RV042 v3, setting up with Comcast SMC and dynamic IP

[abignet]

Greetings,

I've just recently purchased a RV042, thanks in large part to the great reviews on this site. I have Comcast Business Class internet with the requisite SMC 8014(?) modem/router combo, and with a dynamic IP address. I've been reading a lot of forum threads across various forums, but they all tend to be geared more towards having a static IP, which I'd rather not pay for (and I don't really think is warranted for my needs).

Here are some of the kinds of things I'm seeing people suggest:
-use port 1 on the SMC;
-set secondary router (ie, the RV042, in my case) to be a DMZ host;
-turn off DHCP in the SMC (some say this isn't necessary).

I've experimented some with the above (though not the first one, because I hadn't come across that before I left the office), but haven't had any luck yet. I'm wanting to get things set up so that all of my LAN computers (which consists of a few computers and a few NAS's) are hooked up to the RV042 so that I can then VPN in and access those local LAN resources remotely. As part of this I think I need to be able to get DynDNS working such that it is able to automatically update itself within the RV042. That is one of the things that didn't seem to be working.

I have a rough idea of how things might be able to work conceptually, but I'm having trouble getting all the details straight. Here is what I have tried thus far and/or what I'm thinking thus far:
-I assigned an internal IP to the RV042 (from inside it's interface--I think the setting was "Device IP Address") so that it would stay consistent; the SMC is something like 10.1.10.1, so I assigned the RV042 to be 10.1.10.2.
-Pointing the RV042 to the SMC as its gateway still resulted in the RV042 being assigned a different address (something like 10.1.10.194) by the SMC (I think maybe this was the LAN IP in the RV info? I can't remember and I'm not in front of it right now). I could access the admin for the RV from a computer plugged into the RV via the 10.1.10.2 address.
-I wasn't sure whether I should put 10.1.10.2 in the DMZ field in the SMC or the .194 address. I thought that the first one should be correct, but I tried both and neither seemed to have any effect.

I'm going to have to go through all this more thoroughly when I have more time (which probably won't be until this weekend). One thing I wonder a little is if rebooting either/both devices after applying some of these settings would make a difference or not.

Another weird thing I noticed which could be affecting things is that the password field for entering my DynDNS account info seemed to be a lot shorter than what my password actually was. I'm not 100% certain, but that seems like quite a bug if in fact I'm going to have to shorten my password significantly in order for it to be used in the RV settings.

Thanks in advance for any input and help anyone can offer!

 

[thiggins]

If you want to VPN into the RV042, the best way would be to set the SMC to bridge mode.

You can try putting the RV042 WAN IP in the SMC's DMZ. But DMZ implementations don't always handle VPN pass-through properly.

 

[abignet]

Tim, Thanks much for your reply. Apparently there is a lot of disagreement on the internet as to whether these particular router/modem combos have a true bridge mode or not. There is definitely not anything like that accessible in the interface for me. Some say that there is something that can be enabled by calling tech support, but only after you hand over your first born child or something. But others say that this is just tech support making the kinds of adjustments you're talking about (ie, DMZ stuff, etc.).

I had some unexpected time today to experiment further, and so I tried some things in the direction you suggested regarding the DMZ.

Here are the steps that I have take thus far:
-turned off Netgear switch.
-plugged RV into port 1 of SMC (not sure if this really matters, but some seem to think so, so I figure it can't hurt).
-turned on RV and waited a minute or two for it to initialize.
-plugged switch into RV.
-computers attached to switch have local traffic, but not internet at this point.
-cannot access SMC from those computers either.
-changed RV Device IP from 10.1.10.2 to 10.1.10.3 (I thought that perhaps there was conflict or something); this was done through the RV admin interface.
-set DMZ in SMC to WAN IP of RV (10.1.10.194, this is the IP assigned to the RV by the SMC).
-still no internet from computers behind RV.
-turned off switch and RV; waited, turned back on, waiting in between. Still no internet from behind RV.
-"checked" (turned on) Disable Firewall for True Static IP Subnet Only, on SMC (I wasn't totally sure this would do anything).
-turned off network printer (which still had IP from old pool from SMC), and turned off RV and switch again, and turned them back on. Printer still kept old address, but that may not matter.
-changed DMZ on SMC to 10.1.10.3 (the Device IP of the RV); rebooted RV and switch again. Still no internet access from behind RV, and cannot access SMC either from behind RV.

