Hi,
I’ve been trying to work out my network architecture with the pieces i have today:
- isp box with 10gig dac downlink, 4 ssd bays
- pfsense box with dual 10gig dac card
- switch with 10gig dac uplink and multi gig rj45
- main proxmox host
- other devices (laptops, iot…)
ive ran into a dilemma regarding switching my isp box to bridge mode:
- if i do, i lose wlan and nas capabilities
- if i dont, i have to contend with double nat
i’m sure that eventually i will get an ap (maybe unifi) and a dedicated nas (either home built or something like synology or asustore), but for the moment, i want to keep cost down and gradually add new pieces
i was wondering if double nat is of huge performance and maintenance implications, or if i would be okay running this setup for a few months until i get to add an ap and nas?
thank you
If it’s double NAT where you have control over both boxes, it’s not that big a deal. First of all, it only matters at all if you’re trying to forward ports for remote access to your services, in which case you just need to add two port forwarding rules for each service, instead of one, one in each firewall. Alternatively if the ISP router allows it, see if it has a 1:1 NAT feature, this way it forwards ALL the ports to your private router, where you can then be selective about which ports to allow.
Alternatively, if you’re not trying to host services on your LAN for public access and consumption (Which would be a bad idea at this point in time anyway given your level of knowledge) don’t worry about the NAT or port forwarding at all and just use a mesh VPN like Tailscale (Optionally with the self hosted control application Headscale) and use that to access your services which outside home securely.
Some routers will call the 1:1 NAT feature, “DMZ” (Short for Demilitarised Zone). The idea is that you just act as a pass-through, in this case, “passing through” the external internal to the internal router.
It’s not a huge issue. Especially if you can forward ports in bulk to the second router.
I’m surprised your ISP box can route traffic at 10G btw.
Also be sure to check out grandstream APs and other alternatives . I run UniFi but I’m not sure I would deploy it today. Especially if you already have a pfsense box.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters AP WiFi Access Point IP Internet Protocol NAT Network Address Translation VPN Virtual Private Network
4 acronyms in this thread; the most compressed thread commented on today has 10 acronyms.
[Thread #105 for this sub, first seen 4th Sep 2023, 08:55] [FAQ] [Full list] [Contact] [Source code]
Using double NAT here because my ISP won’t even support/allow putting their box in bridge mode and I don’t even have root access to it, just some limited functionality via their web GUI.
I haven’t had any issues with it.
Can you set the ISP box to designate your router as DMZ (de-militarized zone)? Your router needs to get a static IP from the private subnet defined by their router, then you mark that IP as DMZ in their router’s settings.
It’s not technically the same as bridge mode, the ISP box continues to act as a router but also exposes your router fully to the internet so you can mostly ignore theirs afterward.
Yes, that’s essentially what I did.
Double NAT with DMZ.
Those SIP ALGs are more trouble than they are worth. If you are using SIP devices, use a different outbound port on each device (eg: 5060, 5061, 5062).
