Use One-to-One NAT to eliminate double NAT

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

Use One-to-One NAT to eliminate double NAT

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Use One-to-One NAT to eliminate double NAT
Use One-to-One NAT to eliminate double NAT
2023-10-07 23:14:01 - last edited 2023-10-13 01:19:47

Hello,

 

Would appreciate any solid advice as to whether or not using one-to-one NAT could eliminate double NAT to solve a VPN connection issue, or if one-to-one NAT is still NAT, leaving the issue of double NAT.

 

Network:  Firewalla Gold (Router mode) >> ER8411 (Router mode) >> Switch >> Work PC 

                                       - private networks between Firewalla and ER8411 (.10.0) and on my LAN behind the ER8411 (.20.0)

 

The PC needs to be able to utilize a VPN back to my company's office; this is the only issue I'm having and this PC is the only client that I need to resolve double NAT for.

 

Will using one-to-one NAT on the ER8411 for the PC (use its .20.x IP address as both the Original and the Translated IP addresses) and then putting a static route on the Firewalla for routing .20.x traffic back to the ER8411's .10.0 interface work?  Would enabling DMZ forwarding be needed?

 

So that we don't go down any rabbit holes:

 

     - NAT can't be turned off on either the Firewalla or the ER8411.

     - I can only pull one public IP address from my ISP, so I can't put the Firewalla into bridge mode.

     - I don't have the wiring / infrastructure to connect the PC directly to the Firewalla to eliminate the double NAT.

     - I would like to keep both the Firewalla and the ER8411, with the ER8411 at the edge of my LAN.

 

Again, any experts out there, I welcome your advice.

 

Thank you

  0      
  0      
#1
Options
1 Accepted Solution
Re:Use One-to-One NAT to eliminate double NAT-Solution
2023-10-11 05:40:10 - last edited 2023-10-12 19:07:06

  @Lee21 Based on my understanding, it is not possible to eliminate NAT by using One-to-One NAT. One-to-One NAT is a type of NAT that allows for a one-to-one mapping between the WAN port and the LAN port. In contrast, regular NAT can enable one-to-many mapping from the WAN port to the LAN port. However, it is worth considering using VPN directly as it is a more secure option compared to NAT.

Recommended Solution
  1  
  1  
#2
Options
4 Reply
Re:Use One-to-One NAT to eliminate double NAT-Solution
2023-10-11 05:40:10 - last edited 2023-10-12 19:07:06

  @Lee21 Based on my understanding, it is not possible to eliminate NAT by using One-to-One NAT. One-to-One NAT is a type of NAT that allows for a one-to-one mapping between the WAN port and the LAN port. In contrast, regular NAT can enable one-to-many mapping from the WAN port to the LAN port. However, it is worth considering using VPN directly as it is a more secure option compared to NAT.

Recommended Solution
  1  
  1  
#2
Options
Re:Use One-to-One NAT to eliminate double NAT
2023-10-11 12:29:56

  @barrolete:  thank you for your response, and that makes sense. It also sounds like I will still have double NAT even if I use the DMZ function on the ER8411 router for the one PC that I need VPN functions for.  

 

I am still researching why double NAT causes problems with VPN connectivity to possibly indicate what a solution may be, besides fully eliminating it.

 

 

  0  
  0  
#3
Options
Re:Use One-to-One NAT to eliminate double NAT
2023-10-12 07:22:50

  @Lee21 VPN and NAT are two different concepts, so what's wrong with your network that needs to eliminate NAT to complete the VPN setup?

  0  
  0  
#4
Options
Re:Use One-to-One NAT to eliminate double NAT
2023-10-12 19:06:14

  @barrolete The double NAT is preventing my being able to connect to my work VPN. I confirmed this by connecting my laptop directly to Firewalla and then removing the Firewalla and connecting the laptop directly to the ER8411.  In both instances, double NAT was eliminated and I could connect via VPN. 

 

My company's IT department has also confirmed that double NAT will cause issues with our VPN, so I'm going to see if I can get another cable run to my home office so that I can connect the laptop directly to the Firewalla. 

 

I appreciate your help on this.  

  0  
  0  
#5
Options