I have my airport mac thing complaining about double NAT.
My network looks fine indeed.
My question is a bit more on the security side:
How can a double NAT be detected?
In pricinple all devices should be network agnostic.
And even if, why it should be an issue? For this last question I admit there might be some configuration issues if you administer one of the double NAT.
52 Answers
'Tracert' (Trace Route) command will show if you have a double NAT. e.g. tracert 8.8.8.8. You will see more than one hop with a private IP address. Note that this assumes small office / home networks where every router applies NAT. Corporate networks may have more hops and you'd need to do more testing to figure out which hops apply NAT.
An example of something double NAT detectably breaks is UPnP (Universal Plug and Play) Port Forwarding. When a device on your network requests a temporary port forward rule from your router, it won't work right because the upstream router also needs to forward the port. The device will know something is wrong because the router replied that it granted to port open request, but the port still isn't open from the internet. The device can guess that you are in a double NAT situation.
You can also get IP address range overlaps in double NAT situation. It could be impossible for the inner and outer network to communicate with each other because they use the same IP ranges and are thus indistinguishable. Internet may still work on the inner network depending on how smart the inner router is.
The major reason double NAT is not desirable is devices in the outer network cannot initiate a connection to devices in the inner network. Actual routing (e.g. static routes) allows bidirectional communication.
6The only time I've seen double NAT is when you connect a home router to a second home router - this can be done if you route an ethernet cable from the first routers output into the WAN input of the second router.
Generally, you don't want to be on a double NAT because it requires a second jump to get out to the WAN. Also, it can affect UPNP which allows video games and other applications to automatically port forward which improves performance.
To detect double NAT, you should use the trace route command. Open PowerShell and run this command
tracert google.comIf the first two hops start with 192, then you have a double NAT.
To get rid of this second NAT in this scenario, you'll want to turn the second router onto "Bridge Mode", which basically turns off DHCP. This way, you wont have two separate entities issuing IP addresses, and your local network will be one network.
If you have a need to separate your local network into sub-networks, you will need a router that supports VLAN (Virtual Local Area Network). You'll likely need a commercial grade router to do this; a lot of home routers do not support this feature. They don't expect the average consumer to be network engineers.
