What is Double NAT?
ฝัง
- เผยแพร่เมื่อ 7 ส.ค. 2021
- In this video I go over what Double NAT is, how it works, why it should probably be avoided, and why it really isn't that big of a deal if you can't avoid it.
I also go through a crash course in NAT and private IP address explanation.
This video was meant for those who port forward or wonder if they can connect a new router to an already existing router and what implications that may have.
This video cleared up a lot of things for me. Thanks so much!
Really appreciate this.
Just returned to networking as a semi pro after several years of coding.
Learned a few things I never knew before from your vid.
Naturally Subscribed+Liked+Saved
Saying that, I kind of always liked multi-layer NATing. Sure it's more work to implement. Never seen any major problems in performance compared to a traditional single NAT config and multi-NATing is easy to configure if you know what you are doing. I just like to inconvenience bots and hackers as best as I can lol.
I will definitely check out more of your posts. Never stop learning eh? 🤷
Awesome info and explanation. Thank you sooooo much
Awesome video and explanation. Thanks.
really good explanation of double nat
Really good video. All of your videos are excellent, btw. And I don't mind the 'dry theory' at all! Have you thought about doing CPU performance/speed test comparison on NAT, Double NAT and triple NAT? It would be interesting to see just how much degradation there is when extra NAT-ing is added.
I have thought about it a lot actually. It has been on my list of videos to make for some time now. Just haven't gotten around to actually making it.
Would DMZ hosting work in a dual WAN load balancing scenario? I have an extra LTE modem which does not have option for bridge mode/passthrough and would like to use it together with my normal DSL connection on ER-X.
Really liking the content. Would be cool to see something about dual WAN load balance/failover and policy based routing on Edgerouter.
Do we have to set Port forwarding on the secondary router after we put it in the dmz or we have to do it on the primary modem?
Thank you so much for this video.
Never had an issue with my Double NAT setup. My status is set to open. Likely the DMZ I have set on router 1 for router 2. Also UPnP enabled on both to remove headache of forwarding twice constantly.
Thank you, nice explanation!
Thanks have been looking for a good explanation of this for some time, this nailed it. Another note, what tablet (or what IT guys call them) do you use for your diagrams, looks simple and fast, I need one at work for my enlightening scribbles.
The tablet I use for my videos is a Boogie Board Sync which is paired to my computer in digitizer mode. I use it along with the built-in Windows whiteboard application for the drawings.
Unfortunately, this product was discontinued some time ago and I don't believe they ever made a 1-1 replacement for it. I'm just hoping mine never breaks.
I believe the Boogie Board "Blackboard" will save your scribbles much like the Sync, but don't quote me on that.
Excellent vid thank you
@7:33 - My isp router/modem combo router will tend to lockup when more than 12 wifi devices (IofT) connected to it. An additional nat/router taking some of the connections off the main router fixed the lockup problem. NAT takes up a lot of cpu capacity. So don't through away the old router.
Also, does any custom dns server from the primary modem gets forwarded with the Dmz to the secondary Router?
With double NAT your internal router should probably also route all traffic trough your ISP, so you'll need some static route as well I presume. Great series!
Yes, but the static route is generally advertised through DHCP. Kind of a waterfall situation with DHCP advertising the default-gateway downstream...over and over and over again.
My internet provider changed my modem after a power outage in my building. Now, my Ubiquiti Cloud Key Gen 2 is not working. This video gave me the basics I need to negotiate😡 with my provider.
Great contents! I'm a Cisco Eng. As well, you should have more followers, I sub to your channel, keep up the good work 👍
Very nice! Thank you!
Interesting video. I may be doing things incorrectly. In my provided router I have turned off WiFi. I have a managed switch and two unifi WiFi AP plugged in to three of the provided ports. I am now thinking the the WiFi AP my be working overtime. I will have to check.
Thanks. That was interesting.
@12:40 - my netgear r7200 router in dhcp mode will automatically change its default IP address (& relevant settings) when connected to another router with the same IP address. It actually let you know the default ip address was changed when the browser is launched initially.
Just GREAT!
great video
This some good content bruh 😅
I’ve been double NATing for years with two separate private network addresses. This is done on purpose to separate traffic for things like cameras or other devices that I don’t trust (lots of IoT devices never get firmware updates etc) from my local network. I don’t do gaming that requires port forwarding and have never really had an issue with the approach. What this means in practice is that I have 3 separate networks at home. My local one with my laptops/ipads/NAS/Media boxes, a separate one with untrusted devices and a third guest one.
I also use this approach because while I have access to the ISP provided router, I don’t trust that it can’t be managed from the WAN, which is something that I simply will not allow. FWIW, I also change the default DNS to be a trusted one. What I find most disconcerting is that a bunch of the new mesh home routers want you to manage them from the manufacturers website. That’s a hard NO from me. The only way that you should be able to reconfigure your network is if you are actually there. Not only does this prevent someone reconfiguring your network covertly, but also means that you are less likely to have a data breach impact you, and should the manufacturer go broke you can still manage your devices.
