Double NAT problem USG20W-VPN

bdb Posts: 11
edited April 2021 in Security


I'm getting nowhere with my double NAT problem and I need your help.

I have the following structure, which I cannot realize otherwise.

How can I realize that I can access the server behind the USG from the address range

I would also like to know how I can disable the log for port up/down.

Thanks for your help!

Accepted Solution

All Replies

  • bdb
    bdb Posts: 11

    here is the right plan

  • bdb
    bdb Posts: 11

    USG as main router is unfortunately not possible. Bridge does not work either, see screenshot. How can I fix the bridge problem?

    In the fritzbox I set a static route and in the USG the NAT accordingly. Now it works THANK YOU

  • PeterUK
    PeterUK Posts: 1,400  Guru Member
    edited August 2019

    For the Bridge you put in br0 then then the members like WAN and DMZ but if you got statc route to work no need.

  • ChrisGer
    ChrisGer Posts: 204  Ally Member

    Hi @bdb

    it looks like, you are useing the fritzbox for VoIP and router from your ISP.

    As already mentioned by @PeterUK , you should be able to config a routeing rule at the fritzbox, that forward all traffic from 192.168.1.x to (WAN interface USG20).

    At the USG20 you had to disable the SNAT to forward the traffic to the fritzbox and avoid double snat first.



  • Zyxel_Cooldia
    Zyxel_Cooldia Posts: 956  Zyxel Employee

    Hi @bdb

    You can disable default snat at “CONFIGURATION > Network > Interface > Trunk”

    BTW, you have to add static route on upper layer router for subnet 192.168.1.X/24.


    Click “Show Advanced Settings” and untick “Enable Default SNAT”

  • bdb
    bdb Posts: 11


    first of all thank you for your help.


    Yes, i use from the FritzBox VoIP and ISP.


    disabling Enable Default SNAT alone does not help.

    Under "Default Truk Selection" I don't have to set anything?

    With the USG20 I enter the following under Static Route:

    IP: (the IP range of the USG?)

    Do I then enter a gateway or do I select the WAN interface?

  • ChrisGer
    ChrisGer Posts: 204  Ally Member

    Hi together,


    disableing the SNAT is only one part and do not fix the double SNAT as described.

    In your case

    All traffic from the Devices, that are attached to the USG is by default routed trough the WAN Port to the FritzBox -> that's by default working.

    You have to tell the FritzBox (by static route settings) where the reply package for the Subnet(s) on your USG should send to - in your case - IP-Subnet should be send to the WAN-IP of the USG.

    If you require a connect to the FritzBox Network, make a static route on the USG and configure the FritzBix Subnetz (Gateway) to get connected to your fritzBix Webinterface.

    Good Luck


  • bdb
    bdb Posts: 11

    So far I have set a static route in the FritzBox: (IP) (USG)

    And a NAT rule in the USG:

    Virtual Server

    WAN - ext.IP (

    LAN - int.IP (Server

    Release for corresponding services

    A security policy:

    For the services of the server

    From the network of the Fritzbox ( I get access to the services of the server.

    Other settings failed so far.

    But this doesn't work:

    IP-TV of the Fritzbox I can't get into the network of the USG. According to the log the default rule blocks the traffic from to (probably a mulicast service).

    I tried different security guidelines but the firewall always drops.

    I also can't get a VPN connection to the USG.

    I activated the port forwarding in the FritzBox accordingly in the log but always no proposal chosen.

  • ChrisGer
    ChrisGer Posts: 204  Ally Member

    Hi @bdb

    IPTV require IGMPv2/3 support by the firewall/router device.


    can you please verifiy, what USG devices are supporting IGMP v2/3 regular by ZYXEL ?

    Here the config in a example (please change the IP as required for your infrastructure):



    Static route - next hop (FB-IP)!




    Static route - next hop (WAN1-IP)!

    Good luck


Security Highlight