After all that I was out of time and had to have internet back to continue on with my day. I was using a laptop plugged directly into the SMC to access it's admin interface.

From the things I've seen elsewhere the DMZ approach should be the most promising, but so far I've not had any success, so I must be missing something.

 

[thiggins]

Unless I'm misreading your settings, it appears that you have the SMC and RV both using the same sub 10.1.10.X subnet. This is a no-no. The SMC and RV must use two different private subnets. If the SMC is using 10.1.10.X set the RV to use 10.1.11.X. Just set its IP address to 10.1.11.1.

Set the RV WAN type to Dynamic IP and let the RV obtain a DHCP lease from the SMC. Then, on the SMC, enter the RV WAN IP address as the DMZ IP.

 

[abignet]

Unless I'm misreading your settings, it appears that you have the SMC and RV both using the same sub 10.1.10.X subnet. This is a no-no. The SMC and RV must use two different private subnets. If the SMC is using 10.1.10.X set the RV to use 10.1.11.X. Just set its IP address to 10.1.11.1.

Set the RV WAN type to Dynamic IP and let the RV obtain a DHCP lease from the SMC. Then, on the SMC, enter the RV WAN IP address as the DMZ IP.

Oh, that is great! That is an important detail that I was missing from all of my research. I think the RV defaults to something like 192.168.xxxxx, which I changed for several reasons, one of which being I misunderstood some of the comments I read elsewhere to mean that the RV Device IP needed to be on the same subnet as the SMC, but now I'm realizing that it was the RV WAN IP being referred to.

I will try this out tomorrow morning and report back (hopefully with good news!).

Thanks so much for your help! I probably would have been stuck overlooking that key detail for some time.

 

[thiggins]

By the way, the same rule holds for VPN. Make sure the two LANs that you are trying to connect have different IP address ranges.

 

[abignet]

By the way, the same rule holds for VPN. Make sure the two LANs that you are trying to connect have different IP address ranges.

Yes, thank you. I had actually gotten that part right from my research. That was another reason why I changed the Device IP because I wanted to make sure to avoid that. I just didn't yet know enough to change it to something that wouldn't conflict on the other end! Very ironic.

Thanks again for the additional clarification. I'm new to VPN technology, so I don't know enough yet to have much of a sense of how much I don't yet know (if that makes sense).

 

[abignet]

The SMC and RV must use two different private subnets. If the SMC is using 10.1.10.X set the RV to use 10.1.11.X. Just set its IP address to 10.1.11.1.

It worked! I now have internet from behind the RV! Thank you so much!

A couple of things to mention for other people's benefit (these are all with firmware 4.0.2.08):
-When you're creating QuickVPN users (on the VPN Client Access page of the RV) the maximum allowed length of the password is 32 characters. I only figured this out by looking at the page source; there was no warning when I pasted in a longer password from my password keeper software.
-Similar to the above, when configuring DynDNS the max length of the password field (in the RV firmware) is only 15 (which I consider to be way too short).

Even after changing my DynDNS password to one that is 15 characters long, I still have not been able to get it to update from within the RV. I am consistently getting "authorization failed" messages. I don't know if this is somehow caused by the RV connecting to the internet through the DMZ of the SMC or what. For now I'm just going to run the DynDNS update client from a computer at the same location. I think that I still need to leave DynDNS "configured" in the RV in order to have access to other Dynamic IP related features (I think to do with setting VPN clients other than the QuickVPN).

Where I am stuck now is with getting the QuickVPN software (version 1.4.1.2) to work properly. It is pretty straightforward to set up, but there is a requirement that Windows 7 Firewall be enabled:

On Windows Vista and Windows 7, Windows Firewall needs to be enabled in order for QuickVPN Client to function properly. This issue occurs because IPSec service on Vista is disabled when Windows Firewall is disabled. Some thirdparty firewalls will disable the Windows Firewall, which will cause QuickVPN to fail.

Like most people I use security software other than Windows Firewall (in my case, Norton Internet Security) and so Windows Firewall is disabled. So I'm not sure how to proceed here because I don't particularly want 2 firewalls going at the same time, but I appreciate the simplicity of the QuickVPN client and would like to be able to use it (for some computers anyway). I'm trying to see if there is anyway that I can just enable the IPSec service in Windows 7 without enabling the firewall too, but I haven't found anything yet.