Thank you for this superb explanation! I was wondering if your second router can simply be configured as an access point. I have the same double router issue. I need to use my ISP router because it is integrated with an voice-over-the-internet phone. (The ISP provider discontinued copper wire altogether.) But, the router is a WIFI 5 router, and it does not offer gigabit wifi rates... So, I bought a TP-LInk Archer wifi 6E router and configured it as a wifi access point. Would you consider this inferior to your solution?
Not sure if I'd label it as "inferior". Sometimes you have to work with what you have and if you can't setup bridge mode or a DMZ, then sometimes you just have to live with double-NAT. It really doesn't make too much of an impact if you aren't hosting out of your house or using certain games.
I'm just curious as to how it would matter because pretty much every router has no ability to cross talk. that is comunicate with another connection on it.. you'd ghave to connect to the actual computer via internet oop I see your ideal it would prevent it from going through that router, but not the internet
On your modem did you assign a static IP to your second router?
I use the first router\modem to assign the IP to the second router, if you prefer it you can set the IP statically on the second router the same goal is accomplished.
Yes, I used a static address on my second router.
@@ToastyAnswers Thanks. I figured but wanted to be sure. Helping someone with this issue this weekend and wanted to be sure.
good content
So anything connected to the first router wouldnt suffer from portforwarding and double nat issues? Only devices connected to a secondary router right?
Correct, if you have devices directly connected to the first router they would function as normal.
@ToastyAnswers damn still replying 2 years later!? Ur the absolute best! I've been looking for the answer to this question for days.
Double NAT is literally the only way I could have a second router with its own subnet on my home network I share with other people because even through static routes are set up and routing worked between them, the main router doesn't add the second subnet to its NAT pool for translation and there is no way to do so without custom firmware.
Ok so my question is how to get a Synology NAS to work remotely with port forwarding with a double NAT situation? I am totally at a loss at this point?
Depends on what part you are trying to access remotely. Typically, you would just use the same port-forwarding rules on both routers (Router A = Router B's IP & Router B = Synology IP).
However, If you're trying to access SMB shares over the internet by port forwarding, I would not recommend it.
from your explanation what I understood is, double nat is source address translation done twice along the forwarding path. But, what I thought was, double nat is something that will change both the source IP and the destination IP of a flow(at the same time) to something completely different because you have same ip addresses used in different part of your network and you need to have them communicate to each other. What is missing here?
I think this is just semantics. From my experience, Double NAT is referred to as you explained (source NAT done twice) which is also what is explained in the video.
Using the same IP scheme in two different parts of the network and translating between the two using NAT is definitely something that can be done (and frequently used as a band-aid of sorts). However, I'm not entirely sure how this is referred to. If you refer to this as double-NAT, then we simply have to different meanings for the same phrase. They are two completely different ideas, though.
@@ToastyAnswers Thanks Toasty.
Great video , I have this issue in my Xbox. I have a modem and seperate router setup. I changed isp today and now I have double Nat. My port forwarding failed and all ports are open,I use the asus gtax11000. I am wondering if when setting up the router is it possible or likely that by not selecting dchp I now have double Nat ? I followed the verbal instructions from my isp who told me to select automatic isp with no special requirements needed, then the router interface page booted up. For perspective, I am a guy who has little knowledge of this I only heard of double Nat tonight. Lord help me.
I could help you out if you still need help
@@matthewschuster4600 thanks mate all good now it was an issue with the ISP. I also changed ISP no issue everything moving forward
Great video! Can we achieve more security through double nat, incase u don't trust the device given by ISP?
I have same problem exactly as you mentioned in the video. My isp provides ont/router/ap combo device which i don't trust and is banned by many countries. PPPOE authentication is done by that unit. I have put my router behind that, effectively doing double nat. I don't have option to put isp device in bridge mode or passthrough mode.
I don't know about how secure this setup is. If someone gains access to isp router, they only see the ip of my router behind this or more?
Thanks!
NAT can provide some security, but it is best not to think about it as a security feature. The security benefit is kind os a side-effect of NAT. There is really no substitute for a good firewall.
In this situation, an Edgerouter with restrictive firewall rules should be good enough.
Ummm sometimes my Xbox freaks out about doble NAT but most of the time it doesn't quite confusing as everything is set up correctly, what's going on?
I hate troubleshooting Xbox NAT issues on a network. The Xbox likes to use something like UPNP to dynamically open and close ports, which a lot of routers don't support. Basically, if you don't have all the ports an Xbox uses open and forwarded, then you will likely get an error.
This depends on the game being played... different games want to use different ports for different reasons. It is hard to do this on business-class devices since they don't typically support the (less secure) dynamic methods of opening ports.
@@ToastyAnswers Thanks. I do it some things just wondering why. That explains a lot.
What are the security benefits of 2x NAT?
I wouldn't say there is a real "benefit". It makes things a bit convoluted and complicated which could make it harder to gain access, but if someone can bypass one NAT they can probably bypass two.
I only have one router and I’m getting double nat… why would that be?
