Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've got a relatively complex home office/small office network -- I use two NAT (Network Address Translation) routers/firewalls to provide a DMZ (DeMilitarized Zone) for a cheap sacrificial web server. Basically, I don't want compromise (a.k.a. pwnage) of the web server to easily allow access to the PCs on the private network. Here's a simple diagram of how I have things set up:

  INTERNET --- External NAT Router --- Internal NAT Router --- Private LAN  
                         |  
                    WWW Server

The external router allows ports 80 and 443 in, forwarded to the web server. The internal router allows nothing in. Theory: if the web server gets compromised, the private LAN PCs are still protected by the internal router.

Forward: I recently purchased an Apple Airport Extreme to replace the existing internal NAT router. When I plugged the new Airport Extreme into the external router, the Airport Utility complained during setup that I was using a "Double NAT" configuration. I was puzzled -- I've never seen such a message from a router before and have never experienced a problem with a double NAT setup. I've been on a double NAT setup for years.

So, why is double NAT bad enough that my Airport Extreme wants to warn me about it and suggest using bridged mode instead? Putting the obvious performance/latency considerations aside, why would NAT on top of NAT be a bad thing? Thanks!

share|improve this question

4 Answers 4

up vote 5 down vote accepted

I actually had an analogous error occur in my setup recently when I reconfigured it due to a gear swap.

The double-NAT message is designed as a warning of a possible pathological network setup, but I think it's irrelevant, especially as you say you've been running this setup for a while. In fact, many ISPs are using NAT these days on their DSL or cable modems, where each customer is already "behind the router", so to speak, even with a single device connected directly to the modem. As soon as the customer adds a wireless router for their home, they are in a double-NAT situation. And that seems to be working just fine for most people, obviously.

According to my research, it seems as though there are some applications, largely industrial-grade VPNs and other applications that manipulate data at the lower layers of the OSI stack that might hiccup if they start poking around inside the packets. A particular Cisco VPN + Firewall setup is one example I came across. As another example, the reliability of certain implementations of VoIP in a double-NAT environment seemed to be a matter of some debate.

As you point out, it will almost certainly will introduce some small amount of additional latency due to the extra hop and the work being done by each router, but unless you're a competitive gamer... meh.

Edit: As Kevin points out below, UPnP is also likely to freak out in a double-NAT scenario, but the Airport Extreme which prompted the question doesn't support UPnP anyway.

share|improve this answer

This configuration would trip up any application that uses UPnP. This gives application software the ability to ask the router what the external IP is, and open up ports on the router. Applications running on the internal network would not be able to "see" the second router to open up ports on it.

This is probably not a big concern for you, since you are trying to make sure nothing can get in to your internal network.

share|improve this answer

It is very difficult for home class devices to be able to handle this type of scenario because it is effectively changing out the addresses at each router.

I would recommend reconfiguring your network into several logical segments instead of trying to maintain the same address space.

So for your external address going to the net, use whatever your ISP assigns to you. For your network between the two devices use a subnet that is not in use on your private lan.

An example would be use no NAT between the two devices. Use real private addresses. For instance configure each router on the 172.16.1.1 for the outside router's inside interface and use 172.16.1.2 for the internal router's outside interface.

Then configure the two devices to route to one another taking sure to correctly specify the next hop.

The outside router needs to know how to reach the inside of your network and the inside needs to know where to route packets going to the outside. You can still use NAT but you want to not use NAT between the two devices themselves.

I hope this helps some

share|improve this answer
3  
Why would it be "very difficult" ..? Each router is theoretically ignorant of the other. As far as each is concerned, it is the only router and the WAN interface is the Internet, even though that's only true for one of the routers. So... puzzled still: Why would two NAT routers cause problems? I certainly see how your proposed solution avoids the double NAT, but I'm still not clear on why double NAT would be bad to begin with. –  Chris W. Rea Aug 1 '09 at 23:21

In some cases, the Airport Extreme / Express identification of a Double NAT as a problem is plain wrong.

I'll explain:

I have an ATA (Analog Telephone Adapter) which is a VoIP-based landline which uses your existing Internet connection. The landline provider puts that ATA before your router, configures it to connect to the Internet, lets it do some QoS (take away some bandwidth so your phone calls will always come through) and gives the rest to your router. I've chained my Airport Express after such an ATA, and the Airport Express warned me of "Double NAT".

Actually, this wasn't a problem. The ATA will only give the Airport Express an IP address (192.168.2.2), which is mapped 1:1 to the real (external) IP address (1.2.3.4). All of the external ports of 1.2.3.4 are passed to the internal 192.168.2.2. When your Airport Express does NAT, there's nothing wrong. For example, if it wants to expose 10.0.0.5:5555 externally, then:

1.2.3.4:555 —(ATA)→ 192.168.2.2:5555 —(router)→ 10.0.0.5:5555

When Airport Express sees "192.168.x.x" on the WAN port, it automatically cries "Double NAT!". Whether it's a problem or not depends on the circumstances.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.