Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a new connection with a nice new router/cable-modem. I'd like to setup it up optimally and needs some pointers. I am a complete n00b when it comes to routing.

I want to end up with two separate subnets, and each available on their own wireless channel/SSID. Both firewalled. I want my wired computers on the gigabit switch, optimally with public ips. I want to be able to reach from, but not vice versa. Everyone should have internet access.

Hardware and capabilities:

Netgear CG3100. Handles cable connection. Gigabit switch. 802.11n. Can do DHCP, firewall, NAT etc. Can choose subnet. Can turn of NAT and if so hand out up to 4 public ips. Somewhat challenged when it comes to configuration.

WRT-router. Runs DD/Open-WRT very stable. 100 Mbit switch. 802.11.g Can do DHCP, firewall, NAT etc. Can choose subnet. Highly configurable.

I hope to be able to keep on the CG3100, for speed reasons and on the WRT-router for quota and user control reasons. On my network I plan on running servers for various services.

Should I turn of NAT on the WRT-router? Or on the cable modem? Activate what in that case? Is double NAT always f-ed up?

share|improve this question
this is a bit old. do you still want to achieve this? i know a way. – Mucker Jun 28 '11 at 13:23
@Mucker you and others that can should answer it anyway because it's for the database – barlop Sep 11 '11 at 19:56
  • setup CG3100 with NAT for to internet and WRT with NAT for to one address from only if the destination is not in space or else block all packets from to with state new
  • setup route for via WRT IP on CG3100 or static route on every host from (via DHCP if possible)
share|improve this answer

OK, Ill answer it then. The easiest and quickest solution is to use the CG3100 as the main router but change the subnet to the 192 one. Keep NAT enabled on it. Now configure the second router using the 10 range also using NAT. It is that simple. Why have I done it this way?

  1. You want the 192 accessible from the 10 range. By putting the 10 range behind the second NAT OUTBOUND connections are allowed. When a 10. IP tries to access 192 it is NATed through the WRT router and can access all 192 PC's and resources without any additional routing config or firewall config. As far as the WRT is concerned 192 IPs are external and most routers with NAT enabled allow all outbound access but block ALL incoming access by default. Which brings me onto point 2.

  2. You want the 10 range to be NON accessible from the 192 range. The default config for NAT is to block incoming connections so 192 can't get through the WRT to the 10 range as it will be blocked.

On my network I plan on running servers for various services.

This is also easily acheiveble. If you haven't noticed yet, in my solution your subnets are swapped so these servers will now be on the 192 range and since they are behind the first NAT device you eliminate any double NAT problems you may have came across.

I'm here all day! ;-)

share|improve this answer

I don't think it makes sense to say "X can reach Y, but not vice-versa". What would the point be of being able to reach a machine that couldn't reach you? How would you even know you had succeeded?

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .