I have one network 192.168.0.x which is slowly running out of IP addresses. I wanted to remedy this by creating a second network for mobile devices (192.168.1.x).

The first network has a gateway of and a subnet of

When I got to configure the second network (using an Apple Airport) I set its IP address to, its subnet to and its router and DNS to I also activated the DHCP-service for the range of - 200.

This seems to work fine, even though the I received a message that there was a "Double NAT" in the network. Furthermore it tells me "This AirPort base station has a private IP address on its Ethernet WAN port. It is connected to a device or network that is using Network Address Translation to provide private IP addresses. Change your AirPort base station from using DHCP and NAT to bridge mode."

But if I do this, it does not serve the purpose of the AirPort being a separate DHCP for the second address-range (192.168.1.x). Can I just ignore this error, or am I doing something wrong?



I also have noticed that if I now try to change anything about the DHCP or NAT setup on the AirPort I get the error message: "The DHCP range you have entered conflicts with the WAN IP address of your base station". It suggests for me to use as DHCP range, but that is not what I wanted. This kind of gives me the feeling that I might not have this set up correctly, even though it works - as I mentioned.

2 Answers 2


The message:

There is a "Double NAT" in the network. This AirPort base station has a private IP address on its Ethernet WAN port. It is connected to a device or network that is using Network Address Translation to provide private IP addresses.

is purely a warning message, which you can safely disregard altogether.

The annoying feature of this configuration is that none of the devices on the network will be able to talk to those on the network. In other words, right now they represent two distinct subnets. You may keep this configuration, if this is of no concern to you.

Alternatively, you may wish to integrate all of your components into a single subnet. You may obtain this in this way (the order of these operations matters):

1.connect to the Airport, and disable DHCP;

2.unplug the ethernet cable from the WAN side of the Airport, and plug it into the LAN side.

3.open the GUI of the main router, and change the mask of the LAN, from to

4.Turn off everything;

5.turn on the router, count to five, turn on all of the devices in whichever order.

By doing this, you will have established a twice-as-large network, with these properties (output of ipcalc):

# ipcalc
Address:          11000000.10101000.0000000 0.00000000
Netmask: = 23   11111111.11111111.1111111 0.00000000
Wildcard:            00000000.00000000.0000000 1.11111111
Network:       11000000.10101000.0000000 0.00000000
HostMin:          11000000.10101000.0000000 0.00000001
HostMax:        11000000.10101000.0000000 1.11111110
Broadcast:        11000000.10101000.0000000 1.11111111
Hosts/Net: 510                   Class C, Private Internet

This way you will have defeated the dearth of IP addresses, while still keeping all of your devices into the same subnet. Turning everything off and on again forces the introduction of the new mask, and the new routing table.

This works provided you do not have static IPs. If instead you do, you will have to manually adjust the mask to reflect its new value, on each device.

  • ipcalc is a really useful tool. Tossed it into /usr/local/bin on my OS X box. Thanks~! Oct 7, 2014 at 8:34

There isn't quite enough information on your post, I'm going to assume you have 2 network devices. One is connected to the ISP and the second is the AirPort.

It says you have a double NAT because you do in fact have a double NAT. This isn't generally a problem for standard web traffic, but if you have devices that use UPnP the ones on the inside of the second NAT won't be able to negotiate connections through two levels of firewalls.

The thing is it's completely unnecessary for you to add a second device, if you are running out of IP addresses in your private range then you can easily fix that by simply widening the address range on your primary device. If you change the subnet mask from to you will double the number of IP addresses in that range, and then you don't need to add a second device. You'll need to change the subnet mask on any manually configured network device, but anything that gets it's IP by DHCP will automatically update.

  • your assumption is correct. Internet -> 192.168.0.x -> Devices... and.... Airport (which handles 192.168.1.x) -> Devices.
    – Joseph
    Jan 22, 2014 at 14:09
  • As for the solution. I actually like the fact that the mobile devices (192.168.1.x range) can not access the devices in the 192.168.0.x range. The mobile devices are in a kind of guest-network which only needs standard web traffic. Routing from outside into the 192.168.1.x is not necessary.
    – Joseph
    Jan 22, 2014 at 14:13
  • Then the best way to do it is set up a second DHCP range and use bridging as suggested.
    – GdD
    Jan 22, 2014 at 14:21
  • The Apple Airport allows me to set a DHCP only, but it forces me into the 192.168.0.x range.
    – Joseph
    Jan 22, 2014 at 14:43
  • An Apple airport probably doesn't have the flexibility to do what you want. There are many product out there which can do bridging, I suggest you research what's available in your area.
    – GdD
    Jan 22, 2014 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.