NAT masquerading and double NAT

Unless I’m misunderstanding, what you have described is very suboptimal as it introduces double NATing.

ie Your Pi get a public IP from your router’s WAN, and then in turn gives a LAN IP (let’s say 192.168.1.44) to your Netgear (WAN). Then Netgear gives LAN IPs to your devices.

Again I may have misunderstood.

Lost in translation.

The Pi is using ethernet to the wan port on the NETGEAR R6200, the Pi is connected to the ISP modem.
They never say the netgear is doing any Nat and high end Netgear routers can be changed from wan to lan or if left in stock firmware(as suggested with
"And I didn't have to brick the NETGEAR") and put in bridge mode they will treat the wan port as just a special port to expect internet and not try to broadcast to it like normal switches do across their lan.

And, seriously: Only gamers care about double natting, any router under 10 years old just accepts it because so many ISPs combine modems with routers and don't have true passthrough. Maybe they have DMZ.

But Goggle translate sucks, so misunderstood understood.

I'm not knowledge enough to completely grasp your description bit from what I remember, the Pi4 Ethernet jack is programmed as a DHCP server and the NETGEAR gets his address from the Pi4, something like 10.X.X.5
The ISP modem also serve as a DHCP server. The address is something like 10.K.K.1 and serves anything from 10.K.K.2 up to 10.K.K.250
So the Pi4 USB3<->Ethernet adapter is the "WAN" side, attributed his address from the Modem, anywhere from K.2 to K.250. I think it was 10.K.K.101.
For some reason that is beyond my technical knowledge, it works quite OK.
I did that with the help of a friend who knows a thing or two with the intricate details of how DHCP and Routers work.

You are in bridge mode with stock Netgear firmware? It is not double natting.

1 Like

Yes, the NETGEAR has the original firmware intact.

1 Like

It is all good.

Double natting is pedantic.

It is cause of trouble for gamers.

Travel routers can be triple and quad natted in a hotel.

Can you pls briefly describe what is double natting ?

You have an address to the internet that is public.

You have 100 devices behind that and they cannot use one address,
So the router (literally, its why it is named a router) routs or gives all 100 a private address and translates/sorts/routes packages to the correct device.

This is called Network Address Translation. NAT.

Double natting is when a router in front hands a router a private address and that needs to be routed with another set of numbers. Double natted.

1 Like

Double natting would mean that the router would give two addresses to the same device ?

No, I cleaned it up

1 Like

I've split this into a new thread since this part of the discussion was off-topic in its original thread.

I'll try to clarify routing, NAT masquerading, and double-NAT for @Edrikk and @FredCailloux .

Routing
Routing is literally about specifying the routes that traffic should take to get from one network to the next. This may or may not include NAT masquerading.

It's really similar to how you might take a route when going to the store or work or whatever.

However, all your local device and local router needs to know is the 'next hop' gateway. That is to say: your computer wants to access something that is not on its local network. Based on the specified router/gateway (and routing table), it will send the the traffic to the gateway which is "gateway to the next network." When there is response traffic from the distant host, the router will help direct the packets back to the original host.

In the case of all routing, it is required that each network is a unique/non-overlapping subnet -- routing doesn't work properly if any two networks have the same or overlapping
network range. The simplified analogy -- you have been given an object and told to give it to a person named Jody - that's all you know. You walk into a room and there are two or more people named Jody. How do you know which one is the right Jody? Instead, if everyone in the room has a unique name, there is no ambiguity and things go where they need to go.

NAT Masquerading:
The idea behind Network Address Translation / masquerading is fairly simple -- one or more networks (consisting of any number of devices) behind a router can share a single upstream IPv4 address. In the case of normal consumer/residential applications, this is the normal operation for a router -- the ISP gives the subscriber a single IPv4 address. The router itself takes this address on the wan interface and shares that with the devices behind the router. It does this by creating a private network (in the RFC1918 address ranges that are not routable on the public internet) for the lan(s) that then masquerade as the single wan IP. In this way, the NAT masquerading layer is translating the singular external address into an entire network behind the router such that the upstream network sees all the traffic as originating from (and going to) one device -- the router.

A simple analogy: you might send physical mail to a business - let's say the billing department. You don't need to know where the billing department is located within the company's building(s) -- you just address the envelope to the street address for the company and the mailroom takes care of distributing mail to the various people/departments within the company... they can have a "private" addressing system for within the buildings, but you don't need to worry about any of that... all of the employees/departments masquerade behind a single mailing address for the company.

NAT masquerading doesn't exclusively need to be used for public IP addresses -- it's really just a method of sharing a single outward facing address with an entire network.

Double NAT
This is just the idea of putting two NAT masquerading routers in cascade. Basically the lan on the first router is connected to the wan of the second. The devices behind the second router will have 2 hops to get to the egress point towards the internet vs just one for the devices behind the first router. In this case, just as with all routing, each network must be non-overlapping such that routing can function properly. And all devices behind the second router will be masqueraded as the address of the second router itself (as a function of the address it holds on the first router's lan).

Double NAT is not ideal, but is not always a problem. It does break things like UPnP (automatic port forwarding) and some older VPN protocols, but most modern traffic can traverse double NAT without issue.

Where two router devices are used in this type of cascade topology, there are three ways to avoid double NAT:

  1. if the intent is to make one contiguous network, configure the second router as a dumb AP, thereby not using its routing functions and not causing a double NAT scenario.
  2. If 2 or more unique networks are desired and the first router supports multiple subnets/VLANs, setup the additional network(s) on the main router and use the second router as a dumb AP/managed switch (assuming the 2nd router supports VLANs).
  3. Disable NAT masquerading on the second router (if that setting is exposed to the user) AND set static routes on the first router. For example:
  • The first router's lan network is 192.168.1.0/24
  • The second router has address 192.168.1.2 on its wan
  • The second router's lan is 192.168.5.0/24
  • To enable the traffic to flow back and forth properly, we set a route in the first router that looks like this:
192.168.5.0/24 via 192.168.1.2

Does that help explain routing/NAT/Double-NAT?

1 Like

@FredCailloux mistakenly called his router/modem combo a modem.

He is already double natted. But not because of his network setup.

Considering the translation issues and just basic understanding I was as pithy and concise as I could be without... ...doing the job as well as you did.