connecting RBR50 to ISP supplied modem/router using layer 2 bridge?

Question

I'm not very knowledgeable with networking but hopefully someone can confirm that I'm heading in the right direction... For many years I've had an RBR50 plus three satellites happily connected to a VDSL modem provided by a previous ISP.

As of today, I have a new ISP and when the hardware (THG3000) they sent me arrived it became clear that there was no bridge mode in their setup menu. I do need to keep their modem/router as it's the only way to connect our telephones via voip now that the POTs service is dicontinued. But I'm not prepared to put the Orbi into AP mode as I need the guest network. Naively connecting the Orbi WAN port to one of the THG3000 LAN ports taught me all about "double NATing" so I'm not going there again either.

So I began to research Layer 2 bridging and it seems like there are switches that can link two routers without any NAT or routing between them. Is this correct? I think the Netgear GS105Ev2 switch can provide this function. If I bought one and plugged the WLAN cable from the Orbi into one port and connected another to a LAN port on the THG3000 would that allow the Orbi to function as the router like it used to?

CrimpOn · Answer

Sorry. The issue is that in router mode, the THG3000 creates a LAN for user devices, which creates the Double NAT.&nbsp; Does your usage include the specific applications that are affected by Double NAT?&nbsp; Such a device will not help.
&nbsp;
Putting an Orbi system into Access Point (AP) mode does not eliminate the Guest WiFi option.&nbsp; What it does is eliminate the separation feature.&nbsp; Rather than being placed into a separate IP subnet where they cannot communicate with each other or with devices on the primary network, they are placed in the same IP subnet.
&nbsp;
If you want the Guest network simply to have a method to allow "guests" to access the WiFi and to be able to change the password without affecting the dozens of WiFi gizmos around the house, then AP mode does what you want.
If you want Guest network as some sort of security scheme, then no.

AdrianM · Answer

Thanks for the info. I really&nbsp;do need separation as I keep all my untrusted cloud stuff (Chinese light bulbs) on the guest network. They're all spread out over our two buildings hence having three Orbi RBS50 satellites in addition to the RBR50 base.&nbsp;Now I'm puzzled because I thought&nbsp;OSI model&nbsp;layer 2&nbsp;network bridges acted as transparent connections between Ethernet segments. I thought they learned the MAC addresses of devices on each segment and forwarded traffic between them based on MAC. This way, all devices on both segments appeared to be on the same local network, without the need for any NAT or routing. You seem to be saying there will still be double NAT when using such a bridge?

FURRYe38 · Answer

Your ISP Modem already has a built in router and wifi. This would be a double NAT (two router) condition which isn't recommended. https://kb.netgear.com/30186/What-is-Double-NAT
https://kb.netgear.com/30187/How-to-fix-issues-with-Double-NAT
Couple of options,
1. Configure the modem for transparent bridge or modem only mode. Then use the Orbi router in router mode. You'll need to contact the ISP for help and information in regards to the modem being bridged correctly.
2. If you can't bridge the modem, disable ALL wifi radios on the modem, configure the modems DMZ/ExposedHost or IP Pass-Through for the IP address the Orbi router gets from the modem. Then you can use the Orbi router in Router mode.
3. Or disable all wifi radios on the modem and connect the Orbi router to the modem, configure AP mode on the Orbi router. https://kb.netgear.com/31218/How-do-I-configure-my-Orbi-router-to-act-as-an-access-point and https://www.youtube.com/watch?v=H7LOcJ8GdDo&app=desktop
Try option #2 first...
https://kb.netgear.com/000061277/Which-features-are-disabled-on-my-Orbi-router-when-it-is-set-to-AP-Mode

CrimpOn · Answer

AdrianM&nbsp;wrote:
Now I'm puzzled because I thought&nbsp;OSI model&nbsp;layer 2&nbsp;network bridges acted as transparent connections between Ethernet segments. I thought they learned the MAC addresses of devices on each segment and forwarded traffic between them based on MAC. This way, all devices on both segments appeared to be on the same local network, without the need for any NAT or routing. You seem to be saying there will still be double NAT when using such a bridge?

Yes, a layer 2 bridge is equivalent to an Ethernet cable.&nbsp; It has no knowledge of layer 3, which where IP addresses exist.&nbsp; When the Orbi WAN port makes a DHCP request, the upstream router returns information:

Use this IP address.
Use this subnet mask
The Gateway IP for any destination not on this subnet is MY IP ADDRESS.
The default DNS IP is MY IP ADDRESS.

Both the Orbi WAN port and the upstream router are in the same IP subnet.&nbsp; It doesn't matter if they are connected with a physical cable, a layer 2 switch, a MoCA connection, a PowerLine connection.&nbsp; They all appear to both ends of the connection as an Ethernet cable.
&nbsp;
This kind of sinks the idea of putting the Orbi into AP mode. (Lack of network separation).
&nbsp;
I appreciate the fixation over Double NAT. What is not clear is if your internet use is affected by Double NAT.&nbsp; Thousands of customers simply unbox their new WiFi mesh system (Google Mesh, eero from Amazon, Asus, TP-Link, ... and Netgear), plug it into whatever thingy their ISP installed, and "off they go".&nbsp; In my neighborhood at least, a significant number of them do not even change the WiFi credentials from what was printed on the label.&nbsp; They have a Double NAT. Don't know what that is. And don't care.
&nbsp;
Do you:

Want access to LAN resources from the internet (access media server when not home? operate a public web site? want to view security cameras without using the vendor "cloud"?)
Want to use a VPN tunnel to reach the Orbi router when not at home?
Do internet gaming that requires you to forward ports through the router so that your home computer can at as a gaming server?&nbsp; i.e. the game will not work unless you forward ports?

All of those things are possible with a Double NAT, but are more complicated to set up and manage.

AdrianM · Answer

FURRYe38&nbsp;will look into option 2&nbsp;but ISP kit is extremely dumbed-down so not too hopeful about setting up DMZ.&nbsp;&nbsp;CrimpOn&nbsp;Thanks again for the extra detailed explanation. Indeed I'm not in need of (or inclined) to access my LAN over a public IP or domain. So double NAT might be OK for me. What put me off is that when I tried it, the Orbi reacted by setting the subnet to 10.0.0.x and as I have lot's of home-brew IoT with baked-in IP's for various things running on local servers (there's around 30 reserved mappings for&nbsp;MAC to fixed IP to in the Orbi) and I don't want to re-flash a lot of embeded firmware. The Orbi looked like it was doing its best to honor the mappings by keeping the last byte of the IP though.&nbsp;If I could somehow keep the same IPs handed out by the Orbi via DHCP then I'd be OK with this solution. I think I can change the IP address range for the ISP gateway DHCP and I did notice that it can also reserve specific IP's for&nbsp;connected device MACs. I just had to quickly revert to my old router/modem setup to keep the heating and lights going - so I hadn't looked into it further&nbsp;🙄

Forum Discussion

connecting RBR50 to ISP supplied modem/router using layer 2 bridge?

6 Replies