Quick Note: I just discovered that IPSec service (called IPSec Policy Agent) IS enabled on my computer. So I've got more troubleshooting to do to figure out why I can't connect.

 

[YeOldeStonecat]

I have a lot of customers on Comcast business internet, so a lot are using those SMC Gateways..which is a combo modem/router.

You log into its interface (10.1.10.1..user "cusadmin", pw "highspeed"), flip a setting to "Disable Fireall for true static IP only subnet"...and then uplink your own routers WAN Port to one of the LAN ports of the SMC. Log into your own routers web admin, and configure its WAN address as static...plugging in the static IP that Comcast gave you on your account, subnet, gateway, etc. Now your own router is basically bypassing the NAT of the SMC. And you're not stuck with the many pitfalls of double-NAT.

 

[abignet]

Log into your own routers web admin, and configure its WAN address as static...plugging in the static IP that Comcast gave you on your account, subnet, gateway, etc.

Thanks much for posting. Unfortunately I do not have a static IP--I only have a dynamic IP with my Comcast Business account. Do you happen to know of options that work for a dynamic IP?

While the DMZ method described above has worked for getting me internet access from behind the RV, I've wondered if I need to do port forwarding or maybe something with static routes or something (none of which I have any experience with yet) in order to get the VPN working correctly?

 

[YeOldeStonecat]

Wow I've never seen Comcast use the SMC on a dynamic account, even smaller clients of mine with a basic dynamic account with Comcast...were just given the usual Motorola Surfboard used in home accounts. In which case you just set the WAN interface of your router to "obtain auto".

I missed that information...you having a dynamic account, guess my eyes skimmed past that and focused on the SMC.

Setting your own router to "obtain auto" will simply have it pickup a 10.1.10.xxx address from the SMC. So I don't know any method of properly setting that up with the formal method of having the SMC pass the public IP to your router.

I'm trying to picture this....waiting for my second cup of coffee to brew to wake me up more.

Now I'm assuming you're not using the VPN to connect 2 sites...but rather, just to connect to your home LAN while you're out on the road?

SMC, default LAN IP 10.1.10.1..you can leave DHCP enabled. So those settings are fine.

You can leave your RV042 at the default LAN IP of 192.168.1.1

Log into the RVO, and assign its WAN interface a static IP that is in the subnet of the SMCs LAN side. Lets pick...10.1.10.10, subnet of 255.255.255.0, gateway of 10.1.10.1, and you can do whatever you want for DNS...like use OpenDNS, 208.67.222.222 and 208.67.220.220.

Now connect a computer to one of the free LAN interfaces of the SMC...allow computer to pickup a 10.1.10.xxx address..log into the SMC, and stick the IP that you assigned the WAN interface of your RV0..in the DMZ. Or...do port forwarding for whichever VPN type you wish to use.

When you setup your dynamic dns service...you'll want to ensure your DNS alias is bound to the public IP that the SMC obtains on its WAN interface....(like if you go to whatismyip.com) not to the 10.1.10.10 IP address that's on the WAN of your RV0.

In my experience, the "QuickVPN" client that the RV0's use...stinks! I tried it many times in the earlier years of the RV0 series...even did a big deployement of 50 users on an RV016..but it was nothing but problems. On both sides..both the software client, and the firmware of the RV0 itself would occasionally need a reloading because it would corrupt the username list for the VPN clients. I haven't tried it in over 3 years...so perhaps they finally matured the product. I do love the RV0 series for all its other functionality...it's fast, stable, has some good firewall features, does "router to router" tunnels fairly decently. And...the basic PPTP VPN service on it does work well.

Just to step back and give ourselves the opportunity to think outside the box...what are your goals? Just to ponder if there are easier approaches to what you need to get done, instead of taking this VPN double router approach.

 

[abignet]

Thanks for posting.

Now connect a computer to one of the free LAN interfaces of the SMC...allow computer to pickup a 10.1.10.xxx address..log into the SMC, and stick the IP that you assigned the WAN interface of your RV0..in the DMZ. Or...do port forwarding for whichever VPN type you wish to use.

Yes, putting the RV in the DMZ of the SMC has worked for getting me internet access for computers attached to the RV, but it has not been sufficient for enabling me to connect via QuickVPN (or my attempts with the ShrewSoft VPN client, which I'm not entirely sure I've configured correctly).

I tried forwarding ports 443 and 60443 (which are used by QuickVPN) to the RV from the SMC but that had no effect. Do I need to configure some kind of port forwarding in the RV as well?

When you setup your dynamic dns service...you'll want to ensure your DNS alias is bound to the public IP that the SMC obtains on its WAN interface....(like if you go to whatismyip.com) not to the 10.1.10.10 IP address that's on the WAN of your RV0.

Yes. I finally made my DynDNS password simple enough that the RV could handle it correctly (as a side note I think it is ridiculous to have to make one's password so short and devoid of special characters in order for the router firmware to correctly pass it to DynDNS). Unfortunately, it only passes the LAN address received from the SMC--it is not able to pass the true WAN IP (which exists on the SMC, but the RV cannot see, of course). I am using the DynDNS desktop software to update the IP, but I'm not sure yet if that will be sufficient or if there is anything within the RV that depends on having the correct address in the RV.

Now I'm assuming you're not using the VPN to connect 2 sites...but rather, just to connect to your home LAN while you're out on the road?

Yes, sort of. I want access while on the road, but I also want to set up permanent ongoing access between two points (ie, one point being able to always access the other point). I know the best way to do that is to just get two vpn routers (which would then give me a two-way connection, which I eventually want), which I eventually plan to do, but I'd like to get this working with just one for the time being (partly to save money at the moment).

Just to step back and give ourselves the opportunity to think outside the box...what are your goals? Just to ponder if there are easier approaches to what you need to get done, instead of taking this VPN double router approach.

Great question! Here are my goals:

1) Have a perpetual, reliable connection to my Office network from my Home computer. Currently I'm trying to accomplish this by having the RV at the Office and installing QuickVPN (or if necessary using Shrew VPN) on my Home computer. The goal is for the Home computer to be always connected to the Office network. I back up a lot of data (sometimes 10GB/day; other days only 1GB) to the Office network from the Home computer (and network) so that is what this connection is primarily for.

2) Eventually I will get another VPN router for the Home network which will enable me to have a perpetual, reliable connection to the Home network data. Right now I use ReadyNAS Remote (a kind of VPN software that comes with Netgear ReadyNAS') to accomplish this. I have been using the same software for access to the Office NAS, but it doesn't always do well with large backups (ie, can lose it's connection periodically, thus interrupting the transfer).

3) When I am traveling I would like to create a Full or Transparent tunnel (not a split tunnel, which is what QuickVPN does) connection to the Office network both to access files, but also to be able to have all of my internet browsing, activity, etc. go over the VPN connection. This would be for when I'm browsing over a public, insecure Wifi connection (eg, a coffee shop, air port, etc.). Currently I pay about $60/year to http://witopia.net for securing my internet connection in those circumstances, but I'd love to be able to do this through my own VPN, especially since I'm likely to want to connect to my own network resources anyway, I may as well secure my web browsing on my laptop at the same time. I'm not sure how to do this with the RV, and am a little concerned that it cannot do it since I am not seeing anything in the documentation about it. I've read that the PPTP VPN in the RV can do this, but I've also read that PPTP is not as secure as IPSec, and so I'm feeling unsure that is a very good solution for insecure Wifi connections.

Here is some info from my QuickVPN log:

2011/06/07 15:14:29 [STATUS]OS Version: Windows 7
2011/06/07 15:14:29 [STATUS]Windows Firewall Domain Profile Settings: ON
2011/06/07 15:14:29 [STATUS]Windows Firewall Private Profile Settings: ON
2011/06/07 15:14:29 [STATUS]Windows Firewall Private Profile Settings: ON
2011/06/07 15:14:29 [STATUS]One network interface detected with IP address 192.168.0.3
2011/06/07 15:14:29 [STATUS]Connecting...
2011/06/07 15:14:29 [DEBUG]Input VPN Server Address = example.dyndns.org
2011/06/07 15:14:29 [STATUS]Connecting to remote gateway with IP address: REAL_ADDRESS_REMOVED_FOR_SECURITY
2011/06/07 15:14:30 [STATUS]Remote gateway was reached by https ...
2011/06/07 15:14:30 [WARNING]Remote gateway wasn't reached...
2011/06/07 15:14:30 [WARNING]Failed to connect.
2011/06/07 15:14:30 [STATUS]Remote gateway was reached by https ...
2011/06/07 15:14:30 [WARNING]Remote gateway wasn't reached...
2011/06/07 15:14:30 [WARNING]Failed to connect.
2011/06/07 15:14:30 [WARNING]Failed to connect!

My DynDNS address resolves to the correct address, and it appears from the above that QuickVPN reaches at least the outer gateway (presumably the SMC), but then does not make contact with the RV, even though the RV is in the DMZ.

 

[YeOldeStonecat]

Sorry to be away past few days.... big network upgrade project I'm working on and little free time is spent riding the Harley.

Hmmm....do you tried sticking the WAN IP of the RV into the DMZ of the SMC...should work for most things. But that's still double NAT..it's not clean, and some VPN types are very intolerant of NAT..hence special settings like allowing IPSec and PPTP traffic to pass through unmolested. Do doing a double NAT setup introduces even more "yuckiness" for VPN, for lack of better term.

Shouldn't have to do additional port forwarding if you put it in the DMZ..since DMZ already opens up all 65,000 plus ports.

Ensure port 443 isn't forwarded for anything else.
https on the RV needs to be enabled
Used to be ports 443 and 500 for QuickVPN client...perhaps they changed it for newer version, but instead of DMZ, try forwarding those ports. I don't recall port 60443. (I just did some further reading, seems the client will try port 443 first..and if no answer, it will try 60443. But try adding port 500 to the port forward test...instead of DMZ setup)

It may be there is indeed a conflict with the SMC gateway, perhaps externally port 443 is already tied in with Comcasts remote web admin access. I'm used to them being run in the "firewall off" mode, for true static IP subnet with a statically set router behind it (just didn't another setup today) BTW, try that checkbox setting I mentioned in prior reply..by logging into the SMC.

All else fails....
*Try the PPTP VPN instead (forward port 1723). While technically it's less secure, for doing part time connections...it's fine. Breaking into it is really quite an exercise. Just a tad slower in performance than good IPSec.
*Trade in the SMC for a plain Motorola Surfboard modem. Can find brand new still in the box ones on ebay for under 60 bucks. Pick one up, call up Comcast..tell them you want them to provision the new modem...read them the MAC address, let them upload a config file..takes about 10 minutes, reboot everything, done.
*Get a static IP

Try adjusting UPnP settings on your homes router end.
Ensure VPN passthrough is allowed on home router


I know some people have had success sticking an RV router behind another router and doing port forwarding and having it work...I'm just against double NAT..so have never set one up.

 

[abignet]

Thanks for your input. I'm starting to wonder if my Home router (a Netgear RP614v3) is part of the problem. I found where a firmware release for the v4 of this router (which is of course not compatible with v3) mentions "Fixed VPN Passthrough issues". So I'm wondering if those issues might also be in the v3 and if that is why things don't completely work (ie, if it lets the connections out, but doesn't let replies back in sometimes).

I could not find any explicit VPN passthrough settings in the RP614v3 to adjust. I did turn on UPnP, but that did not seem to have any effect (at least not on QuickVPN).

I ended up calling Comcast a few days ago. There wasn't much they could do for me other than confirm that I've done all the things with the SMC that are worth trying. They did not think that I would be allowed to use my own modem.

I've been experimenting with Shrew VPN, and I can establish a connection (it even shows as being connected in the RV interface), but I can't manage to ping anything that is behind the RV. Do you have any experience with Shrew and the RV042?

Since I'm wanting to set up a persistent VPN connection I feel pretty hesitant to use PPTP. Security is pretty important to me.

At this point I'm kind of giving up on QuickVPN (which is too bad, since it should have been so simple). I'm hoping that maybe I can get things working with Shrew, if I can figure out what still isn't working.

If it turns out that even Shrew won't work then I'll probably move towards getting a vpn gateway for home (which I was planning to do eventually, just not right now) and getting rid of the RP614v3.

Update:
I may actually be starting to get somewhere with Shrew VPN. I'll post more when I've done further testing, but I wanted to share the potentially good news before anyone went to the effort to offer more troubleshooting suggestions. Hopefully I'll be reporting back with more substantial good news.

 

[thiggins]

Thanks for your input. I'm starting to wonder if my Home router (a Netgear RP614v3) is part of the problem. I found where a firmware release for the v4 of this router (which is of course not compatible with v3) mentions "Fixed VPN Passthrough issues". So I'm wondering if those issues might also be in the v3 and if that is why things don't completely work (ie, if it lets the connections out, but doesn't let replies back in sometimes).

Just take the router out and connect your client directly to the SMC and see.

 

[abignet]

Tim, thanks for your post. The Netgear is actually not behind the SMC. I should clarify my network topology, as I'm mentioning so many devices here that I'm sure it is no longer clear what is connected to what.

Here is my setup:
Office Computers -- RV042 -- SMC (Comcast Business Class modem/router combo) -- INTERNET -- Motorola cable modem (self purchased, which is/was allowed for Comcast Home customers) -- Netgear RP614v3 -- Home Computers.

Maybe I could just try doing a direct connect to the Motorola with my laptop here at some point.

However, I have finally gotten the Shrew VPN client working and so far the VPN connection has seemed to be fairly solid. I'm running some long backups of large files to test things out a bit. Then I want to do a few tests with Iperf and maybe experiment with the security settings for the VPN. I started with AES 256, but that may be overkill. Security is pretty important to me, so I don't want my data to be hackable, but I'm also not likely to be a particular target either, so I may try AES 192 or maybe even 128.

Any one want to share any opinions regarding suggested Ipsec Phase 1 & 2 settings that balance security and performance? What would be considered the minimum for maintaining security?

I should add here for other reader's benefit that in order to access Windows computers on either side of the VPN I had to add some IPs to Norton's Trust Control, and set them at Full Trust. By doing that I could then ping the office Windows computer (which is behind the RV) and view shared folders, and from the office I could ping and view shared folders of the home computer (which is running the Shrew VPN client). The NAS at the office did not need this since it doesn't run Norton. I don't think I can access any other computers on the Home network though at this point--just the one running the Shrew VPN client. This is what I would expect.

I enabled Netbios forwarding on the RV tunnel that I'm using, but it doesn't seem to be doing anything. So far I've had to add the appropriate IP's to my Hosts file (on the home computer running Shrew) in order to access the office machines by name. Does the Netbios forwarding work better (or only) if one is doing a Gateway-Gateway setup? Does anyone have any experience with using the RV042 and Shrew and forwarding Netbios (so that adding entries to the Hosts file is unecessary)? It is not the end of the world to have to use the Hosts file, but I would like to better understand what is possible and not possible.

The next big thing I'd like to figure out (and which I feel a little skeptical will be possible with the RV) is to configure a Full/Transparent tunnel to the RV042 with Shrew VPN (or some other VPN client). This is for my laptop. By Full/Transparent tunnel I mean a tunnel where ALL traffic goes to the remote router (ie, the RV042). This is for purposes of securing my internet connection when I'm browsing over an insecure Wifi connection (eg, a coffee shop). I know that some VPN routers can do this, but I am not seeing anything in the documentation for the RV about this (unless I've missed it thus far). Does anyone know if this is possible with the RV?

 

[YeOldeStonecat]

PPTP VPN, you adjust the gateway with settings in the VPN dialer you setup. So you can surf through your remote VPN hosts connection.

 

[abignet]

PPTP VPN, you adjust the gateway with settings in the VPN dialer you setup. So you can surf through your remote VPN hosts connection.

What about security though? This is for using over unsecured wifi connections, the very places most susceptible to attack. I'm unclear about the particulars of the vulnerabilities in PPTP so I don't know how big the risks are. I've read that if one uses a long enough password that you're fairly safe, but I'm not completely comforted by that. Is it the server end (ie, the RV042) that could come under attack just by having PPTP enabled, and/or is it live PPTP sessions that can be vulnerable if the password is too short? I just want to be sure I really understand the risks before I go this route.

 

[pw40b]

Same exact situation.

Hi there - I am a little late to the party but wanted to let you know that I have been down this exact same path. Many memories, mostly bad, were brought back reading this.

We also got an SMC box from Comcast, with a dynamic IP. After going through countless scenarios as you have, I finally had them give us a "standard" cable modem box. This fixed the double-natting problem and everything worked great, including VNC and QuickVPN client.

Eventually we decided to go with an IP phone and SIP trunk, which required a static IP. So today Comcast upgraded us to the SMC box, but of course with the static IPs the double-natting shouldn't matter - we will just set our RV042 to one of our static IPs.

Bottom line was that SMC+Dynamic IP did not work for us and although it took some arm twisting, Comcast gave us a "standard" cable modem which solved the problem.