A practical deployment guide for carrying inbound UDP tunnel traffic through two consecutive NAT gateways and validating end-to-end overlay reachability
Deploying an SD-WAN Hub with a direct public IP is straightforward, but enterprise environments often place the Hub behind multiple internal firewalls or nested ISP routers. When the Hub sits two layers deep behind NAT (Double-NAT), unsolicited inbound tunnel traffic from remote Spokes cannot reach the appliance unless the translation path is explicitly built. A two-stage UDP port-forwarding chain solves this by carrying the tunnel transport traffic across both NAT boundaries to the Hub WAN interface.
In this deployment, the SD-WAN Hub has no direct public exposure. Incoming packets from remote Spokes must cross two independent gateways, with each gateway translating the destination toward the next hop.
Figure 1. Inbound tunnel traffic from the Spoke crosses two DNAT stages before reaching the Hub WAN interface.
| Segment / Device | Role | IP Address / Interface | Port / Traffic |
|---|---|---|---|
| Edge Perimeter | Inbound Gateway | Public WAN IP | UDP 5085 |
| Intermediate Router | Stage 1 destination / Stage 2 ingress | 192.168.160.149 | UDP 5085 |
| SD-WAN Hub Appliance | Stage 2 destination (physical WAN) | 192.168.69.168 | UDP 5085 |
| Hub Overlay Tunnel | Site-to-site virtual interface | 172.16.30.1/23 | Encapsulated payload |
| Spoke Overlay Tunnel | Remote virtual interface | 172.16.30.2/23 | Encapsulated payload |
| Hub Subnet | Local area network | 10.10.30.0/24 | Local LAN |
| Spoke Subnet | Remote area network | 10.10.40.0/24 | Remote LAN |
In this deployment, UDP port 5085 is configured as the SD-WAN tunnel transport port. Both NAT devices therefore need a static Destination NAT (DNAT) rule for the same UDP port. The rules form a chain: the first gateway forwards to the second gateway, and the second gateway forwards to the Hub.
| Source | Any permitted internet source |
| Protocol | UDP |
| Destination port | 5085 |
| Forward to IP | 192.168.160.149 |
| Forward to port | 5085 |
| Source | Traffic arriving from Stage 1 / permitted sources |
| Protocol | UDP |
| Destination port | 5085 |
| Forward to IP | 192.168.69.168 |
| Forward to port | 5085 |
A device on the Spoke LAN (10.10.40.100) sends traffic to a server on the Hub LAN (10.10.30.234). The Spoke SD-WAN appliance encapsulates the inner packet inside the overlay transport and sends it toward the Hub public IP on UDP 5085.
The edge router receives UDP 5085, matches the Stage 1 DNAT rule, rewrites the destination to 192.168.160.149, and forwards the packet toward the intermediate router.
The intermediate router receives the forwarded packet, matches Stage 2, rewrites the destination to 192.168.69.168, and delivers it to the Hub physical WAN interface.
The Hub processes and decapsulates the overlay packet, then routes the inner IP traffic through the SD-WAN overlay and local routing table to 10.10.30.234.
After the two-stage forwarding chain is active and the overlay is established, verify end-to-end routing in both directions. The following lab outputs confirm successful reachability across the Hub and Spoke subnets.
Command executed from a workstation on the Hub network (10.10.30.x):
C:\Users\Admin>ping 10.10.40.100
Pinging 10.10.40.100 with 32 bytes of data:
Reply from 10.10.40.100: bytes=32 time=67ms TTL=126
Reply from 10.10.40.100: bytes=32 time=63ms TTL=126
Reply from 10.10.40.100: bytes=32 time=67ms TTL=126
Reply from 10.10.40.100: bytes=32 time=71ms TTL=126
Ping statistics for 10.10.40.100:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 63ms, Maximum = 71ms, Average = 67ms
C:\Users\Admin>tracert 10.10.40.100
Tracing route to LAP-NETWORK-10 [10.10.40.100]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms HUB-PORT.lan [10.10.30.1]
2 53 ms 39 ms 59 ms 172.16.30.2
3 53 ms 58 ms 59 ms LAP-NETWORK-10 [10.10.40.100]
Trace complete.
Command executed from a workstation on the Spoke network (10.10.40.x):
C:\Users\Admin>ping 10.10.30.234
Pinging 10.10.30.234 with 32 bytes of data:
Reply from 10.10.30.234: bytes=32 time=70ms TTL=126
Reply from 10.10.30.234: bytes=32 time=49ms TTL=126
Reply from 10.10.30.234: bytes=32 time=48ms TTL=126
Reply from 10.10.30.234: bytes=32 time=69ms TTL=126
Ping statistics for 10.10.30.234:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 48ms, Maximum = 70ms, Average = 59ms
C:\Users\Admin>tracert 10.10.30.234
Tracing route to ROOT [10.10.30.234]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms Spoke-device.lan [10.10.40.1]
2 46 ms 38 ms 58 ms 172.16.30.1
3 48 ms 47 ms 58 ms ROOT [10.10.30.234]
Trace complete.
If the tunnel does not establish or LAN-to-LAN traffic fails, validate the forwarding chain from the outside inward. A failure at either NAT stage prevents the Hub from receiving the UDP tunnel traffic.
| # | Check | What to verify |
|---|---|---|
| 1 | Public reachability | Confirm the outer gateway has a true reachable public IP and is not itself behind ISP CGNAT. |
| 2 | Stage 1 DNAT | Verify UDP 5085 on the public WAN is forwarded to 192.168.160.149:5085. |
| 3 | Stage 2 DNAT | Verify UDP 5085 reaching the intermediate router is forwarded to 192.168.69.168:5085. |
| 4 | Firewall policy | Confirm UDP 5085 is permitted on both gateways and on the Hub WAN policy. |
| 5 | Service binding | Confirm the SD-WAN Hub is listening on the expected UDP transport port/interface. |
| 6 | Routing | Confirm 10.10.30.0/24 and 10.10.40.0/24 are installed and reachable through the overlay. |
| 7 | Symmetry | Check that return traffic follows the same stateful NAT path and is not diverted by asymmetric routing. |
| 8 | Packet capture | Capture UDP 5085 at each hop to identify the exact stage where packets disappear. |
Double-NAT does not prevent an SD-WAN Hub from supporting inbound tunnel establishment; it simply requires a complete, deterministic translation path through every NAT boundary. In this topology, forwarding UDP 5085 from the public edge to 192.168.160.149 and then to the Hub WAN at 192.168.69.168 provides that path. The successful ping and traceroute results in both directions demonstrate that the overlay is established and that the Hub and Spoke LANs can communicate end to end.
