akaggie05 said:
I'm having ATT Fiber installed next week. From reading ahead to plan for my install, it sounds like the standard equipment they give out now is the BGW320. If you want to use your own router behind it, you need to put it in "IP Passthrough" mode, otherwise you'll end up with a double NAT scenario. This can sometimes cause issues.
I've had far more problems with "IP Passthrough" aka "Bridge Mode" than with having nested NAT devices.
First, I run a small wireless ISP. We don't have enough IP addresses to go around and so we use CGN (Carrier Grade Nat) for that. Our outer firewall can pass traffic straight through to routable IP addresses and can NAT the CGN addresses.
The CGN addresses should eliminate the possibility of a NAT device having the same IP address block (or overlapping IP address blocks) on both WAN and LAN. No customer should ever use a CGN address block (in the 100.64/10 range) on their own network. Also, the firewall has a pool of routable addresses for the CGN to use.
Each customer gets a /24 block in the CGN space. For example, one customer might have 100.99.0/24 and the customer next door might have 100.98.7/24.
Our customers have a radio to communicate with our access points. Our access points are in bridge mode, but the CPE radios are rarely in bridge mode. Then the customer will generally have their own router behind the radio.
---
The three primary issues that I've seen arise are:
1) You don't want to have the same or overlapping IP blocks on both side of the router. If you do, then the router does not know how to route the traffic and you cannot connect. Since most home routers seem to have a default LAN IP address in the 192.168.0/24, 192.168.1/24, 192.168.2/24, and 192.168.88/24 blocks, we use an entirely separate LAN IP block on our CPE radios.
So far, this has never presented an issue for us.
2) The WAN port on the inner router must be plugged into a LAN port on the outer router. If you plug it into the LAN port on the inner router instead, anything plugged into the inner router may or may not work, depending on whether it receives it's IP address from the inner router or the outer router. For example, if the outer router has the LAN address 172.20.76.1 in the 172.20.76/24 block and the inner router has the LAN address 192.168.1.1 in the 192.168.1/24 block, then any device plugged into them may either get an address in the 192.168.1/24 block if it gets it from the inner router DHCP or in the 172.20.76/24 block if it gets it from the outer router DHCP. If it is in the 192.168.1/24 block, the router won't be able to route it to the first router and so it won't work. If it is in the 172.20.76.24 block then most routers will pass it along fine.
Also, if you connect to the router using wifi, the IP address you will get will be in the 192.168.1/24 block and the router will not be able to route the traffic at all.
This presents an issue for us maybe once every year or two. We can often see it by looking at the DHCP tables on the radio since only the router entry should have an entry. If we see for cell phones, computers, tvs, ..., then it is normally plugged in wrong and easy to fix. If we also see an entry for the router itself, then it might be in bridge mode.
3) As far as I'm concerned, the biggest pain in the ass, by far, is having a router set up in bridge mode. It can really contemplate figuring out what is wrong. If there is something with the outer NAT device and it stops passing IP addresses, then your inner NAT device is either not going to have an IP address or it will have a fallback IP adddress that may or may not be easy to find.
Or it might be that the cable went bad -- you wouldn't believe how many people think that if they damage the cable, it is enough to just wrap the pairs together (and sometimes even splitting pairs). The worst I've seen was by an electrician who thought that ethernet was like telephones and tried to run an ethernet cable from point A to B, another from point B to C, and another from point C to D and then wirewrapped the pairs together. That was very puzzling to figure out what he had done.
If you have a problem and the router is configured in Bridge Mode, you have a few possibilities:
A) Hopefully you set a fixed IP address on the device and wrote it down on a label and attached it to the router. Of course, if that fixed IP address on the device is not in the IP address block of the outer NAT device, then it isn't going to be able to automatically update the firmware.
B) If you don't have the foresight to assign a fixed IP address and write it on a label, you can try guessing. This usually isn't worth the effort.
C) Or you can press the red button to reset the router to factory defaults and then reconfigure it normally.
D) You should be able to plug a laptop or computer into the outer router and check the DHCP table to find the address.
E) If D doesn't work, then you might need another router that you can take out of the closet, plug in the router you can't reach, plug in a laptop or desktop, and check the DHCP table on it. Hopefully, this router is not in bridge mode.
F) If all else fails, throw the router away and go buy a new one.
---
In our case, there is another reason not to put the router in bridge mode. If the router is one that we maintain for the customer, the CPE radio outside the house or business may itself be in bridge mode. If that is the case and you change the router to bridge mode, then all your devices will receive CGN addresses. This complicates the issue even more.
---
So if you set your router in bridge mode, you can make life simpler if you assign it a fixed IP address, preferably in the same block assigned by the outer NAT device, and write the IP address and block on a label and attach it to the router. For example, if you give it 192.168.1.76 in the 192.168.1/24 block, then write "192.168.1.76/24" on the label. It may make your life far simpler.