Need clarification of double-NAT

i have a peplink balance 305 router with 2 sources of internet plugged into WAN1 & WAN2 on the balance 305
Both WAN connections are configured for DHCP

My first internet source is a Pepwavce MAX BR1 cell modem/router.
My second internet source is a Starlink router in by-pass mode

My confusion is, i can plug a laptop into a lan port on the max BR1 and get to the internet, by-passing my house LAN - is the MAX BR1 in bridge mode by default? (NO) because i can plug into LAN port and get a DHCP address and get to the internet.
My Starlink router is in bypass mode (bridge mode) - if i plug my laptop into the only ethernet port on the starlink router, it gives my laptop a DHCP ip address and i can get to internet.

So, the question is, what is the difference between the two intnernet sources in regards to double nating? The starlink router is a single DHCP server and gives me IP Address and the max br1 modem/router is a multi-DHCP server.

Thanks in advance

From the BR1 you are almost certainly behind multipler layers of NAT/CG-NAT in the cell providers network before it even gets to you. The BR1 can be setup to bridge the IP of the cell modem directly to a single client on the LAN side, but as mentioned you’re still likely behind the cell networks multipler layers of NAT so that doesn’t really gain you much.

From Starlink - that depends. There are some folk saying that when it is in bypass mode they have been given a routed public IPv4 address for the single device connected to the router, there are also people who say they get CG-NAT addresses.

If you have a need to do some port forwarding to devices behind your Balance via a stable public IP I’d look at deploying a FusionHub Solo somewhere and tunnel traffic via it.

By default a BR1 is in NAT mode as you say and a device connected to it will get an IP in the 192.168.50.x range.

When directly connected to the Starlink you will get a “Carrier Grade NAT” (CGNAT) IP (100.64.0.0 to 100.127.255.255)

This is still NAT, and you are still getting a private IP, its just NAT provided by Starlink’s private network rather than your own local network.

Very little difference from a practical perspective - both use NAT via routers you have no control over (one in Spacex perimeter, the other on your cellular providers network). Neither will allow inbound port forwarding (unless you have a posh SIM with a public IP).

The BR1 can be setup to bridge the IP of the cell modem directly to a single client on the LAN side, but as mentioned you’re still likely behind the cell networks multipler layers of NAT so that doesn’t really gain you much.

Been a long day, so this is probably a stupid question, but I’m curious. If you are already behind 1 layer of NAT with a cellular connection for example, are there situations where adding a second layer of NAT will make any difference to any real world applications or create unexpected side effects?

If by default on a cellular pepwave we’re doing two layers at least of NAT, e.g.
public IP 174.222.44.xxx → cellular wan IP 10.100.120.xx (1 level of NAT) → pepwave LAN NAT 192.168.50.0/24 (double NAT)
does adding a third level of NAT by connecting another peplink router 192.168.60.0/24 router add any additional problem, or are we already experiencing any double NAT issues that would be the same with triple NAT?

After double NAT any additional levels of NAT just bring the same issues but with more steps / NAT stages. There are no issues you’ll see on triple or quad NAT that you wouldn’t have already experienced in double NAT topologies.

2 Likes