Using double NAT here because my ISP won't even support/allow putting their box in bridge mode and I don't even have root access to it, just some limited functionality via their web GUI.
I haven't had any issues with it.
post
replies:
You’ll be fine. In the past stuff like ftp and sip could get confused by double nat, but not so much today. And stuff like opening a port from outside to the inside needs some planning through double nat.
We run it in the office for years now and it is totally fine. We are in a building with multiple companies sharing internet and we wanted our own network within, so we are using double nat (internet modem and our switch).
replies:
[removed by mod]
replies:
If it’s double NAT where you have control over both boxes, it’s not that big a deal. First of all, it only matters at all if you’re trying to forward ports for remote access to your services, in which case you just need to add two port forwarding rules for each service, instead of one, one in each firewall. Alternatively if the ISP router allows it, see if it has a 1:1 NAT feature, this way it forwards ALL the ports to your private router, where you can then be selective about which ports to allow.
Alternatively, if you’re not trying to host services on your LAN for public access and consumption (Which would be a bad idea at this point in time anyway given your level of knowledge) don’t worry about the NAT or port forwarding at all and just use a mesh VPN like Tailscale (Optionally with the self hosted control application Headscale) and use that to access your services which outside home securely.
replies:
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| AP | WiFi Access Point |
| IP | Internet Protocol |
| NAT | Network Address Translation |
| VPN | Virtual Private Network |
4 acronyms in this thread; the most compressed thread commented on today has 10 acronyms.
[Thread #105 for this sub, first seen 4th Sep 2023, 08:55] [FAQ] [Full list] [Contact] [Source code]
I double NAT. My ISP box gives off WiFi for consoles, guests, some IOT. UPNP is enabled and I generally don't care what goes on there.
My FW is an OPNSense box and everything I do is behind that. I've opened ports, run Tailscale, etc and have had no problems at all. All it is is an extra device to open a NAT rule in if I want to open something up.
No issues with double NAT. I even had a setup with an internal and external net, and the provision that any network link originating from (not passing through) the outer NAT router would raise an alert on the inner NAT router - which would simply switch the outer NAT router off.
Double NAT with DMZ.
Those SIP ALGs are more trouble than they are worth. If you are using SIP devices, use a different outbound port on each device (eg: 5060, 5061, 5062).
If you're using double NAT, you're doing something wrong. If you want to do it right, stop using double nat. If that doesn't matter to you, and you're comfortable supporting a broken-by-design network, do it.
replies:
Yes.
all 32 comments