Google OAUTH failure with double NAT configuration

Question

Level 3

870 points

Google OAUTH failure with double NAT configuration

I recently discovered that I could not refresh my Blogger blogs with MarsEdit. In particular the Google OAUTH service failed showing a blank page. After a few days debugging I narrowed the problem down to my Apple AirPort Extreme 802.11ac (SN C86QV7EFFJ1R) with firmware 7.9.1. With NAT enabled (Router DHCP and NAT) Google OAUTH fails. In Bridge mode (connected to xfinity cable modem) OAUTH works.

OAUTH also works if I VPN from my Mac.

Because of the way I discovered this it's possible that the 7.9.1 update broke Google OAUTH for DHCP/NAT mode.

Anyone see anything like this?

Posted on Dec 6, 2019 6:28 PM

Reply

Answer 1

Best reply

Tesserax

Level 10

148,519 points

Dec 7, 2019 9:28 AM in response to jfaughnan

FYI ... the OAUTH protocol is not specific to Google. Regardless, it appears, from your post, that the MarsEdit app uses the OAUTH protocol over HTTP to authenticate with Blogger that also appears to be hosted on Google servers. To gain access, there are at least six communications that must occur between your Mac and Blogger to be successful. As the others have mentioned, with your Extreme in a "Double NAT" condition with your upstream Xfinity gateway, one of more of these communications is/are not occurring. Only by taking a data capture can you actually verify this. When you connected directly to either the gateway or used a VPN, you in effect, removed the Double NAT condition. As the others have mentioned, reconfiguring the Extreme as a bridge will do the same.

Reply

Answer 2

Dec 6, 2019 8:29 PM in response to jfaughnan

Double NAT is always a bad setup.

And there is no need to use it.. just use the Airport in bridge mode.. if you need it still for wireless.

A lot of issues are supposed to be fixed once we move to IPv6 but progress is still slow.

Reply

Answer 3

Dec 6, 2019 8:48 PM in response to jfaughnan

Because of the way I discovered this it's possible that the 7.9.1 update broke Google OAUTH for DHCP/NAT mode.

Nothing good will happen with a Double NAT condition on a network.

If you are saying that things were working fine before you updated the AirPort to 7.9.1 and broke immediately after you updated to 7.9.1, then there might be some value in looking at the firmware update as a suspect.

Reply

Answer 4

jfaughnan Author

Level 3

870 points

Dec 6, 2019 9:06 PM in response to Bob Timmons

Thank you!

I had thought double NAT was more secure. I’ve run that way for 10-20 years.

It broke recently. To prove it was the firmware update i would have to revert to the prior version. I might try that or I might simple accept bridge mode.

Reply

Answer 5

jfaughnan Author

Level 3

870 points

Dec 7, 2019 7:54 PM in response to Bob Timmons

Sadly, I found out today what double NAT is good for.

It's necessary for the guest network unless the comcast devices has a VLAN capability: https://lucatnt.com/2016/05/enable-guest-network-on-airport-basestations-in-bridge-mode/

Bridge mode let OAUTH work, but it turned off my Guest network -- without warning. I use that network for all my IOT devices -- TV, garage opener, etc.

So now I'm back to Double NAT. I'm going to try reverting to the old firmware using "click the base station in AirPort Utility, then Option-click the firmware version number."

Reply

Answer 6

jfaughnan Author

Level 3

870 points

Dec 8, 2019 7:49 AM in response to jfaughnan

... and I switched back to firmware 7.7.9 (elegant interface) and .... it's still broken!

So, by long process of elimination, I'm leaning toward Google having changed something that broke compatibility with AirPort Extreme DHCP (Double NAT). I need the guest network so my solution for now is to run in Double NAT and use my VPN (TunnelBear) when I need to authenticate with Google. Fortunately that's not often. I'll test periodically to see if things change.

Reply

Answer 7

jfaughnan Author

Level 3

870 points

Dec 7, 2019 9:37 AM in response to Tesserax

Thank you! I’m bridge for now and probably indefinitely. I’m curious as to what changed to make double NAT fail, but not curious enough to pursue further.

Reply

Google OAUTH failure with double NAT configuration

Similar questions