I don't have this setup either, but it is preferred by Voipo. It must be secure enough, otherwise you'd be hearing of more ATA's being attacked or hacked.
Ok, I stand corrected. I missed the fact you statically assigned the IP's on the RT with the same subnet.
Router setup:
IP: 172.20.0.1
Subnet: 255.255.255.0
Gateway: 0.0.0.0
DHCP enabled: starting IP pool of 172.20.0.100
RT LAN:
IP: 172.20.0.2
Subnet: 255.255.255.0
Gateway: 172.20.0.1
RT WAN:
IP: 172.20.0.3
Subnet: 255.255.255.0
Gateway: 172.20.0.1
LAN and WAN ports on the RT are set with static IP's which are on the same subnet as the router and do not automatically obtain IP's from the WRT. The RT is acting like a switch as you mentioned, so there's only a single NAT between your public IP and your RT which is good.
I do see a problem as chpalmer pointed out in his post. Your WRT's gateway should be 172.20.0.1 not 0.0.0.0 It's possible when you had the RT's WAN hooked up to the WRT's LAN that the router assigned this gateway to the RT as well. I'm assuming of course that you had the RT automatically obtain its IP address from the WRT's IP pool when you tried it before. You might want to see if that was the problem. If this resolves the issue, then you would want to reserve or assign a static IP for the RT in the router.
Bookmarks