Double NAT?

[netsysadminMember]

Hi,

I have the following setup:
Internet<

---

>ADSL modem/router<

---

>ZeroShell<

---

>LAN

The ADSL modem/router already does NAT.
Is it possible for ZeroShell to forward outgoing packets to the Internet via the ADSL modem/router without doing NAT on them, ie, only do routing/forwarding?

Thank you

[ppaliasMember]

Go to
Network -> Router -> NAT
Remove the interface that connects to the modem-router from the NAT Enabled Interface list.

[netsysadminMember]

It does not work. As soon as I re-add the interface to the list of “NAT Enabled Interfaces”, it works again!

[netsysadminMember]

Any one can help?

Thanks

[bbozoMember]

1. check if ZS and adsl router are in the same subnet (they should be).
2. ZS Should have adsl routers IP as a Default Gateway (PCs in lan should have ZS as their GTW)
3. DNS forwarders in ZS should be set to adsl router
4. disable NAT in ZS

I can’t be certain this is a solution. This is in general.
you sholud post more info on your configuration.

[netsysadminMember]

Thanks for replying.

LAN computers use 10.0.0.0/16 subnet and have 10.0.0.3 as their gateway.
ZeroShell LAN interface IP address: 10.0.0.3/16
ZeroShell WAN interface IP address: 10.1.0.1/16
ZeroShell gateway: 10.1.0.3
ADSL modem/router LAN interface IP address: 10.1.0.3

[bbozoMember]

then considering everythig a alredy said you should add in your adsl router a static route to your lan subnet and set next hop (gtw) as 10.1.0.1/16 (your ZS)

as i can see you have a big network since you use class B subnet (16).
Consider the ability of your adsl router and hardware you run ZS on because it can slow down your network. If you network is not that big (more than 250 clients) you should use C class subnet (24).

hope this helps

[ppaliasMember]

@netsysadmin wrote:

It does not work. As soon as I re-add the interface to the list of “NAT Enabled Interfaces”, it works again!

For what reason you re-add it? You need to remove it from the NAT Enabled Interfaces list.

[yutiMember]

I think ZS in Bridge mode may help you.

[netsysadminMember]

OK. It’s working. I think adding the static route was the solution.

However, I am unable to ping the LAN interface (10.1.0.3) of the ADSL modem/router from a PC on the LAN!
I can ping the WAN interface of the ZeroShell firewall (10.1.0.1).

But I can access the internet without any problem!

[ppaliasMember]

Does the modem have a static route for the 10.0.0.0/16 subnet? If not, it cannot communicate with your LAN clients and you need to install a static route on the modem for 10.0.0.0/16 via 10.1.0.1

[netsysadminMember]

Yes, it does. But, I’m still unable to ping it!

[ppaliasMember]

If routing is ok, then you need to check any firewall that might be blocking your traffic.

[Author]

Posts