Router behind Router and external access

[Kamikaze01]

Hello dear Network friends

I have a RT-AC68U with merlin 384.13

Previously I had my modemrouter from ISP operated in bridge mode and behind the RT-AC68U.
Everything was perfect: VPN, my NAS (externally accessible via DDNS and HTTPS from LetsEncrypt), etc ...

Since a few days I have another ISP, which now provides a Fritz!Box 7530 as a modemrouter.
However, this modemrouter can not be operated in bridge mode *ARGH*

You will already be able to think of my question:
How can I operate my ASUS router behind this Fritz!Box the same way as before?
How can i access my devices externally?

Internet itself works normally and my ASUS also distributes the IP addresses in range 192.168.1.0/24
In the WLAN of ASUS (2nd router behind router), I can also access both devices.
1st Network (Fritz! Box) is 192.168.178.0/24
2nd Network (ASUS) is 192.168.1.0/24

I can no longer access my NAS externally.
Not even about the direct IP?!!?
Also the LetsEncrypt certificate does not work anymore.
In the DDNS update settings, I have set it to "external", but i got wrong ip in my DDNS account.

In the end, i disable DDNS settings and LetsEncrypt in ASUS, but still can not reach from external via HTTP (even with plain IP)

I have the same port forwarded in both devices
I have even set my ASUS router as an "Exposed Host" in the Friz!Box

Is it possible, that my new ISP block external access to the modemrouter for security reason?!!?

Can someone help me with the configuration? How can I reach my NAS externally via a URL and via HTTPS?

Thank you very much

 

[Greg72]

I cannot remember if the Fritz box allows for DMZ(+) mode or not. If you can set it for DMZ, go that route.

 

[PolarBear]

How can I reach my NAS externally via a URL and via HTTPS?

If I understand correctly, your system looks as follows:
ISP ----> FRITZ!Box 7530 ----> Asus RT-AC68U ----> home network


Apart from the DMZ suggestion mentioned by Greg72 above, another way might be to set up port forwarding on your ISP's FRITZ!Box modemrouter to forward incoming OVPN traffic to your RT-AC68U. (You mentioned that you already have a VPN set up, which worked with your old modem.)

In the FRITZ!Box modemrouter, you would also have to assign a fixed IP to your Asus RT-AC68U, and then use this IP in your port forwarding rules.

A few days ago I had to set up something similar. In this case, the ISP's modem was a FRITZ!Box 7390, which it seems also cannot be set up in bridge mode. Perhaps the menu structure of the 7530 is similar and the same method would work for you.

In case it is helpful, here are some notes I prepared in case I have to set it up again.

 

[dosborne]

Personally I like and recommend a double NAT setup. The ISP is happy as they are essentially unaware and you retain complete control over your own internal network as an isolated unit. All you need to do is port forward the vpn. It then is simple if you change ISPs, or upgrade equipment down the road. I just added a second ISP to my setup and was running in 5 minutes. Took longer to get the shrink wrap off the box.

 

[Kamikaze01]

Thanks for all your help.

I did not have to use the FritzBox, as I can simply connect my ASUS direkt behind the ONT box.

As I have a static IP from my ISP, I just have to put the PPPoE login dates in the ASUS and set VLAN ID to 31.
Now everything works like a charm.

No need of FritzBox - Problem solved (for me).