THE DREADED DOUBLE NAT

NAT is a good thing, so double NAT must be better, right? Not really.

Double NAT normally happens when you connect a device with router functions to a network that already has a router – for example, you might find that the only way to get a new Wi-Fi 6 router on to the internet is to plug it into your old ISP-provided router.

A double-NAT configuration means that you end up with two devices handing out IP addresses. This isn’t a disaster. The secondary router won’t assign addresses that clash: if the old router is issuing addresses in the 192.168.0.x range, the new one might use the 192.168.100.x range. And the two routers should be able to pass packets between themselves so that all systems can talk to one another and get on to the internet.

Double NAT can create problems, though. Since the secondary router doesn’t have its own external IP address, nothing connected to it can receive incoming connections. UPnP won’t help, as the computer running the application isn’t directly connected to the router that’s connected to the internet. Similarly, QoS features that aim to prioritise particular clients or traffic types can get confused, since the primary router can’t probe devices connected through the secondary one. And while NAT itself doesn’t open up any network vulnerabilities, it does mean you need to stay on top of security settings and patches for two routers instead of one.

There are a few possible solutions. Many routers and mesh systems offer a bridge mode, which effectively turns them into network extenders for the primary network: this lets you use their wireless capabilities, but advanced features such as parental controls or network security scanners are normally disabled.

Alternatively, you can manually configure port forwarding to direct incoming traffic on selected ports from the primary router to the secondary one. Again, though, you’ll need to configure this twice, so that the secondary router forwards connections on to the appropriate client.