Agree about the quick part and that you don't need to depend on a bunch of routers to build an elaborate network. But it's easy to do and allows repurposing of equipment you may already own (or future repurposing routers that've been puchased for an existing install).
I've been double NATing for 10+ years. What parameter(s) might've I've been misconfiguring that have always allowed me to browse and manipulate shares located on upstream connected devices (yet never allowed when trying to connect to downstream devices)?
"SMB/CIFS broadcasts shouldn't propagate through the NAT" shouldn't really matter, right (actually I think it's NetBIOS though -- I didn't think SMB does any broadcasting on its own)? I'm already "un-NATed" when messing with upstream devices.
Makes me wonder why some large corporations utilize multiple NATing. Why do they do it?
I've never really encountered that - Shares available downstream. There are certain ways I suppose, with consumer/ prosumer routers that it can work. The NAT router would need to allow and proxy the broadcast traffic through. In some instances, you simply have no control over this.
Generally, you can have the downstream router point to public DNS rather than the upstream router for DNS to avoid propagating the ARP resolved hostnames on the first tier router. Disable any dynamic routing (RIP and such) as well as making sure that the SPI is configured for the strictest settings (available on some Dlink routers). Beyond that, there is little control if the router has a decent IGMP proxy on it that can't be turned off.
In other instances, your router might actually have some simple form of dynamic routing (RIP) that isn't turned off or can be controlled off the web UI.
I've seen RIP being available (through WebUI) on some DLink and TP-Link routers in the past though they most certainly are disabled by default.
That said, it's far less common to see CIFS shares work across the NAT. I've been called in to 'fix' such networks in the past. The ISP provided CPE provides NAT and the customer has their own 'firewall' providing a double NAT. The usual complain is that some wireless clients can connect to the file-shares but not the wired clients.
In these instances, it's almost always because the NAS is connected to the ISP CPE (which also provides wifi for upper management). Usually, it's just a matter of reconfiguring their firewall and router as well as swapping links on the servers and NAS where need be.
Half the time, the initial network is a hackjob performed by a freelance 'it guy' or some intern who was tasked with the job because his/ her area of studies say 'Computer Engineering' or 'Business IT'.
The layman seems to think that you can do everything from programming to networking to fixing any appliances running off electricity just because your diploma or degree says computer or IT in it.
I've encountered some scenarios where the client has a NAS behind a double-NAT router. The upstream devices cannot see or connect to the NAS and the upper management switches to the downstream NAT router's wifi network to access the NAS.
It's a goofy setup at best and very sad to see when it's setup by a person who's paid for 'professional services'. i.e. Not some intern who was tasked with the thankless job.
In at least one such situation, the laptops were even configured to run with Outlook's PST files residing on the mapped drives. Thankfully, it was only the archived emails but it lead to plenty of errors with Outlook when the user plugged in the network cable (goes to the first tier NATed network).
