Preliminary note
This question is out of academic interest. I know how to work around the limitation. I use this setup to control access from one subnet to the other on IP level which works great so I don't need any 'solution' or alternative setup - just as implied by the questions: no need for any guessing about my intentions :)

My LAN consists of two cascaded consumer routers with NAT enabled each. I set up a static route in router 1 (which is connected to the internet) so that packets from subnet 1 targeting the subnet of router 2's LAN will use the latter as a gateway. The routing seems to work so far. However when router 2 receives a packet for its LAN subnet on its WAN port it drops the packet immediately.

Is this because of the nature/specification of NAT so that the router won't accept any packets not addressed to its WAN IP? Do the NAT specs imply this?

Or does the firewall inside the router blocks everything which is not port-forwarded to a specific LAN IP?

Are consumer routers (also) designed to not route private IP addresses on their WAN port even if it has a private address assigned?

Any other mechanism involved?

  • 1
    Downvoting is ok but w/out any hint on what I'm doing wrong I probably won't do any better itf. Just read about downvoting policy and couldn't see any rule I'm breaking. – pong Feb 6 '12 at 18:01
  • Indeed, why the downvotes? – psusi Feb 6 '12 at 23:36

Because it is a NAT relationship, it can't "route" traffic. Packets addressed to the routers WAN IP Address will be forwarded according to its port forwarding rules. Any packets not addressed to its WAN IP Address will be dropped becuase they are not for it. In fact, ANY device connected to an IP network will ignore packets that may be recieved that aren't addressed to it.

You can also view this function as part of the firewall if you want. If the router just routed anything it recieved that looked like it belonged to the LAN side it wouldn't be much good as a firewall, would it?

As you know, if you want to allow traffic through then the traffic must be addressed to the routers WAN address and have port forwarding rules to tell it where to send the traffic onto. That is how a NAT device works, you appear to think they should work as a router, they don't.

  • Seems like I'm gettin it. To sum it up: NAT devices shouldn't be considered routers at all regarding traffic from WAN to LAN. They provide kind of routing solely by dynamically and statically mapping WAN ports to LAN IPs and don't use a classic routing table for traffic passing the WAN-LAN-barrier. Sounds reasonable to me, thanks! – pong Feb 6 '12 at 19:12
  • Sorry, OT and more of an IP spec question: Do real routers also drop packets not addressed to them, i.e. do routers change the target IP address of a packet along its way or is routing handled by a separate header field? I would assume that devices connected to an IP network working on layers below IP do not drop packets not being addressed to them - you might still consider them as not being devices in this context, though :) – pong Feb 6 '12 at 19:18
  • Thought that routers wouldn't modify the packet itself so they should be devices not dropping packets not being addressed to them? – pong Feb 6 '12 at 19:24
  • Kinda lousy commenting system, sorry on that! Regarding firewalls I assume that routers (in a conceptual manner respectively dedicated ones) do not provide any letting pass traffic from WAN to LAN by default so they neither are a good a firewall nor one at all by design? – pong Feb 6 '12 at 19:35
  • A true router can provide some protection as a firewall, they can be configured to drop some traffic but it is very static. A true firewall will allow more dynamic control, such as allowing replies to outgoing connections but not allowing unsolicited incoming traffic and matching patterns of traffic (like port scans) that could be malicious. – pipTheGeek Feb 9 '12 at 17:09

Don't chain one NAT router into another. If you want to use the second one just as a switch to get more ports, then disable the NAT functions on it and don't use the WAN port.

If you really insist on cascading the routers, then you need to have the first router forward to the WAN IP of the second, and then configure it to forward to the correct host.

  • Thank you! Regrettably this doesn't answer my question, either. I'm cascading to have two subnets so I can maintain a central firewall to control access from one subnet to the other on IP level which works just great. I know how to work around the routing limitation by port forwarding as implied by the question but I wanna know why the drops are happening out of academic interest. Any clues on that one? – pong Feb 6 '12 at 17:23
  • @Christian, because you didn't forward the port correctly. As I said in my answer, you have to have the first router forward to the WAN IP of the second router, not to the private IP behind it. – psusi Feb 6 '12 at 23:35
  • Hi and thanks again! Yeah, I know of the forwarding possibility, was just curious about why the routing didn't work. Now I know from the accepted answer: a NAT device isn't a router by design. Thanks again, appreciated! – pong Feb 7 '12 at 1:24

It is not clear what you are trying to accomplish, but here are some points that will clarify this for you (I hope):

  1. Private IP addresses are not routable over the Internet.
  2. NAT is useful to translate public IPs to private IPs and vice versa.
  3. NAT can be combined with destination port change. It can be called PAT or port forwarding.
  4. Any network device should drop a received packet if it is not addressed to it, not configured to forward traffic, or does not know how to forward it (using routing table).
  • Thank you for your answer! I know about all you're saying (as implied by the question which is out of academic interest only): 1. I don't route private IP traffic over internet but via my 2nd router which is assigned a private IP on both NICs: do consumer routers usually treat their WAN port as internet regardless of their WAN IP? 2. NAT can also be useful for translating private IPs to private IPs. 4. The router receives a packet on its WAN interface targeted for its own LAN subnet. I assume it knows how to route that. Getting back to my question: why droppin it? – pong Feb 4 '12 at 14:50
  • Are you seriously asking us to "speculate" on why equipment you haven't specified the make and model of in a configuration you haven't fully articulated MIGHT be doing something? – SpacemanSpiff Feb 6 '12 at 18:58
  • It's not about actual hardware but the behaviour of usual one and primarily talking about TCP/IP and related concepts and specifications of these standards, sorry for having caused any irritation. If specs don't imply the limitations then I'd know it's hardware dependent which would be satisfying as well. – pong Feb 6 '12 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.