Discussion stats
  • 34 replies
  • 3494 views
  • 1 kudo
  • 7 in conversation
Announcements

Top Contributors
Reply
Highlighted
Aspirant

Double nat issue...

Hey rook here with a quick question... 

 

got a double nat warning on my Xbox one..

 

running my new Orbi connected to a modem/router combo from century link for my fiber. 

 

So I was doing some research and saw that you can do one of two things to resolve this.  

 

1. Bridge the modem/router.   Or

 

2. Add the Orbi’s ip Address to the modem/router dmz

 

i chose to do number two

 

went into my Orbi app to find out the up address.   I found it under router settings.

 

then I signed in to my modem/router and went to the dmz add area. There they have the empty boxes to enter the number, but they also have a drop down box with a list of your devices and their associated ip address.  But there the rbr20 is listed under a different IP address.  

 

Which do I use? Do I add the iPad address under router setting in the Orbi app or the one the stock router\modem listing ? 

 

 

Model: RBR20|Orbi AC2200 Tri-band WiFi Router
Message 1 of 35
Highlighted
Prodigy
Prodigy

Re: Double nat issue...

@BiGMERF, assuming you don't need Disney Circle or Armor features, there is a 3rd option, Orbi AP mode, which doesn't require you to tinker with your modem/router settings.  Putting the Orbi in AP mode will also shield it from external attacks, i.e., ports scan/sync attacks.

Message 2 of 35
Highlighted
Aspirant

Re: Double nat issue...

yes thank you, I am aware of AP mode.. only issue with that is you loos some features in the process... it also seemed like for some reason while in AP mode my devices where less likely to connect to the sattelites... 

Message 3 of 35
Highlighted
Aspirant

Re: Double nat issue...

Hi,

 

Rookie my self, and did the same experience 1-2 weeks ago, when i got my RBR20 + sat.

 

I did it from the modem(router).

 

The adress ORBI showed was the WAN adress.

In my modem the orbi was assigned a LAN adress, which i put into the DMZ.

Message 4 of 35
Highlighted
Virtuoso

Re: Double nat issue...

The best way to get help for this is from the forum community of your ISP.

 

In general, the host router should know what IP address it assigned to your Orbi so that would generally be the one to use.  But a more proper way to identify the Orbi is by its MAC address.  Arris routers for instance use MAC to identify the device to put into IP Passthrough mode which is another label for DMZ.  After the setting is applied, you may need to reboot the RBR50 to get it to pick up the new settings if it doesn't do it on its own.  You'll know it worked if the Orbi gets the public IP of your ISP connection.

Orbi RBK50 in AP mode, 100/20 Mbps VDSL2, Arris BGW210 gateway

Message 5 of 35
Highlighted
Guru

Re: Double nat issue...

What is the Mfr and model# of the ISP modem the NG router is connected too?

Modem Combo Units:
This would be a double NAT condition which isn't recommended. https://kb.netgear.com/30186/What-is-Double-NAT
Couple of options,
1. Configure the modem for transparent bridge mode. Then use the Orbi router in router mode. You'll need to contact the ISP for help and information in regards to the modem being bridged correctly.
2. If you can't bridge the modem, disable ALL wifi radios on the modem, configure the modems DMZ or IP Pass-Through for the IP address the Orbi router gets from the modem. Then you can use the Orbi router in Router mode.
3. Or disable all wifi radios on the modem and connect the Orbi router to the modem, configure AP mode on the Orbi router. https://kb.netgear.com/31218/How-do-I-configure-my-Orbi-router-to-act-as-an-access-point and https://www.youtube.com/watch?v=H7LOcJ8GdDo&app=desktop

 

Option #2 is recommended if you want to use the Orbi in router mode connected to a router upstream from the Orbi system. 

 


My Setup (Cable 900Mbps/50Mbps)>CAX80>Orbi RBK50 v2.5.1.16(Router Mode)
Additional NG HW: C7800/CM1100/CM1200, Orbi CBK40, Orbi RBK50/RBK853, R7800, R7960P, EX7500/EX7700, XR450 and WNHDE111
Message 6 of 35
Highlighted
Master

Re: Double nat issue...


@BiGMERF wrote:

............., but they also have a drop down box with a list of your devices and their associated ip address.  But there the rbr20 is listed under a different IP address.  

 

Which do I use? Do I add the iPad address under router setting in the Orbi app or the one the stock router\modem listing ? 


Please use the address that you find in the drop down menu for the DMZ settings. This is the address for Orbi in the ISP Router.

My Setup Internet Fiber ONT 250↓/250↑ISP Telenor | Wifi Router Orbi RBK50 AC3000, Router Mode, Wired Backhaul / Orbi RBK852 AX6000, Router Mode, Wireless Backhaul | Switches Netgear GS208Time Zone CET (Sweden)

Message 7 of 35
Highlighted
Aspirant

Re: Double nat issue...

