Using LTE Modem with VyOS double-nat


Hello, i recently bought a Huawei E3372 Hi-Link LTE Dongle and got a data simcard from work to provide 4G failover at home.

So far im able to get a Ethernet interface out of the dongle (plug and play no magic) i get my VyOS router to have as IP and the dongle has as IP, and when i ping the dongle IP it seems to vary a lot in response times ( as if im pinging the 4G cell tower) so that is a good start. Also i have tested the modem on my laptop without configuring it beforehand and it auto connects to the Internet so it is autoconfigured.

My own minor problem is that since the modem is a router in it self and it means it is a double nat configuration which i cant seem to find a reliable source for. This prevents me from pinging and reach the overall outside Internet via the 4G connection.

Config used:
set protocols static route next-hop XXXX (Fiber line static route)
set protocols static interface-route next-hop-interface eth5 distance ‘255’
set interfaces ethernet eth5 address ‘’
set interfaces ethernet eth5 description ‘4G Failover’
set interfaces ethernet eth5 duplex ‘auto’
set interfaces ethernet eth5 hw-id ‘0c:5b:8f:27:XX:XX’
set interfaces ethernet eth5 smp-affinity ‘auto’
set interfaces ethernet eth5 speed ‘auto’

Commands used:
fma@glos1ce1dk:~$ ping interface eth5
PING ( from eth5: 56(84) bytes of data.
From icmp_seq=1 Destination Host Unreachable
From icmp_seq=2 Destination Host Unreachable
From icmp_seq=3 Destination Host Unreachable

fma@glos1ce1dk:~$ ping interface eth5
PING ( from eth5: 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=58.1 ms
64 bytes from icmp_seq=2 ttl=64 time=16.7 ms
64 bytes from icmp_seq=3 ttl=64 time=14.7 ms

fma@glos1ce1dk:~$ show ip route
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
> - selected route, * - FIB route, q - queued route, r - rejected route

S>* [1/0] via XXX.XXX.XXX.XXX, bond0.200, 00:12:54
S [255/0] is directly connected, eth5, 00:17:27
S [254/0] unreachable (blackhole), 00:22:55
S>* [1/0] is directly connected, wg3, 00:22:56
C>* is directly connected, bond0.101, 00:23:02
S>* [1/0] is directly connected, wg3, 00:22:56
C>* is directly connected, wg3, 00:22:57
C>* XXX.XXX.XXX.XXX/XX is directly connected, bond0.200, 00:15:35
S>* [254/0] unreachable (blackhole), 00:22:56
S>* [254/0] unreachable (blackhole), 00:22:56
C>* is directly connected, eth5, 00:23:14
C>* is directly connected, dum0, 00:23:17

Can anyone help ?
Currently i have looked at forum posts here and on OpenWRT to get a general idea.


Just out of interest, have you got a source NAT rule that will masquerade out-bound eth5 ?

I think that might be the issue here.


As long as you have a proper nat source rule you should be good. also, you mentioned that this particular modem is also a router? This reminds me of Cradle Points which can route using static routes or dynamic routes as well. Make sure that your wireless modem knows how to get to the subnets behind it (The subnets on the other side of your VyOS router).

To simplify, you could attempt to put the wireless modem into bridge mode, and pass the outisde publicly routable address directly to your interface in VyOS.


Ye sorry i forgot to add that nat rule above in the first text. Yes just a regular masquerade nat rule with eth5 as outbound.


Ye this huawei modem acts as a router on stick. So it assigns to point at the GW for the LTE network so if VyOS pings that it is already NAT but i can access a website on which has the modems web interface so in that case i must assume there is a return route for traffic as i would not have been able to access the web interface.

Sadly the modem web interface does not appear to have a bridge modem setting else i would have done that instead as you also mentions due to KISS (keep it simple stupid).


i had to change to dhcp on the modem and do the following:

set protocols static route dhcp-interface eth5

that fixed my problem. Only issue now is that i cannot add distance to the static route so both my WAN and the failover has 1 in distance.