There's a few reasons, all of which depend on your provider or where your connection is coming from. Some ISPs do CGNAT (which is still NAT on a much larger scale). Other reasons would be if you're in an apartment complex or dormitory where the connection is managed by the landlord and is ran through another router upstream.
there's A LOT of security benefits to double NAT (better word for it would be NETWORK SEGMENTATION) depending on a person's use case.
you can isolate your IoT and cameras with double NAT or if you have teenage kids that watch porn (yeah I said it) you can isolate there device so it won't infect other devices on your network...
there's benefits to double NAT if you apply a little higher order thinking to it, just depends on the use case...
im getting double nat just with 1 ISP router and no more there router or modemds
came here because starlink currently does not support bridge mode on their router, i can bypass the starlink router entirely but then you cant monitor the service using the app
You can still get the stats via port forwarding. There are a few threads on Reddit explaining what you need to input. A quick google search should get you there.
Where you said in the video at 8:28 “sometimes you can ONLY do DMZ, not pass through or bridge mode, so you end up with double NAT”.
What’s wrong with adding router #2 into the DMZ of router #1? This sends the internet directly through to router #2, bypassing the firewall of router #1. Is this a bad thing, or is it perfectly safe? I’m looking to do this with a mesh wifi system on my home fibre connection. The mesh does not support PPPoE (required for U.K. FTTP) and the ISP’s router does not allow bridge mode. It DOES however allow DMZ.
Your video was explaining everything super clearly for me up until this point where you mention that if you ONLY have DMZ, you’ll end up with double NAT (rather than explaining whether it’s OK or not, to simply add the second router into the first router’s DMZ).
Any input / clarification on this would be much appreciated, I don’t want to end up with security risks on my network from adding the mesh system’s main router into my ISP’s router’s DMZ (with wifi then disabled on the ISP’s router)
Yeah... listening to that again is a bit confusing. I can see why you misunderstood what I was trying to say.
There is nothing wrong with adding router #2 to the DMZ. This does not end up with double NAT.
I was trying to say that sometimes none of those options are available (Pass-thru, bridge, or DMZ). Which is where you end up having double NAT. My comment about "sometimes you can only do DMZ" was just an add-on comment (sometimes you can only do pass-thru, sometimes you can only do DMZ, sometimes none of these are available... which is when you end up with double NAT).
I think I threw that in because my own router only has the option to use DMZ (not pass-thru or bridge). So, DMZ is actually how I run my own network. There isn't any additional security risk by using DMZ over another option.
@@ToastyAnswers that’s incredible - this is as I suspected, but wanted to confirm as you definitely sound like you know more about this than me 😂
Thanks for the super quick response, much appreciated. I went ahead and configured it this way earlier after the fibre technician left, and it seems rock solid.
Having some issues with port forwarding which has previously been configured on router #2 and worked with no issues. Could the reason these aren’t working any more, be due to having this router in the DMZ of router #1? Surely not, as being in the DMZ by definition means that router #2 is exposed to my external IP address?
Curious if you know why the forwards might not be working any more. Both routers are on different subnets, afaik. Router #1 assigns an IP of 192.168.1.xxx to router #2 (which I’ve then added to the DMZ) and router #2 is then assigning all IPs on the subnet 192.168.0.xxx.
FWIW, the WAN IP of router #2 is showing as 192.168.1.xxx - I was expecting this to show as an external IP… is this correct behaviour? Could explain the port fwd issue.
There could be a few reasons why the existing port-forward configuration isn't working, but without knowing exactly how the network is configured it is hard to say.
1. The network behind the Edgerouter is different than it was (E.g. Previously, the devices did not have 192.168.0.xxx addresses). You would need to update the port-forwarding destinations to the correct addresses.
2. The devices have grabbed different DHCP addresses, therefore the port-forward destination has changed. If the previous router was used for DHCP (also, the devices you were port-forwarding were DHCP enabled) and now the Edgerouter is being used, the devices could be getting different IP addresses than they previously had.
3. The new ISP is blocking those ports somewhere upstream... (not the most likely, but it could happen).
With a DMZ, the WAN address of router #2 isn't going to show a public IP, but this shouldn't have any affect on the port-forwarding. Essentially, a DMZ destination is the same as port forwarding every single port from your WAN address to your "DMZ device" (in this case, the Edgerouter or Router #2). This is why you can only have a single DMZ destination. Your ISP router is still technically performing NAT (Yes... you do "technically" still have double-NAT...) but it has no consequence since ALL traffic is being forwarded to your internal DMZ device anyway. The translation still occurs, but ALL traffic is translated and passed along to your internal router. From your perspective, your Edgerouter might as well have the public IP since it is processing all the public traffic anyways. It's just passing through a translation layer that isn't really needed... it just happens to be your only option for achieving what you want to do.
Of course, with IPv6, each separate machine in your house can have separate, real IP addresses. With IPv6, you don't need this terrible kludge called NAT in the first place.
Would love to see a video on this being done with IPv4 NAT
My Xbox always has double nat sometimes goes to strict nat. I have a frontier modem router in one and bought a nighthawk gaming router hoping to get more range and better performance. Seems like I opened a can of worms
ohhh double hardware firewall I like..... It why I has alll security abnd virus scanners off... oop I deleted dem....... lol oh well... dont need em anyway, nothing gets in that I dont specifically ask for...