0

I have one network 192.168.0.x which is slowly running out of IP addresses. I wanted to remedy this by creating a second network for mobile devices (192.168.1.x).

The first network has a gateway of 192.168.0.1 and a subnet of 255.255.255.0.

When I got to configure the second network (using an Apple Airport) I set its IP address to 192.168.0.3, its subnet to 255.255.255.0 and its router and DNS to 192.168.0.1. I also activated the DHCP-service for the range of 192.168.1.2 - 200.

This seems to work fine, even though the I received a message that there was a "Double NAT" in the network. Furthermore it tells me "This AirPort base station has a private IP address on its Ethernet WAN port. It is connected to a device or network that is using Network Address Translation to provide private IP addresses. Change your AirPort base station from using DHCP and NAT to bridge mode."

But if I do this, it does not serve the purpose of the AirPort being a separate DHCP for the second address-range (192.168.1.x). Can I just ignore this error, or am I doing something wrong?

Thanks

// EDIT

I also have noticed that if I now try to change anything about the DHCP or NAT setup on the AirPort I get the error message: "The DHCP range you have entered conflicts with the WAN IP address of your base station". It suggests for me to use 192.168.0.2-200 as DHCP range, but that is not what I wanted. This kind of gives me the feeling that I might not have this set up correctly, even though it works - as I mentioned.

2

The message:

There is a "Double NAT" in the network. This AirPort base station has a private IP address on its Ethernet WAN port. It is connected to a device or network that is using Network Address Translation to provide private IP addresses.

is purely a warning message, which you can safely disregard altogether.

The annoying feature of this configuration is that none of the devices on the 192.168.0.0/24 network will be able to talk to those on the 192.168.1.0/24 network. In other words, right now they represent two distinct subnets. You may keep this configuration, if this is of no concern to you.

Alternatively, you may wish to integrate all of your components into a single subnet. You may obtain this in this way (the order of these operations matters):

1.connect to the Airport, and disable DHCP;

2.unplug the ethernet cable from the WAN side of the Airport, and plug it into the LAN side.

3.open the GUI of the main router, and change the mask of the LAN, from 255.255.255.0 to 255.255.254.0.

4.Turn off everything;

5.turn on the router, count to five, turn on all of the devices in whichever order.

By doing this, you will have established a twice-as-large network, with these properties (output of ipcalc):

# ipcalc 192.168.0.0/23
Address:   192.168.0.0          11000000.10101000.0000000 0.00000000
Netmask:   255.255.254.0 = 23   11111111.11111111.1111111 0.00000000
Wildcard:  0.0.1.255            00000000.00000000.0000000 1.11111111
Network:   192.168.0.0/23       11000000.10101000.0000000 0.00000000
HostMin:   192.168.0.1          11000000.10101000.0000000 0.00000001
HostMax:   192.168.1.254        11000000.10101000.0000000 1.11111110
Broadcast: 192.168.1.255        11000000.10101000.0000000 1.11111111
Hosts/Net: 510                   Class C, Private Internet

This way you will have defeated the dearth of IP addresses, while still keeping all of your devices into the same subnet. Turning everything off and on again forces the introduction of the new mask, and the new routing table.

This works provided you do not have static IPs. If instead you do, you will have to manually adjust the mask to reflect its new value, on each device.

  • ipcalc is a really useful tool. Tossed it into /usr/local/bin on my OS X box. Thanks~! – Trane Francks Oct 7 '14 at 8:34
1

There isn't quite enough information on your post, I'm going to assume you have 2 network devices. One is connected to the ISP and the second is the AirPort.

It says you have a double NAT because you do in fact have a double NAT. This isn't generally a problem for standard web traffic, but if you have devices that use UPnP the ones on the inside of the second NAT won't be able to negotiate connections through two levels of firewalls.

The thing is it's completely unnecessary for you to add a second device, if you are running out of IP addresses in your private range then you can easily fix that by simply widening the address range on your primary device. If you change the subnet mask from 255.255.255.0 to 255.255.254.0 you will double the number of IP addresses in that range, and then you don't need to add a second device. You'll need to change the subnet mask on any manually configured network device, but anything that gets it's IP by DHCP will automatically update.

  • your assumption is correct. Internet -> 192.168.0.x -> Devices... and.... Airport (which handles 192.168.1.x) -> Devices. – Joseph Jan 22 '14 at 14:09
  • As for the 255.255.254.0 solution. I actually like the fact that the mobile devices (192.168.1.x range) can not access the devices in the 192.168.0.x range. The mobile devices are in a kind of guest-network which only needs standard web traffic. Routing from outside into the 192.168.1.x is not necessary. – Joseph Jan 22 '14 at 14:13
  • Then the best way to do it is set up a second DHCP range and use bridging as suggested. – GdD Jan 22 '14 at 14:21
  • The Apple Airport allows me to set a DHCP only, but it forces me into the 192.168.0.x range. – Joseph Jan 22 '14 at 14:43
  • An Apple airport probably doesn't have the flexibility to do what you want. There are many product out there which can do bridging, I suggest you research what's available in your area. – GdD Jan 22 '14 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.