Is double NATing a problem?

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › Is double NATing a problem?

AndyT

18 posts

Geek

Topic # 108777 5-Sep-2012 13:51

As per my other recent postings, I run a Draytek Vigor120 modem currently in standard modem mode behind a Netgear WNDR4500 wirless router. I'd switch to PPPoE pass through mode, but the downside of that is losing the web interface to the V120. Conversley, the downside of sticking with the standard modem mode is that I'm double NATing.

The question is whether double NATing is (i) a significant / fundamental / performance degrading problem that ought to be avoided if at all possible, or (ii) something I needn't worry about in everyday domestic use with a few wired and wireless devices around the house being used for web browsing, emails, Skype VOIP and the occassional media streaming?

Is there a clear answer on this, based on which I can make the decision in which mode to run the V120?

1 | 2

4230 posts

Uber Geek
+1 received by user: 1124

Reply # 681818 5-Sep-2012 14:19

Double NAT is not ideal, however if you are predominantly using outgoing connections - web browsing, email etc, you'll probably be just fine.

A friend of mine set up his home this way several years ago (had been donated some equipment, and wanted to use it!), and it's been no problem.

I've not used a WNDR4500 - is it possible to put this in bridge mode or similar, so only the Draytek is doing NAT?

Ragnor

8020 posts

Uber Geek
+1 received by user: 384

Trusted

Subscriber

Reply # 681824 5-Sep-2012 14:29

Short Answer: Use PPPoE passthrough and add a static route in the Netgear so it knows how to get to the modem ip address range so you can access the web admin.

Ragnor

8020 posts

Uber Geek
+1 received by user: 384

Trusted

Subscriber

Reply # 681828 5-Sep-2012 14:34

Long Answer:

NAT

Network address translation breaks end to end connectivity.

Without "tricks" a client behind NAT on one connection can't connect to a a client behind NAT on another connection directly.

An application acting as a server listening for connections behind NAT won't receive any connections unless the router has a port forward to pass them on.

This doesn't really effect general web browsing or email because you are connecting to a hosted server that's not behind NAT.

Over time other client to client (or p2p) applications have worked around this by using a server as the middle man, (eg: messenger, skpye etc) register with a server on the internet first and then either proxiy the connection between the two clients via the server or match make the ports being used by the connection (outgoing connections put records in your routers NAT table) so direct communication can occur.

Additionally UPNP and NAT-PMP protocols were invented so clients/apps could dynamically request routers forward ports allowing apps to wait for connections and actually receive them behing NAT

Double NAT

If port forwarding manually you have to port forward twice in two devices, from modem to router and then from router to pc/device

You can see how double NAT would prevent UPNP and NAT-PMP from working because your app will only request a port be forwarded in the router not in the modem.

This mostly affects p2p and gaming, most console games use a p2p system for match making and hosting. If you are behind NAT and UPNP/NAT-PMP can't open a port you can't host very well and as above behind NAT can't join behind NAT hosts.

It can also affect VPN client software, some VoIP protocols, FTP

theEd

341 posts

Ultimate Geek
+1 received by user: 26

Trusted

Reply # 681859 5-Sep-2012 15:11

Considering the very minor nuisance of not being able to access a web interface in which no settings take effect anyway, I don't think it's a remotely tough decision. Use passthrough, avoid Double NAT.

cisconz

cisconz
1153 posts

Uber Geek
+1 received by user: 76

Trusted

Subscriber

Reply # 681916 5-Sep-2012 16:48

You should only need to look at the web interface of the DV120 when there is something wrong, so use passthrough

Hmmmm

Zeon

3347 posts

Uber Geek
+1 received by user: 359

Trusted

Reply # 681940 5-Sep-2012 17:40

Double NAT will add to latency (although not much) but will be mostly noticable in real time traffic like VOIP, online games, skype etc.

chevrolux

2992 posts

Uber Geek
+1 received by user: 829

Subscriber

Reply # 681972 5-Sep-2012 19:18

Ragnor: Short Answer: Use PPPoE passthrough and add a static route in the Netgear so it knows how to get to the modem ip address range so you can access the web admin.

