@usslindstrom 

Consumer routers only have the ability for a single vlan. You would have to have a nic on the TP-Link subnet and set up default route to send traffic to that interface, then it would reach the internet, or otherwise tag the outgoing traffic for that subnet.

  @apila22 Understood, thank you for the response.

I'm not talking about additional VLANs on the device itself though, but rather this scenario:




In any other L3 device, you can easily add the additional subnets as the NAT SOURCE addresses, and the equipment includes those networks when it does the address translation.  TP-Link seems incredibly rudamentary here.

  @usslindstrom 

Is the L3 side of the blue line an IP on the TP Link subnet? Do you only have a static route on the L3 for the TP Link subnet? What happens if you add default route (0.0.0.0) on the L3 to the TP Link gateway address? TP Link already has its quad zero to the WAN. But no matter what, you are doing double NATing trying to use a consumer device like that.

Or set up quad zero to your WAN IP address and the WAN subnet to quad zero like the TP Link has, but my experience stops at basic routing tables. This would break every time ISP changes your IP unless you pay for static, which would be why default routing to the TP gateway would be safer.

You aren't trying to allow incoming internet traffic to the L3 just outgoing?

  @apila22 Negative, not double-nat.

The top circle is the BE800, the bottom is the other L3 device.  It's strictly routing.  The BE800 only allows NAT from its internal subnet, not from any route set on the internal L3.

Yes, the default route of the L3 device behind is pointing to the BE800.

All clients in any subnet behind the other L3 device can reach the BE800 without any issue.

The issue is that the BE800 only performs NAT on its locally defined subnet.  I can't see anywhere in the configuration to add additional nat sources.  All other consumer grade routers support this, just not the BE800 it looks like.

  @usslindstrom 

What other consumer grade routers support this?

  @jra11500 

Almost all.  Most don't even need configuration.

Packet received on the inside interface, the router uses its 0.0.0.0 route to forward out the packet where it gets nat'd.  A nat session is built.  Everything works.

But since you asked for an exact model, consumer grade...  Here's one of a thousand:  Ubiquiti Edge Router X.  A 50 dollar box of metal.