Ok thank you. I did it and it seemed to fix the issue at least on my Xbox. When I run a cmd check. Two ip’s still pop up.

Also whenever I try to use remote connection via my cell phone outside of my home network. I get that it’s not currently online. It I know it is. Any ideas ?
Message 8 of 35
Highlighted
Prodigy
Prodigy

Re: Double nat issue...


@BiGMERF wrote:

yes thank you, I am aware of AP mode.. only issue with that is you loos some features in the process... it also seemed like for some reason while in AP mode my devices where less likely to connect to the sattelites... 


Yes, you are right.  If you must have a feature that's not available in AP mode, Router mode is a good choice.

 

Orbi will eventually redirect all clients to the correct/nearest Satellites, unless there's a weak signal problem with that particular Satellite.  I always leave my setup alone overnight after Orbi reboots/restarts for the dust to settle.  If my clients are not connected to the expected Satellite in the morning, it means that I need to look into that Satellite to ensure that it still provides proper WiFi signal in its area of coverage.

 

When you put the Orbi in Router mode, you might want to look into changing these NAT options:

  • If you are using VOIP, on the WAN Setup page, disable SIP ALG by selecting Disable SIP ALG.
  • If you are having problem with playing game on the console, you could try changing NAT filtering from Secured to Open.

 

NAT Filtering

This option determines how the router deals with inbound traffic. The Secured option provides a secured firewall to protect the PCs on LAN from attacks from the Internet, but it may cause some Internet games, point-to-point applications, or multimedia applications not to work. The Open option, on the other hand, provides a much less secured firewall, while it allows almost all Internet applications to work.

Message 9 of 35
Highlighted
Virtuoso

Re: Double nat issue...

Remote connection has to be enabled via the management console. It hasn’t worked for me in the past 2 firmware updates. .32 and now .44

Orbi RBK50 in AP mode, 100/20 Mbps VDSL2, Arris BGW210 gateway

Message 10 of 35
Highlighted
Prodigy
Prodigy

Re: Double nat issue...


@BiGMERF wrote:
... When I run a cmd check. Two ip’s still pop up.

Is it trace route or some other cmd?  For the two IPs, are they both private IPs (10.0.0.x or 192.168.1.x) or one of them is private and the other is a public WAN IP from your ISP?

 

In this same setup:

  • What's the IP of the HUB?
  • What's the IP of Orbi WAN interface?
  • What's the IP of Orbi WiFi client?
  • What's the IP of Orbi LAN client?

The IP information above will provide a better idea of your current NAT/DMZ setup.

Message 11 of 35
Highlighted
Aspirant

Re: Double nat issue...

Management console ? Do you mean pc hardwired to the Orbi ?

Message 12 of 35
Highlighted
Aspirant

Re: Double nat issue...

Cancel that.  Got remote management to work 

Message 13 of 35
Highlighted
Prodigy
Prodigy

Re: Double nat issue...


@BiGMERF wrote:

Management console ? Do you mean pc hardwired to the Orbi ?


I could be mistaken, but I suspect it's referring to "Remote Management" in Orbi Advanced Setup.

Message 14 of 35
Highlighted
Prodigy
Prodigy

Re: Double nat issue...


@SW_ wrote:

@BiGMERF, assuming you don't need Disney Circle or Armor features, there is a 3rd option, Orbi AP mode, which doesn't require you to tinker with your modem/router settings.  Putting the Orbi in AP mode will also shield it from external attacks, i.e., ports scan/sync attacks.


Just a data point.  An example of the type of regular attacks on my RT-AC87U router.  Fortunately, both username/password can be changed on this router, which isn't the case with Orbi.  The risk with Orbi in Router mode is a bit higer than AP mode setup b/c the default "admin" username can't easily be changed for example.  WIth that said, it doesn't mean that Orbi in Router mode isn't safe!

 

Apr 21 17:14:10 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 22 16:50:31 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 23 07:07:17 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 24 10:16:29 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 24 15:11:14 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 25 00:40:14 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 25 14:52:05 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 25 19:26:05 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 26 05:08:07 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 27 23:33:30 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 28 04:21:26 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 29 13:02:51 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 29 17:40:36 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 29 22:25:29 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 30 03:04:12 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
...

May 8 05:02:40 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
May 8 09:11:50 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
May 8 19:54:31 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.116.170.72 in login.
May 8 19:59:16 HTTP_login: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in auth check.

Message 15 of 35
Highlighted
Aspirant

Re: Double nat issue...

sw_

 

iwas using the  "tracert 8.8.8.8" in CMD..

 

This morning its coming back with only one IP.. So i guess I did it right..

 

is it true i now have an opened window for an outside attack ?

Message 16 of 35
Highlighted
Virtuoso

Re: Double nat issue...


@BiGMERF wrote:

 

is it true i now have an opened window for an outside attack ?


Someone else raised this question in another forum.  The assumption is the Orbi has necessary router functions such as advanced  firewall to live on the open internet safely.  For instance, I see DOS attacks logged and presumably the Orbi is able to handle the condition. 