+1

There is nothing stopping you seeing the stats page. Just add a static route.

AndyT

18 posts

Geek

Reply # 682077 5-Sep-2012 23:31

Thank you all .... looks like it's a "no brainer" ...... pass-through + static route.

richms

19660 posts

Uber Geek
+1 received by user: 3489

Trusted

Subscriber

Reply # 682084 6-Sep-2012 00:03

Double nat will totally break upnp on the network, even if you DMZ the second router, it still doesnt know what the external IP address is.

Richard rich.ms

AndyT

18 posts

Geek

Reply # 682313 6-Sep-2012 13:27

Forgive me for perhaps asking a dumb question as a newbie .... but where do I configure the Telecom NZ settings for VPI / VCI / Encapsulation / Modulation? .... assuming they are still necessary in passthrough mode. I'm assuming it's not in the V120 modem, but I can't see where in the WNDR4500 router settings that I would do this.

Zeon

3347 posts

Uber Geek
+1 received by user: 359

Trusted

Reply # 682354 6-Sep-2012 14:25

No those VPI/VCI you set in the Draytek

AndyT

18 posts

Geek

Reply # 682800 7-Sep-2012 13:18

OK ...thanks

DrStrangelove

368 posts

Ultimate Geek
+1 received by user: 1

Reply # 682985 8-Sep-2012 01:25

Just as a voice from the other side, I'd say NAT'ing and double NAT are not an issue if you have a 'known' environment and are able to provide the required services without issues.

I would not spend money just to half-bridge/bridge to a firewall/router unless there was a reason to do so and/or NAT'ing gave you problems.

I have a TP-LINK 8840, 8840T, Linksys WAG120N and Thomson TG585v8.

The TP-Link 8840 can provide a half-bridge and I seem to remember setting it up as such as a test ages ago.

But the 8840 and 8840T have a slow ADSL2 speed, down 1Mbit (download) on the Linksys WAG120N and Thomson TG585v8 in my environment. (I can spit onto the VDSL2 boundary [sigh] but miss out re: distance to exchange)

So in my case half-bridge and lose 1Mbit and VLANs or use NAT and gain 1Mbit and in the case of the Thomson TG585v8, VLANs.

I use my Thomson TG585v8 as a modem/router and have configured VLANs on it and as such a half-bridge is not an option. By having VLANs on my modem I can 'fork' traffic to my private and/or guest LAN routers depending on usage and never the two networks will meet at the network layer.

My NAS is accessible via WiFi to guest network(IP network) if required.

There are services to provide Global to Private IP addresses in the form of DDNS and all of the TCP/UDP ports I use operate effectively using NAT (mainly PPTP and OpenVPN) and even PAT**.

25 - 30ms response time using ADSL2+ and NAT over ~100km to speedtest.net server is not bad in my book.
The 30ms is using a notebook on WiFi 15m from the router.

** TP-Link 8840 TCP/UDP port addressing probably stops at somewhere around 4096, so using PAT on high ports (6000+) to 'well known' ports does not work. BUT it does work on a TG585v8 ;-)

nakedmolerat

4305 posts

Uber Geek
+1 received by user: 799

Trusted

Reply # 682986 8-Sep-2012 03:01

^as above

I have run double NAT in the past for many years until I bought DGND3700 2 years back. For games, I forwarded both routers. As long as it does not cause any trouble, you can keep the current setup.

Ragnor

8020 posts

Uber Geek
+1 received by user: 384

Trusted

Subscriber

Reply # 684007 10-Sep-2012 17:40

nakedmolerat: ^as above

I have run double NAT in the past for many years until I bought DGND3700 2 years back. For games, I forwarded both routers. As long as it does not cause any trouble, you can keep the current setup.

Not so bad for 1 game, 1 player but it compounds the more games and players you have behind the double NAT.

I would argue manually port forwarding twice for every port that needs to act as a server and every player behind the double NAT is tiresome and annoying. Also means you have to use static ip addressing for clients or at least static by mac address.

1 | 2