Double NAT

[keef]

Hello. How do I turn off Double NAT using Merlin 386.5.2 on an Asus 3100 router? I got a warning from Ad Guardian. I'm not even sure how it got turned on.

thanks

 

[ColinTaylor]

You can't "turn off" double NAT on the Asus. Double NAT is where you have another router between your Asus and your internet connection.

 

[keef]

You can't "turn off" double NAT on the Asus. Double NAT is where you have another router between your Asus and your internet connection.

Well, that is why after 2 hours I could not find the setting. I only have my cable modem and Asus router, so I'm not sure why AG sees it as a double NAT setup. Weird.

thanks for the reply.

 

[Tech9]

Your ISP device is perhaps a modem/router or you are getting a CGNAT address from your ISP.

 

[dave14305]

Why would an Ad blocker care about double NAT?

 

[Ranger802004]

Your ISP device is perhaps a modem/router or you are getting a CGNAT address from your ISP.

I was thinking CGNAT too.

 

[Ranger802004]

Well, that is why after 2 hours I could not find the setting. I only have my cable modem and Asus router, so I'm not sure why AG sees it as a double NAT setup. Weird.

thanks for the reply.

Is the Cable modem one of those dual function router / modem combos?

 

[ColinTaylor]

Why would an Ad blocker care about double NAT?

Indeed. But it makes mention of it in the Asuswrt-Merlin-AdGuardHome-Installer release notes and the install script.

 

[Tech9]

Is the Cable modem one of those dual function router / modem combos?

Not sure what problem we are solving here. It doesn't matter for DNS filtering.

 

[Tech Junky]

This is just dumb. I'm effectively running triple NAT and it works just fine for blocking things. While I'm not using AG I'm filtering by pihole. Also, connected to VPN and getting I would say "line speeds" but, it's 5G FWA now which fluctuate a bit based on time of day / tower use.

ISP <> gateway <> DIY router / VPN <> LAN
x.x.x.x <> 192.168.12.x <> 10.5.0.x 192.168.0.x

 

[dave14305]

Indeed. But it makes mention of it in the Asuswrt-Merlin-AdGuardHome-Installer release notes and the install script.

If I don’t understand what’s happening, blame double NAT!

 

[keef]

Is the Cable modem one of those dual function router / modem combos?

Good idea. I thought of that as well. It is just a modem.

The really weird bit now is AG no longer gives me the Double-Nat error. I did nothing at all. I still cannot get AG working but at least no dead in the water error!

 

[keef]

Why would an Ad blocker care about double NAT?

All I can offer is the screen capture from running AG at the from the beautiful amtm. And the error is no longer there. Since I cannot get AG working with double-nat gone, it was not the error that caused it to fail. I must have missed another setup function.

As a test, I am trying to block all ads on speedtest.net. Should AG block those successfully? The stats home screen for AG updates and says it has blocked tens of thousands of ads. I have deleted the browser cache and tried a different browser.

 

[Ranger802004]

Why would an Ad blocker care about double NAT?

Now that I think about it, if it is doing session tracking or marking traffic with mangle rules, the functionality could get lost in translation from Double NAT.

 

[eibgrad]

Now that I think about it, if it is doing session tracking or marking traffic with mangle rules, the functionality could get lost in translation from Double NAT.

If you're suggesting that the upstream router is stripping marks ...

The marking of packets remains local to the router doing the marking. It does NOT modify the packet itself. It's tracked and managed independently by the kernel. That's why if you want to make your marks persistent within a connection, you need to use the SAVE and RESTORE options in the mangle table. That effectively keeps remarking the packets as they come and go within the same connection.

So I still don't see how being double NAT'd would affect anything related to marking, or by extension, session tracking if we assume it's dependent on the use of marking.

Then again, maybe you meant something different entirely.

 

[ColinTaylor]

The warning about double NAT was added in this commit. It roughly coincides with this post.

I can't find anything on the internet to suggest that AdGuardHome has any issues with multiple NAT levels. The only thing I did find was from someone using pfsence who was trying to use NAT loopback in a double NAT situation in an attempt to create a form of DNSFilter. I do wonder whether the post I linked to above was also attempting something similar. In which case it would really be a user error rather than a problem with AdGuardHome.

So I suspect the NAT warning message was just added as a general disclaimer rather than indicating an actual identified problem.

 

[eibgrad]

Well NAT loopback in a double NAT situation can be problematic. It assumes the upstream router supports it, since you have to reference the upstream router's public IP, NOT your own router's private IP. But I have no idea if AdGuard is somehow dependent on NAT loopback (or perhaps in some very specific and uncommon situation). To the extent it is, then yeah, I could see the problem.

 

[ColinTaylor]

But I have no idea if AdGuard is somehow dependent on NAT loopback (or perhaps in some very specific and uncommon situation).

I don't believe there are any dependencies on NAT loopback. That's why I think it's a user error, e.g. attempting to access AdGuardHome via the WAN interface without first modifying the firewall.

 

[Ranger802004]

If you're suggesting that the upstream router is stripping marks ...

The marking of packets remains local to the router doing the marking. It does NOT modify the packet itself. It's tracked and managed independently by the kernel. That's why if you want to make your marks persistent within a connection, you need to use the SAVE and RESTORE options in the mangle table. That effectively keeps remarking the packets as they come and go within the same connection.

So I still don't see how being double NAT'd would affect anything related to marking, or by extension, session tracking if we assume it's dependent on the use of marking.

Then again, maybe you meant something different entirely.

Not always the case, if the upstream router is maintaining the sessions instead of the first hop router you are connected to, then that router (first hop) is acting as a passthrough so it can potentially cause some issues.