I've split this into a new thread since this part of the discussion was off-topic in its original thread.
I'll try to clarify routing, NAT masquerading, and double-NAT for @Edrikk and @FredCailloux .
Routing
Routing is literally about specifying the routes that traffic should take to get from one network to the next. This may or may not include NAT masquerading.
It's really similar to how you might take a route when going to the store or work or whatever.
However, all your local device and local router needs to know is the 'next hop' gateway. That is to say: your computer wants to access something that is not on its local network. Based on the specified router/gateway (and routing table), it will send the the traffic to the gateway which is "gateway to the next network." When there is response traffic from the distant host, the router will help direct the packets back to the original host.
In the case of all routing, it is required that each network is a unique/non-overlapping subnet -- routing doesn't work properly if any two networks have the same or overlapping
network range. The simplified analogy -- you have been given an object and told to give it to a person named Jody - that's all you know. You walk into a room and there are two or more people named Jody. How do you know which one is the right Jody? Instead, if everyone in the room has a unique name, there is no ambiguity and things go where they need to go.
NAT Masquerading:
The idea behind Network Address Translation / masquerading is fairly simple -- one or more networks (consisting of any number of devices) behind a router can share a single upstream IPv4 address. In the case of normal consumer/residential applications, this is the normal operation for a router -- the ISP gives the subscriber a single IPv4 address. The router itself takes this address on the wan interface and shares that with the devices behind the router. It does this by creating a private network (in the RFC1918 address ranges that are not routable on the public internet) for the lan(s) that then masquerade as the single wan IP. In this way, the NAT masquerading layer is translating the singular external address into an entire network behind the router such that the upstream network sees all the traffic as originating from (and going to) one device -- the router.
A simple analogy: you might send physical mail to a business - let's say the billing department. You don't need to know where the billing department is located within the company's building(s) -- you just address the envelope to the street address for the company and the mailroom takes care of distributing mail to the various people/departments within the company... they can have a "private" addressing system for within the buildings, but you don't need to worry about any of that... all of the employees/departments masquerade behind a single mailing address for the company.
NAT masquerading doesn't exclusively need to be used for public IP addresses -- it's really just a method of sharing a single outward facing address with an entire network.
Double NAT
This is just the idea of putting two NAT masquerading routers in cascade. Basically the lan on the first router is connected to the wan of the second. The devices behind the second router will have 2 hops to get to the egress point towards the internet vs just one for the devices behind the first router. In this case, just as with all routing, each network must be non-overlapping such that routing can function properly. And all devices behind the second router will be masqueraded as the address of the second router itself (as a function of the address it holds on the first router's lan).
Double NAT is not ideal, but is not always a problem. It does break things like UPnP (automatic port forwarding) and some older VPN protocols, but most modern traffic can traverse double NAT without issue.
Where two router devices are used in this type of cascade topology, there are three ways to avoid double NAT:
- if the intent is to make one contiguous network, configure the second router as a dumb AP, thereby not using its routing functions and not causing a double NAT scenario.
- If 2 or more unique networks are desired and the first router supports multiple subnets/VLANs, setup the additional network(s) on the main router and use the second router as a dumb AP/managed switch (assuming the 2nd router supports VLANs).
- Disable NAT masquerading on the second router (if that setting is exposed to the user) AND set static routes on the first router. For example:
- The first router's lan network is 192.168.1.0/24
- The second router has address 192.168.1.2 on its wan
- The second router's lan is 192.168.5.0/24
- To enable the traffic to flow back and forth properly, we set a route in the first router that looks like this:
192.168.5.0/24 via 192.168.1.2
Does that help explain routing/NAT/Double-NAT?