# Router on a stick and double NAT - no internet access



## justinnoor (Feb 23, 2020)

Hello community,

I recently built a router on a stick for the first time using a custom router/firewall device. This device will handle all layer 3 activity, acting as a dhcp server for a Cisco sg-350 switch. Thus far, all of the machines can communicate with others of the same vlan, but none of them can access the internet.

Also this network is double-NATed because I need the features of the custom device, but I’m also forced to use the ISP router. This should not be a problem because this network only needs internet surfing, software installations, updates, etc.

Below is a device in vlan10 - IP address 192.168.10.10. It can ping the 192.168.10.1 interface, but not the internet. I suspect a routing table problem, but I've tried every configuration imaginable. I’m 110% sure the firewall isn’t blocking the traffic. Unfortunately I cannot post any files (no internet), and had to write this from a different machine. Any feedback would be greatly appreciated.


----------



## VladiBG (Feb 23, 2020)

You need nat traslation from 192.168.10.0/24 to any except 192.168.2.0/24 via 192.168.1.66 on em0


----------



## justinnoor (Feb 23, 2020)

VladiBG said:


> You need nat traslation from 192.168.10.0/24 to any except 192.168.2.0/24 via 192.168.1.66 on em0



Yes em0 192.168.1.66 is my egress interface, and is a dhcp client of the ISP router. My NAT rules are:

```
pass out on egress inet from $vlan10:network to any nat-to (egress:0)
```


----------



## VladiBG (Feb 23, 2020)

Is this router OpenBSD?
Use tcpdump and see where the traffic is blocked.


----------



## justinnoor (Feb 24, 2020)

VladiBG said:


> Is this router OpenBSD?
> Use tcpdump and see where the traffic is blocked.


Yes the router is, but I’m using PF on all the machines, including two FreeBSD hosts that attach to the switch. I’ll play with tcpdump and see what I come up with. Thanks for the help.


----------

