What is this Double NAT error I have? Is that why can't connect to Apple TV

I just ran the latest firmware update for the Airport Extreme N and now am also getting the Double Nat error. I clicked on the ignore option to prevent the flashing amber light, but that doesn't solve the problem nor explain why a base station that was working fine and reporting no errors now gives this error. I have the base station configured to access my earhlink dsl link via a static IP (for some reason earthlink dsl refuses to work properly via DHCP). But there were no changes to the configuratin prior to updating the firmware.

Interestingly, my Internet access is currently unaffected.

What's the deal?

I think what you are seeing is two firewalls / two routers / two NAT servers.

One is your Airport Express (AEBS) and I am guessing that the other is your cable or ADSL modem - which often has these features.

The way to get rid of one or the other is to configure one of the units into "bridging mode". (Turning off NAT)
I'd advise logging into your Modem and make sure it is in bridging mode.

Same problem here: I didn't understand at first that the amber light in the Airport Utility was a specific warning, so wasted half an hour re-setting the Extreme to no effect. I've now told it to ignore the 'double NAT' warning, and I'm back to green. But what's the issue in the first place... anyone got any ideas?

This base station has a private IP address on its Ethernet WAN port.

Is the IP address of your WAN port set to/coming up as being in any of the following ranges?

10.x.x.x
172.16.x.x - 172.31.x.x
192.168.x.x

These are the ranges reserved for Private Networks and you should not expect to see them on the WAN port of your router UNLESS your AEBS(n) is behind another router or is being used in bridge mode.

I updated my AEBS a few minutes ago and now I have the yellow light twinkle too. It worked fine before so it must have something to do with the patch. I can't run my AEBS in bridge-mode because my Xbox and other things can't reach my Airport Disk in than.

What to do, what tod do?

MacBook Pro Mac OS X (10.4.9)

comTee,

I'm trying to figure out the circumstances that generate this Double NAT error. Please advise if the IP address on your WAN port is in any of the ranges listed in my immediately prior post in this thread. IMO, such "Double NAT" error shuld nit be reported UNLESS the WAN IP is in one of those ranges.

Thank you.

Bruce,

My IP is within the 10.0.x.x range and I have a ADSL-modem with router and NAT function so that's probably why I get the error. Maybe I get rid of the error if I uncheck the UPnP/NAT function in my ADSL-modem..?

Go to the "Internet" pane of your Airport Utility and where it says "Connection Sharing" change the dropdown to "Off (Bridge Mode)"

That should fix your error.

15" MacBook Pro 2.16ghz Mac OS X (10.4.9) 2gb RAM, 128mb VRAM, 20" Cinema Display (Aluminum), Apple BT MM, Apple Wireless Keyboard

comTee,

I'd be lying if I told you I knew the answer for sure. But I'm assuming since it's acting as a "bridge" it's relying on the firewall from my modem/router. I have a service called Verizon FiOS and the modem which comes with the service also serves as a wireless router with pretty sophisticated network features.

So, in saying that, my set up may be a bit different from yours.

I checked the IP and it is in the 172.16 range, but that is what Earthlink support directed me to use when I set up my original base station (a dual-ethernet). Interestingly, when I configure the AEBS to connect to DSL via DHCP (which never allows access to the Internet) it still uses the 172.16 range. I tried setting the AESB to Bridge mode but that also killed my Internet access.

What I'd like to know is what Apple changed that caused this situation to occur when prior to the firmware update this situation was not happening. Although I suspect part of it may be due to the AESB not having a separate MAC address for the internal network and the WAN like the Dual Ethernet base stations did.

comTee,

OK, that explains why the Double NAT error is occurring. Perhaps this test is a new addition to the Airport firmware which is trying to be helpful.

In your case, and I suspect in the others in this thread, there are two routers back to back, the ADSL-modem w/ router and the AEBS(n). You need the ADSL-modem w/ router to manage your DSL connection, let's assume so as it is an all-in-one solution. You do NOT need the router functions of the AEBS in this environment, in fact it is a detriment to the sharing of your network resources if you have other devices plugged into your ADSL-modem router.

Change the AEBS(n) to operate as a bridge and the error will disappear. All your wireless devices will now be on the same private LAN subnet.

Alternatively, if you want all your network resources to be on the private LAN of the AEBS, then you would undo the NAT functions of your ADSL-modem router, effectively making it the bridge. Now, all your wired devices must plug into the AEBS(n) LAN ports, none into the ADSL-modem/router LAN ports.
If

comTee says...

Does bridge-mode has any effects on programs using NAT and will the AEBS firewall be inactive after that?

Yes and Yes.

Don't do it
Instead. Go to your modem config - write down your PPPoE settings.
Put your MODEM in BRIDGED MODE
Then in Airport Utility - enter those PPPoE settings into the Airport Extreme PPPoE tab.

This error showed up here after the update.
I'm transitioning from an old airport network to the new one and for the moment it's easier to temporarily place the "n" on the ethernet port of the old airport so the explanation here makes sense.
The question is why is it such a big deal. It worked before the update and it works after the update but now the airport is moaning about it.
Anyone know why it's complaining now?

NAT is a bit of a hack.
IP was originally designed so that every computer in the world had a unique number but there are too many computers and not enough digits.

NAT allows several computers to share. So behind the one real IP address can be an entire network. The hack works by gluing on extra addressing info onto each packet that goes through the router. NAT on top of NAT is not a good idea.

If you look at the DUAL BAND networks thread - I suggest that your main router does NAT and DHCP - and the secondary router is put into bridging mode. This makes sense, and means that all the machines on your (two) wireless networks behave as one.

Yeah, I understand the topology and the overhead and also why it's not an ideal solution but it seems to be overkill for the airport to be complaining about it.
Anyway I'll have the new network up and running soon so I'll pass on the configuration idea.
Thanks anyway.