4

We've got an ISP provided docsis modem / router.

We can place the modem / router in modem only mode and use our own router of choice which is what we do.

The ISP pushed a firmware update which means that the modem drops out for 5 mins every hour, they dont have a fix for this yet other than put the unit back into router + modem mode.

Will having 2 routers wired as router -> router -> switch cause issues on the network ?

Things we have setup currently on our router :

  • VLANS
  • VPNS
  • FIREWALL
  • MAC TO IP BINDINGS
  • QOS
  • 5
    You’ve left a lot of details open to guess. There are obvious things that will happen, but we don’t know your level of understanding to know if the obvious needs to be said. Port forwarding will break, double NAT will happen, IPSec VPNs will break, some additional latency will be introduced, etc. – Appleoddity Mar 2 '18 at 15:27
  • can you turn off DHCP on the second router? – Journeyman Geek Mar 2 '18 at 15:34
  • @JourneymanGeek i can, but the second router is our main router, with our Mac to IP bindings and everything else setup on, id prefer to turn on the DHCP on the ISP provided router - would that help ? – sam Mar 2 '18 at 16:02
  • You will be fine with QOS, VLANS, MAC bindings. In principle, you need firewalling only on the innermost router. It will simplify configuration to turn the firewall off from the ISP provided router. Regarding VPN, if you are connecting to a remote openvpn server, it will work fine, even with double NAT. – Strangelovian Mar 2 '18 at 16:26
10

It will work correctly for basic internet access, such as displaying internet web sites in a browser.

More "advanced" use cases may break because of double NAT (with IPv4). It still a concern today, since IPv4 is far for being phased out. For example, you will have trouble to have UPNP working correctly. You will also need to configure DNAT (Destination NAT) rules twice on both routers.

One possible fix is to use the DMZ mode of the ISP provided device. This will greatly simplify UPNP and DNAT configurations.

  • 1
    I've run like this for a couple years. ISP modem/router with my router behind it with my router configured as being in the DMZ. Haven't noticed any major problems with it once set. You might need to change the address range of one of the routers if they are both defaulting to 192.168.1.x as having them both set to the same thing might not work. I changed my ISP router to 192.168.10.xxx – Evan Steinbrenner Mar 2 '18 at 19:18
2

The answer is almost always "yes", but you need to give more details, otherwise answers can only be vague.

While your question is about chaining routers, which works (apart from possible care needed over double NAT), the solution seems unnecessarily complicated. You might want to go for a much more direct and simple solution.

What we need to know, to say more, is - country, ISP, connection media (fibre, copper, dedicated link, whatever), the internet connection type on that media (ADSL, ADSL2, VDSL,...) that's actually coming into the premises, and what modem/router equipment the ISP and you, have connected to it. If you can add a photo of any label and the ISP box, that would also help.

The reason being that, it may well be that the ISP modem is itself a poor choice and you should get a different one, which solves your issue much more directly. All *DSL and fibre connectivity rends to be quite standardised, so if your current ISP box isn't doing what you need, or gets disruptive updates, it is quite/very likely that you can keep their box safe in case you ever need to show or return it, and but a cheap different box that does the job you need without disruption.

(Also as a slight digression, many ISP provided routers are often "cheap" models. I don't know if that's the case for you, but it's worth bearing in mind. They routinely have shocking security lapses (plenty of research on this - Google it) including in some cases "well known" backdoors/unsecured internet-side admin logins, they run on lowish power CPU/RAM compared to what one might actually want to use, which limits connection capabilities, and updates may only be for a limited period. This night not apply to you, but I wouldn't treat one as secure or use it for routing, I'd always pass through directly to a capable trustworthy device.)

Coming back to your situation, I had a similar issue (UK, fibre link, VDSL). I replaced the ISP router with a plain VDSL modem, backed by a software router ("pfSense") that's cheap, extremely powerful, almost certainly a ton more secure (FreeBSD + open source + security audits), and gets continual updates long past the point where an ISP product would get none. The router automatically handles the PPPoE and CHAP authentication required by my ISP, and even on a 15 year old P4 it's still probably way more powerful than any consumer router so it never slows or drops connections due to lack of resources. Its been a stable setup for maybe 8 years now, with no issues at all, and I basically forget about it for months at a time between config modifications and updates. I have a lot more confidence in it than I would have in any ISP supplied router.

The ISP router is in a store cupboard in case they ever need it back, or if there's a fault and they won't repair unless its a problem on their equipment too, but those are the only situations its used, and its been used maybe once, perhaps twice, in all that time, to check if a fault would still be present when their equipment was used - it was. Once the fault was fixed it went back in storage and my usual equipment was reconnected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.