cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1063
Views
0
Helpful
18
Replies

Resolving Double NAT Issues

Rolitto
Beginner
Beginner

Hi, I have the following scenario:

 

Internet/ISP-----Modem/Router R1-----Router R2-----PC/Server

                                       |

                                       |

                                       |

                    Mobiles, NAS, Printer, etc...

 

Local network of R1: 192.168.2.0/25.

Local network of R2: 192.168.1.0/28.

ISP is providing a public IP address x.x.x.x.

 

Now, here's what's happening:

  • PC/Server on the local network of R2 can access the Internet and ping other devices on the remote network.
  • Devices on the local network of R1 can access the Internet, but cannot ping PC/Server. However, they can ping the local (internal) interface of R2.

And here's what I tried:

  1. Disabling SPI, unchecking Block WAN ping requests, etc... did not solve the issue.
  2. Disabling NAT from R2 and placing it in Router mode did not solve the issue. It just made PC/Server unable to access the Internet and ping other devices on the remote network.
  3. Writing a static NAT rule on R1 helped in making devices on the local network of R1 be able to ping the local interface of R2 only and not PC/Server.
  4. Placing R2 inside the DMZ did not solve the issue either. Maybe, some port forwarding or ACL rules are required to fix it... I'm not sure yet.

Is there anything missing?

Any suggestion is highly appreciated...

18 Replies 18

Georg Pauwen
VIP Master VIP Master
VIP Master

Hello.

 

does R1 have a route to the local network (192.168.1.0/30) of R2 ? Can you post the configs of both routers ?

Yes, R1 has a static route to the local network of R2 (192.168.1.0/28). These are commercial routers, one ADSL/VDSL modem/router and another is the open-source DD-WRT.

1.jpg

 

Hello,

 

Local network of R1: 192.168.2.0/25.

Local network of R2: 192.168.1.0/28.

 

What network is the link between R1 and R2 using ?

Hello Georg, well yes actually the link in between R1 and R2 is the local network of R1, which is 192.168.2.0/25. R1 is connected to the ISP via a PPPoE connection, R1 and R2 are interconnected via a LAN-to-WAN configuration. DHCP is configured on R1 only.

 

WAN IP address on R1: x.x.x.x.

LAN IP address on R1:192.168.2.1.

WAN IP address on R2: 192.168.2.2.

LAN IP address on R2: 192.168.1.1.

IP address on PC/Server: 192.168.1.5.

Hello,

 

which one of the two routers is the DD-WRT, and what brand/model is the other router ? I would post a schematic drawing of that topology including IP addresses and connections, because it is kind of hard to understand your setup, and hence, to answer your question...

Ok, here's the basic drawing.

2.jpg

 

 

 

Hello,

 

--> Disabling SPI, unchecking Block WAN ping requests, etc... did not solve the issue.

 

I assume with that you mean the equivalent of:

 

"Filter anonymous Internet requests."

 

which is the default on Linksys devices (set under 'Security') ?

 

"Block Anonymous WAN Requests (ping)" <-- that would be the DD-WRT 'version' I guess ?

 

Which firmware version are you using for the DD-WRT ?

 

Also, can you post the output of 'ipconfig /all' from the PC ?

Georg, sorry for missing replying on you. Here's the output of the DD-WRT:

1.jpg

 

And here's the output of ipconfig /all:

2.jpg

 

paul driver
VIP Expert VIP Expert
VIP Expert

Hello

 


@Rolitto wrote:

 

Now, here's what's happening:

  • PC/Server on the local network of R2 can access the Internet and ping other devices on the remote network.
  • Devices on the local network of R1 can access the Internet, but cannot ping PC/Server. However, they can ping the local (internal) interface of R2.

And here's what I tried:


Disable the software firewall on pc so to allow icmp echo-reply ?

 

 


Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

Hi Paul, I previously turned off the firewall on the device, but that didn't solve the issue. And before that, the NAS was on the local network of R2 and I couldn't ping it from outside.

Hello

 


@Rolitto wrote:

Hi Paul, I previously turned off the firewall on the device, but that didn't solve the issue. And before that, the NAS was on the local network of R2 and I couldn't ping it from outside.

 


If R1-R2 are on 192.168.2.0/x subnet then what subnet are the printer and laptop connecting to R1on?
And does rtr 2 have a route to that subnet ?

 

 


Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

The printer, laptops, NAS, and mobiles are all on network 192.168.2.0/25. The PC/Server is on network 192.168.1.0/28.

As for the 2nd question, I tried assigning a default static route on R2 having the WAN interface (IP address 192.168.2.2) as the gateway and network 0.0.0.0/0.0.0.0 as the remote network/subnet, but I was in doubt that something was either missing or incomplete.

P.S. The NAS was previously on network 192.168.1.0/28 to protect it against malicious activity, but then I had to assign it to network 192.168.2.0/25 so that devices can access it.

@Rolitto wrote:

The printer, laptops, NAS, and mobiles are all on network 192.168.2.0/25. The PC/Server is on network 192.168.1.0/28.


LAN IP address on R1:192.168.2.1.

WAN IP address on R2: 192.168.2.2.
Printer, laptops, NAS, and mobiles are all on network 192.168.2.0/25

So if all the above share the same subnet that would indicate the Printer, laptops, NAS are assgined and connected to access ports on R1 related to the R1(lan) R2(wan) interface network.

 

Now if the above setup is correct then your routing looks okay between r1-r2, otherwise your the problem stems from trying to have two routed interfaces in the same subnet which can be obtained via IRB something I am assuming you dont have enabled?


Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

Paul, yes the mobiles, laptops, NAS, printer, and the WAN interface of R2 are all attached to the LAN interfaces of R1, hence assigned to the same network: 192.168.2.0/25.

I'm not sure what you exactly mean by routing looks okay between R1 and R2 since devices on R1's LAN cannot access to or ping devices on R2's LAN. However, devices on R2's LAN can access other devices on R1's LAN. At the same time, devices on R1's LAN and devices on R2's LAN can connect smoothly to the Internet as well.

As for IRB, I'm not sure there's any option on the WAN interface setup of R2.3.jpg

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers