0

Current situation:

The internet available to me is a shared router that I do not have administrative access to. If really needed I could reset the password but I rather not. I plugged in a network cable and plugged it into the WAN port on my own openwrt/lede router. This gives me a semi-functional but secure network where I have a firewall. However this is a double NAT, which breaks some programs.

What I want:

I want to assign my own network the IP's given from the shared network(192.168.1.0/24) where I keep my firewall enabled. In a way this is similar to assigning public IP's from your ISP to your whole LAN while having a firewall. Simply bridging the WAN and LAN side works but I lose the firewall in this case, which is missing the point. I simply do not trust the other tenants.

Unfortunately my knowledge about how to route networks is limited to NAT so I don't really know how to approach this(sidenote: any good tutorials on routing?). I did find this: https://lede-project.org/docs/user-guide/firewall_configuration#stateful_firewall_without_nat.

But that doesn't work. I simply lose internet from my LAN side when I disable masquerading(which I assume is NAT)

1
  • Unfortunately, questions about consumer-grade devices are explicitly off-topic here. You could try to ask this question on Server Fault for a business network, or on Super User for a personal network. Also, understand that NAT has nothing to do with the firewall function. Firewalls can operate fine without NAT, it is just that a firewall is often a convenient place to NAT. NAT can also be run on a device that is not a firewall. NAT is just a kludge to extend the life of IPv4 until IPv6 is prevalent.
    – Ron Maupin
    Jun 2 '17 at 16:16
1

If ou want to get traffic from the multi-tenant network to your own using the addresses given to you from the multi-tenant subnet you'll need to turn off NAT as you have done and then enable proxy-arp for the addresses you want. However this is overkill, I don't know what applications won't work across a "double-NAT" as you call it. Unless you are somehow processing the network traffic between the NAT devices, then what difference can it make, one NAT or two?

Not the answer you're looking for? Browse other questions tagged or ask your own question.