

Now I need to update my trusted certificates!