Orbi RBK50 in AP mode, 100/20 Mbps VDSL2, Arris BGW210 gateway

Message 17 of 35
Highlighted
Guru

Re: Double nat issue...

So what did you do to get things working? 


@BiGMERF wrote:

Cancel that.  Got remote management to work 


 


My Setup (Cable 900Mbps/50Mbps)>CAX80>Orbi RBK50 v2.5.1.16(Router Mode)
Additional NG HW: C7800/CM1100/CM1200, Orbi CBK40, Orbi RBK50/RBK853, R7800, R7960P, EX7500/EX7700, XR450 and WNHDE111
Message 18 of 35
Highlighted
Aspirant

Re: Double nat issue...

Pulled search on here and found a that worked.
When I get home I’ll check to see if i can find it and I’ll place the link here.
Message 19 of 35
Highlighted
Guru

Re: Double nat issue...

Smiley Wink


My Setup (Cable 900Mbps/50Mbps)>CAX80>Orbi RBK50 v2.5.1.16(Router Mode)
Additional NG HW: C7800/CM1100/CM1200, Orbi CBK40, Orbi RBK50/RBK853, R7800, R7960P, EX7500/EX7700, XR450 and WNHDE111
Message 20 of 35
Highlighted
Aspirant

Re: Double nat issue...

Here ya go

 

1. Open the app

 

2. Tap The Home Icon (no text just a little picture of a house, on iphone this is in the upper left hand corner)

 

3. Tap settings (Little gear icon, next to the word 'Settings')

 

4. Tap 'Remote Management'

 

5. Toggle Remote Management to off.

 

6. Toggle Remote Management to on.

 

That should do the trick, Hope this helps! 

Message 21 of 35
Highlighted
Guru

Re: Double nat issue...

Thank you. Please mark your thread as solved so others will know. 

 

Enjoy. Smiley Wink


My Setup (Cable 900Mbps/50Mbps)>CAX80>Orbi RBK50 v2.5.1.16(Router Mode)
Additional NG HW: C7800/CM1100/CM1200, Orbi CBK40, Orbi RBK50/RBK853, R7800, R7960P, EX7500/EX7700, XR450 and WNHDE111
Message 22 of 35
Highlighted
Prodigy
Prodigy

Re: Double nat issue...


@BiGMERF wrote:

sw_

 

iwas using the  "tracert 8.8.8.8" in CMD..

 

This morning its coming back with only one IP.. So i guess I did it right..

 

is it true i now have an opened window for an outside attack ?


Congart!  You did it right!

 

Yes.  That's exactly right.  An example on the regular attacks on my RT-AC87U router, which shields my Orbi.  Fortunately, both the usename/password can be changed on this router.  You just have to monitor the Orbi logs.  If the Orbi starts having problems due to external attacks, only then you should consider putting in AP mode.

 

Apr 21 17:14:10 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 22 16:50:31 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 23 07:07:17 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 24 10:16:29 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 24 15:11:14 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 25 00:40:14 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 25 14:52:05 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 25 19:26:05 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 26 05:08:07 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 27 23:33:30 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 28 04:21:26 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 29 13:02:51 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 29 17:40:36 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 29 22:25:29 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
Apr 30 03:04:12 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.

May 8 05:02:40 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
May 8 09:11:50 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
May 8 19:54:31 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.116.170.72 in login.
May 8 19:59:16 HTTP_login: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in auth check.
May 9 08:03:32 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.

Message 23 of 35
Highlighted
Prodigy
Prodigy

Re: Double nat issue...


@BiGMERF wrote:

sw_

 

iwas using the  "tracert 8.8.8.8" in CMD..

 

This morning its coming back with only one IP.. So i guess I did it right..

Yes, you did it right.  Congrat!

 

is it true i now have an opened window for an outside attack ?


Yes.  It's one of the disadvantage of Orbi Router mode, which exposes it to external attacks.  Just monitor the Orbi logs, if the Orbi starts giving you problem, only then you should consider switching to AP mode.

...

May 8 05:02:40 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
May 8 09:11:50 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.
May 8 19:54:31 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.116.170.72 in login.
May 8 19:59:16 HTTP_login: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in auth check.
May 9 08:03:32 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 200.107.254.70 in login.

...

There attacks happen more often and more frequent than in the past.  Fortunately, both usename/password can be changed on my router.

 

Message 24 of 35
Highlighted
Prodigy
Prodigy

Re: Double nat issue...

@BiGMERF wrote:

iwas using the  "tracert 8.8.8.8" in CMD..

 

This morning its coming back with only one IP.. So i guess I did it right..

Yes, you did it.

 

@BiGMERF wrote:

is it true i now have an opened window for an outside attack ?

Yes.  It's one of the disadvantage of Orbi Router mode, which exposes it to external attacks.  Just monitor the Orbi logs, if the Orbi starts giving you problem, only then you should consider switching to AP mode.

Message 25 of 35