Resolving Double NAT Issues

[Rolitto]

Hi, I have the following scenario:

Internet/ISP-----Modem/Router R1-----Router R2-----PC/Server

                                       |

                                       |

                                       |

                    Mobiles, NAS, Printer, etc...

Local network of R1: 192.168.2.0/25.

Local network of R2: 192.168.1.0/28.

ISP is providing a public IP address x.x.x.x.

Now, here's what's happening:

• PC/Server on the local network of R2 can access the Internet and ping other devices on the remote network.
• Devices on the local network of R1 can access the Internet, but cannot ping PC/Server. However, they can ping the local (internal) interface of R2.

And here's what I tried:

1. Disabling SPI, unchecking Block WAN ping requests, etc... did not solve the issue.
2. Disabling NAT from R2 and placing it in Router mode did not solve the issue. It just made PC/Server unable to access the Internet and ping other devices on the remote network.
3. Writing a static NAT rule on R1 helped in making devices on the local network of R1 be able to ping the local interface of R2 only and not PC/Server.
4. Placing R2 inside the DMZ did not solve the issue either. Maybe, some port forwarding or ACL rules are required to fix it... I'm not sure yet.

Is there anything missing?

Any suggestion is highly appreciated...

[Georg Pauwen]

Hello.

does R1 have a route to the local network (192.168.1.0/30) of R2 ? Can you post the configs of both routers ?

[Rolitto]

Yes, R1 has a static route to the local network of R2 (192.168.1.0/28). These are commercial routers, one ADSL/VDSL modem/router and another is the open-source DD-WRT.

[Georg Pauwen]

Hello,

Local network of R1: 192.168.2.0/25.

Local network of R2: 192.168.1.0/28.

What network is the link between R1 and R2 using ?

[Rolitto]

Hello Georg, well yes actually the link in between R1 and R2 is the local network of R1, which is 192.168.2.0/25. R1 is connected to the ISP via a PPPoE connection, R1 and R2 are interconnected via a LAN-to-WAN configuration. DHCP is configured on R1 only.

WAN IP address on R1: x.x.x.x.

LAN IP address on R1:192.168.2.1.

WAN IP address on R2: 192.168.2.2.

LAN IP address on R2: 192.168.1.1.

IP address on PC/Server: 192.168.1.5.

[Georg Pauwen]

Hello,

which one of the two routers is the DD-WRT, and what brand/model is the other router ? I would post a schematic drawing of that topology including IP addresses and connections, because it is kind of hard to understand your setup, and hence, to answer your question...

[Rolitto]

Ok, here's the basic drawing.

[Georg Pauwen]

Hello,

--> Disabling SPI, unchecking Block WAN ping requests, etc... did not solve the issue.

I assume with that you mean the equivalent of:

"Filter anonymous Internet requests."

which is the default on Linksys devices (set under 'Security') ?

"Block Anonymous WAN Requests (ping)" <-- that would be the DD-WRT 'version' I guess ?

Which firmware version are you using for the DD-WRT ?

Also, can you post the output of 'ipconfig /all' from the PC ?

[Rolitto]

Georg, sorry for missing replying on you. Here's the output of the DD-WRT:

And here's the output of ipconfig /all:

[paul driver]

Hello

---

@Rolitto wrote:

Now, here's what's happening:

• PC/Server on the local network of R2 can access the Internet and ping other devices on the remote network.
• Devices on the local network of R1 can access the Internet, but cannot ping PC/Server. However, they can ping the local (internal) interface of R2.

And here's what I tried:

---

Disable the software firewall on pc so to allow icmp echo-reply ?

[Rolitto]

Hi Paul, I previously turned off the firewall on the device, but that didn't solve the issue. And before that, the NAS was on the local network of R2 and I couldn't ping it from outside.

[paul driver]

Hello

---

@Rolitto wrote:

Hi Paul, I previously turned off the firewall on the device, but that didn't solve the issue. And before that, the NAS was on the local network of R2 and I couldn't ping it from outside.

---

If R1-R2 are on 192.168.2.0/x subnet then what subnet are the printer and laptop connecting to R1on?
And does rtr 2 have a route to that subnet ?

[Rolitto]

The printer, laptops, NAS, and mobiles are all on network 192.168.2.0/25. The PC/Server is on network 192.168.1.0/28.

As for the 2nd question, I tried assigning a default static route on R2 having the WAN interface (IP address 192.168.2.2) as the gateway and network 0.0.0.0/0.0.0.0 as the remote network/subnet, but I was in doubt that something was either missing or incomplete.

P.S. The NAS was previously on network 192.168.1.0/28 to protect it against malicious activity, but then I had to assign it to network 192.168.2.0/25 so that devices can access it.

[paul driver]

@Rolitto wrote:

The printer, laptops, NAS, and mobiles are all on network 192.168.2.0/25. The PC/Server is on network 192.168.1.0/28.

LAN IP address on R1:192.168.2.1.

WAN IP address on R2: 192.168.2.2.
Printer, laptops, NAS, and mobiles are all on network 192.168.2.0/25

So if all the above share the same subnet that would indicate the Printer, laptops, NAS are assgined and connected to access ports on R1 related to the R1(lan) R2(wan) interface network.

Now if the above setup is correct then your routing looks okay between r1-r2, otherwise your the problem stems from trying to have two routed interfaces in the same subnet which can be obtained via IRB something I am assuming you dont have enabled?

[Rolitto]

Paul, yes the mobiles, laptops, NAS, printer, and the WAN interface of R2 are all attached to the LAN interfaces of R1, hence assigned to the same network: 192.168.2.0/25.

I'm not sure what you exactly mean by routing looks okay between R1 and R2 since devices on R1's LAN cannot access to or ping devices on R2's LAN. However, devices on R2's LAN can access other devices on R1's LAN. At the same time, devices on R1's LAN and devices on R2's LAN can connect smoothly to the Internet as well.

As for IRB, I'm not sure there's any option on the WAN interface setup of R2.