I don’t think, ‘double NATing’ is the real problem. But switching these modem/routers into router mode usually activates firewall functions also, not all packets directed to my endpoint reach the red interface of IPFire.
Some thoughts about internet traffic with NAT and firewalls:
- two applications communicate using the addresses <IP1>:<port1> and <IP2>:<port2>. Example: desktop 12.34.67.89 sends from port 56234 requests to we server 98.76.54.32:80.
This demands both globally unique IPs of the two devices. - to reduce the amount of necessary addresses, NAT allows a structuring into sub nets. Private IPs are matched to one public IP. Ports chosen by the end device are mapped to a unique port of the concentrator device ( router ).
- this allows regualation of the connections <local device> <—> <remote device>, called firewall. Especially it is possible to deny accesses from outside ( connections initiated by a device in WAN ).
- to allow access to single applications in the local net ( a server, e.g. ) you can define port forwards. A destination address <public IP>:<server port> is translated to <private IP>:<app port>, where private IP is the local IP of the device serving the application. This demands a ‘static’ definition of the application port.
- to allow a ‘dynamic’ definition protocols are defined to set these port forwarding rules ‘on the fly’. PCP is one of them.
- this inhibits the sole decision of the firewall gateway, IMO. An arbitrary device inside the protected local network can ‘drill holes into the wall’. This can originate in malware installed on this device.