Topology: Incoming Traffic > Modem > Router > Switch > Rest of Network In this image, notice IEAS-FILESVR, incoming traffic goes to the modem/router "IEASOFFICE" into the switch, to the FILESVR through the opened ports, but due to the double NAT conflict between the modem and router, the ports cannot be opened.

enter image description here

A DMZ is set up in the modems setup page, allowing the router to appear as the Modems WAN IP outside the firewall. With this enabled or disabled, the ports still remain closed. NAT Themselves are both enabled on the modem and router, as when they're disabled on either of them, the connection to the internet is lost.

The modem (ActionTec R1000H) is ISP supplied and cannot be replaced, as they do not support any non-ISP supplied modem, and the router in question is the TP-Link TL-ER604W.

In the modems "Port Forwarding" tab, the ports 443 and 80 are opened on the IP of IEAS-FILESVR, the ISP is not blocking these ports from being opened, when using an online port checking tool, port 23 is the only one that appears open, and nowhere is it being told to be opened. In the "Port Triggering" section of the TP-Link, ports 443 and 80 are triggered to open when they receive incoming traffic.

An attempt was made to solve this problem by using a PPPoE network between the modem and router, but failed. Firewalls have been disabled to see if they cause or contribute to the problem.

How can this double NAT between the modem and router be fixed? As disabling NAT on one or the other does not work.

  • What is the connectivity between the modem and router? There shouldn't be any need to route between these two devices, and so no need for double NAT. – Paul Jul 21 '15 at 13:25
  • @Paul An Ethernet cable is connecting between a Modem LAN port and the Routers WAN port. This network setup was done by a company who seems hesitant to send someone over to help us, which is why I'm here. – Keagan Dalley Jul 21 '15 at 13:27
  • Do you know what function the router is providing? If the is layer 3 connectivity between the modem and router, which there must be for the router to NAT, then the modem is also a router. Which means you should be able to just remove the router and connect the switches to the modem. – Paul Jul 21 '15 at 13:29
  • @Paul So it appears the the router is allowing people to connect to the network over wireless (We use a switch for wired connections) and the modem is what gives everyone the connection to the internet, so without the modem we cannot reach the internet, and without the router nobody can connect to the network via wireless. It appears the modem doesn't support doing what the router is on it's own. – Keagan Dalley Jul 21 '15 at 13:38
  • Ok, what you need to do is turn off DHCP on the router, and give it an address in the same range that the WAN port gets when it connects to the modem, then connect the modem to the LAN port, not the WAN port. This will give you a single network across wifi and lan and modem. Then change the DHCP scope on the modem to exclude the IP you gave the router. Every one will get their IP address from the modem, including wifi people. – Paul Jul 21 '15 at 13:41

With the help of Paul, I have found the problem. The ActionTec gateway and the router were the cause of the double NAT (obviously), so I have put the router into the ActionTec's DMZ, so everything from the router is forwarded to the ActionTec. Although this may not be the most organized or best solution, it did what it was supposed to do. Removing the router entirely was another option but due to the already established DHCP servers and Ethernet setups in the building, that would cause to much grief.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.