My network just got more complicated recently after I had to add a router from my ISP because I want to use their optical telephone service, provided by the router 1:

the poor quality picture I drew

In the manual it says that the router should be connected directly to WAN, leading to the topology shown in the picture.

The problem is, I want to continue using my own router as much as possible (VPN, DHCP, DDNS, etc.), and I want to be able to continue using the VPN server in router 2, and I want the devices in the LAN to be able to access each other.

After many hours of struggling, I was able to get all the devices connected to the Internet with the following setup:

Router 1 (RT-S300NE by NTT East-Japan)

  • IP: (uses the DHCP of router 2. in
  • Netmask:
  • DHCP off
  • PPPoE settings for my ISP

Router 2 (ASUS RT-AC68U)

  • IP:
  • Netmask:
  • Gateway:
  • DNS:
  • DHCP on
  • (disabled WAN, NAT, and PPPoE settings from this one)

However, the devices in the LAN are not able to connect each other. Pinging my PC from my laptop gives "Request timed out.". Weirdly, I can access both routers without issue. I have a feeling that the issue is related to NAT settings, but I don't quite know what I should do. If I remove the gateway setting from router 2. the problem disappears but then my PC and laptop lose connection to the Internet (can still connect to both routers and other local devices).

I decided to go with a setup where the routers are connected via LAN ports instead of connecting router 1.'s LAN to router 2.'s WAN. I don't think bridge mode is possible for router 1., but it does have DMZ and virtual DMZ setting options. However, I'm not quite sure how DMZ works or whether I should or shouldn't use it.

The main thing is that I need the VPN of router 2. and I need to be able to access router 1. via that VPN. I would also like to use the DDNS service of router 2., but currently I get error "The wireless router (i.e. router 2.) currently uses a prive WAN IP address. This router may be in the multiple-NAT environment and DDNS service cannot work in this environment"

Is it possible to get VPN and DDNS working the way I want? What settings should I change?


What you tried to configure is doable, but inconsistent with your drawing and your requirements to use Router 2 as a boundary separating your LAN from WAN.

Router is a device which routes packets between two (or more) distinct networks.

Each of your routers must have thus at least two interfaces with IP address in separate networks.

Take a simple approach and consider each of the two routers as having LAN and WAN interfaces.

  • Router 1 WAN is connected to NTT
  • Router 1 LAN is connected to Router 2 WAN (only)
  • Router 2 WAN is connected to Router 1 LAN (only)
  • Router 2 LAN is connected to your devices

Currently your Router 2 LAN interface is in network, which is how you access it from your other devices. You should leave it as is, so that you don't have to reconfigure the devices.

Router 2 "LAN" interface:

  • IP:
  • Netmask:
  • Gateway: none
  • DHCP server: on

Now you must configure a new network for the connection between your Router 1 WAN and Router 2 LAN.

It cannot be network, as you already use it on your LAN interface. /24 has the same meaning as netmask and means the network is defined by the first three segments in dotted notation. So you must use for example network.

Router 1 "LAN" interface (physically connected to the Router 2):

  • (static)

Router 2 "WAN" interface

  • (static)
  • Gateway

VPN, DNS, DDNS do not matter for IP connectivity.

You can also use DHCP for the network between routers instead of static.

You can configure it in other ways, but first, I believe, you must get your words to be consistent.

  • "Router is a device which routes packets between two (or more) distinct networks." I might have explained my setup confusingly as I do not have lot of experience setting up networks, but I think you got my point that I want to use router 1. only for WAN access and router 2. for handling my LAN. So I guess I would like router 1. to work as a simple bridge between WAN and router 2. However, it doesn't have such bridge settings (at least not as an easily understandable menu). – Kitanotori Dec 12 '16 at 12:07
  • What I advised is a simple, straightforward configuration, on which you can build something secure. What you suggest is non-standard, unnecessarily complicated, and insecure. It can be done, but as you noticed yourself not easily; and for a good reason. – techraf Dec 12 '16 at 12:12
  • Can't get the setup you described working (no internet and no access to router 1. from devices connected to router 2.). – Kitanotori Dec 12 '16 at 13:26
  • Of course there will be access from devices to both routers and to internet. What I described is exactly for this purpose. Why do you claim otherwise? – techraf Dec 12 '16 at 13:28
  • Okay, I got it working. Had to enable NAT in router 2. and remove gateway settings from DHCP page (the old IP pointing to remained). Strangely the network speed dropped to slightly above 100mbps for router 2. devices whereas I get 500mbps speeds from a device connected to router 1. All ports in both routers support 1Gbps so I guess I still have some routing issue... – Kitanotori Dec 12 '16 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.