ASUS RT-AC66U Double NAT issue

[ddawko]

Hello guys,

I know this issue has been talked about many times, however I did find some answer but no solution to this issue, so I would need some step by step assistance for a numb like me.

I have a router/modem from my ISP that I can't control anyhow and I connected ASUS RT-AC66U wireless router. I do have a static IP address.

I have a WAN IP obtained from DHCP. The IP address is something like 100.x.x.x

However whastmyip.com showing me my static IP which is 80.x.x.x

However I cannot setup DDNS on my wifi router as it's showing me double NAT issue. When trying to setup DDNS client as asuscomm.com it would connect to 100.x.x.x

Same for the VPN. If setup OpenVPN in wifi router, the .ovpn file configuration will also connect to 100.x.x.x

Shouldn't I connect to IP address 80.x.x.x to get to my home network from outside world?

Would you please someone help me and point me to right direction what I should do to get my DDNS and VPN working. I would like to access my home network from outside for instance security cameras etc.

Thanks for your help,
David

 

[sfx2000]

If your DHCP WAN address is in the 100.64.0.0/10 range - the provider has implemented Carrier Grade NAT - which breaks many things...

https://en.wikipedia.org/wiki/Carrier-grade_NAT

 

[avtella]

What ISP is this? I would try at least putting the ASUS in a DMZ within the ISP modem, however best case to avoid double NAT is transparent bridging, where the ASUS does the internet dialing and the modem only forwards the packets to and from ISP. Tell tech support you need access to the modem to make changes, so you can enable VPN for work, they may yield.

 

[sfx2000]

Tell tech support you need access to the modem to make changes, so you can enable VPN for work, they may yield.

The counter point is that CGN can pass outbound VPN, no problem... it's the inbound that breaks with Carrier Grade NAT.

DMZ'ing the router in a CGN won't help with ipv4, as it's still NAT'ed...

CGN is horrible... but hey, folks these days think the internet is facebook and google right?

IPv6 can help here, but even then - takes a router and client workstations that works correctly with ipv6 - and then the applications themselves...

 

[sfx2000]

Tell tech support you need access to the modem to make changes, so you can enable VPN for work, they may yield.

The counter is that DDNS and inbound aren't needed for work on a consumer account - see above.

So tech support isn't going to help out much here - as most consumer account Terms of Service - thou shall not run inbound services on our network on a consumer account.

Which for many - DDNS and inbound VPN could be considered as such - DDNS suggests that there are inbound service endpoints - e.g. servers...

I'll repeat - CGN sucks - and OP's post above - with the 100.x.x.x - that's likely CGN - if it's 100.64.x.x, it is...

 

[avtella]

Thank god CenturyLink isn't like this.

 

[sfx2000]

Thank god CenturyLink isn't like this.

I agree - so far - in my region - ATT/Cox/TWC (now Spectrum) - they've been pretty good about this - I don't think ATT would go to GCN, and I doubt that CoxHSI would - but Spectrum, with their merger, who knows?