VPN setup with double-NAT with Multi-WAN

Routers
1

Hello there,

my original problem is that I cannot establish a VPN connection to my GL-X3000 router which sits behind another modem with NAT.
I have setup and bought this router primarly because of the Multi-WAN feature as my ISP connection is not stable (PLC connection and vDSL are on the same frequencies, but I need both).

This is my setup:

ISP → FritzBox/Modem with DHCP Server → WAN-Port of GL-X3000 → Home Network
SIM → setup through GL-iNet interface as Multi-WAN fallback

For VPN:
Modem has setup NAT forwarding for respecting port to GL-X3000 (5000) with UDP protocol.
GL-X3000 NAT port forwarding from source port to port of NAS server with VPN is setup with UDP protocol.

What does work:
ISP → modem with NAT forwarding → NAS (VPN can be established, NAS only temporary inside this network for testing)
Network of modem → VPN connection to VPN server of GL-X3000 network

What does not work (double-NAT):
Phone in outside network → ISP → modem with NAT forwarding → GL-X3000 with NAT forwarding → NAS with VPN Server

Now my 2 ideas:

  • What can I do to fix the double-NAT setup? Is there a setting in GL-X3000 which I can set or in the OpenWRT settings? Should I switch to the GL-X3000 as a VPN server?
  • I do not strongly need double-NAT. Can I configure the Multi-WAN service of the GL-X3000 to use the network of the modem as default and the SIM network as backup? In this setup I would put my modem in client mode and have it as part of my normal home network (192.168.0.0/24 → Modem e.g. 192.168.0.100 and GL-X3000 on 192.168.0.1)

Looking forward for some feedback to solve this issue swiftly! :slight_smile:
Thank you

3

The easiest thing to do would be to put the GL-X3000 on the upstream's DMZ. Expose it directly to the WAN. I would think a FritzBox has a DMZ option but I've never used one.

I assume you're using WireGuard. The default WAN-side port used is UDP/51820 but whatever works best for you.

1 Like
4

Hello,

Thank you for the suggestion! Unfortunately, FRITZ!Box only allows the option of an „exposed host“ and does not feature a DMZ option.

So I still have the problem of a double NAT with this feature.

Probably tailscale / headscale would also solve my needs. But would be better to solve it with a simple wireguard option. I think my synology NAS uses an OpenVPN server. I also use a custom port for my VPN.

Next, I try to use the openguard server directly in the GX-3000 router.

5

An exposed host sits in the DMZ. It is exposed without NAT to the WAN — the Internet.