I have my internet at home through a configuration with two separate routers:

  1. RouterA. This is a router provided by my ISP.
  2. RouterB. This is an intermediary router that provides a wireless network for all my devices.

This setup looks as shown in below image:

router setup

RouterA is configured with "Enable DNS Relay" set to true and currently it is providing the internal IP addresses for all devices, including RouterB.

This setup is working fine so far, and I like the fact that I can access both RouterA and RouterB from my PC (without having to walk to either router and connect to it with some direct cable) because they both have an internally accessible IP.

The question I wanted to ask is about the "NAT Mode" option on RouterA.

The NAT Mode provides following alternative options:

  1. RoutedWithNat
  2. Bridged
  3. RoutedWithoutNat

The explanations about these provided by RouterA look as shown below.

routing options

Currently the NAT Mode in RouterA is set to the default value which is "RoutedWithNat".

As stated above, RouterB provides the wifi network and all devices connect to it (no devices are directly connecting to RouterA).

  1. What would be the consequences for IP addressing and connectivity if NAT Mode was set to "Bridge" or "RoutedWithoutNat"?
  2. In what kind of use scenarios would someone want to use "Bridge" or "RoutedWithoutNat"?

1 Answer 1


Let us assume you are trying to reach the NYTimes, www.nytimes.com.

Routing with NAT means that your router will send your packets on to its gateway (routing) while re-writing the source address (which originally is your IP address) to its own (WAN!) address (this rewriting is NAT). The reason for this is that your router's upstream router does not know of your existence, it only knows the IP address of the WAN interface of your gateway, so, when it will have to relay back the NYTimes' reply, it will be able to let you have it if and only if it can first reach your router/gateway. All along, the gateway keeps track of all packets sent, so that when it gets a reply from the NYT it knows it has to send it to you, not to your wife's pc.

This is how a gateway works: the gateway joins two distinct subnets.

You might have decided that you wanted to use your ISP-supplied gateway as the gateway for your whole LAN, providing routing, DHCP and DNS services. In this case, how would you have had to configure your routerB? Well, in this case its role would have been simply that of passing packets on to their intended recipients. This is the scenario under which you would want to have the Bridged configuration: packets would be routed and NATted by routerA, and routerB would just pass them along. The fact that routerB also acts as an AP (access point) changes nothing. Probably, this would be the fastest configuration because you would drop one layer of NATting, but I doubt that, nowadays, this would make much difference.

The third scenario, routing without NAT, comes in handy when, once again, the LAN is controlled by your routerA (including DHCP, DNS, and routing), but for some reason you want some of your packets not to be routed the traditional way, but thru some other complex scheme: for instance, if you wish to use some kind of proxy that makes it look like you are in some far and remote place. Or. alternatively, you might setup a proxy on routerB which filters out porn sites and Facebook, so as to protect your children.

In either case, you would want some pcs to go the usual route, while others should be going thru the proxy: then you have all of these machines routed by routerB thru the proxy. There is no need for the reply packets to be NATted, because the reply packets do not need to be acted upon by routerB, so they may just as well come to you directly without further delay. RouterB would be acting then as a pure router, not a gateway, because it is not separating two distinct subnets.

What would happen to your communication?

In the first case, if you were to pass routerB suddenly into Bridged mode, for about an hour it would disrupt communications (because most machines still act with the old IP address, which however however does not have a router any more); this period ends when the lease of the IP address ends, about 1 hour later for many LANs. Then all machines will ask for a renewal of the lease, but will find a new DHCP server which will give them new IP addresses. Then everything will start working again. You must remember, though, to disable the DHCP server on routerB: though this stands to reason, it is not necessarily automatic.

In the second case, the answer is exactly the same, whether you enable connection via a proxy or not.

  • Thank you for the detailed answer, @MariusMatutiae. But why should the DHCP server on routerB be disabled in "bridged" mode?
    – x457812
    Nov 30, 2015 at 15:02
  • 1
    @x457812 In bridged mode, router B belongs to the same subnet as routerA. But you cannot have two DHCP servers on the same subnet, because they will often collide, and create numerous problems. They might be dishing out the same IP address to two different pcs for instance: when routerA gives it to pc1, routerB does not know the number is taken, so it might give it to pc2. And now that is bound to disrupt communications. Nov 30, 2015 at 15:06
  • ah ok thanks @MariusMatutiae. I didn't realize that you were speaking of having routerB in "bridged" mode. In my original question the bridged mode option was in routerA.
    – x457812
    Nov 30, 2015 at 15:10
  • 1
    @x457812 Sorry, I mixed them up. But what I said applies perfectly, just replace routerB with routerA, and routerA with the (hidden to you) router uostream of routerA. Nov 30, 2015 at 15:17
  • cool, thank you @MariusMatutiae. Much appreciated.
    – x457812
    Nov 30, 2015 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.