Don’t Enable Hardware NAT for IPsec VPN

TL;DR – If you have an AmpliFi HD router and need to connect to a corporate VPN, do not check the “Enable Hardware NAT” box in the WebUI.

I’m still working at home (#flattenthecurve) and using my company’s corporate VPN to access private resources in AWS. Today, I ran into an issue where I was able to connect to my corporate VPN using the GlobalProtect client but was not able to connect to AWS servers or even browse the web. I reached out to my team and later our network admin. They didn’t see the issues I was having and suggested that this issue may be on my network.

I started my troubleshooting by power-cycling everything in my network stack, including my laptop. I own an Arris SURFboard modem, an AmpliFi HD router w/ two mesh access points, a 48-port NETGEAR ProSafe switch, and finally I use a USB-C to Ethernet adapter to connect to a wall port in my office. After power-cycling and reconnecting my laptop to my office’s ethernet port, I still couldn’t connect to my VPN and browse the web.

The next step was to remove variables. I plugged my laptop directly into the modem’s ethernet port and I was finally able to connect to the VPN and access our AWS servers. That meant that my laptop and USB-C to Ethernet adapter were working fine. The issue was upstream from my laptop and downstream from the modem. I reconnected the router to the modem and power-cycled them both again. Then I connected my laptop to an ethernet port on the back of the router. The VPN issues were back. This tells me that something was wrong in the router. The router was working fine with the VPN yesterday though and not today, so what changed?

The biggest part of troubleshooting any electronic system that was working one day and stopped working the next is to answer this simple question: what changed? Well, to make a long story short, here’s what I realized.

Last night, I turned off the WiFi on my laptop and plugged in my ethernet adapter to speed up a transfer to my NAS. This morning, I had not turned the WiFi back on; I was only using ethernet. I turned WiFi back on and the VPN started working like normal again! The WiFi network comes from the same router, same subnet, same everything – just wireless. I dug into my router’s WebUI (which has more advanced settings than the iOS app) and saw one setting that might be the culprit. It’s called “Enable Hardware NAT”.

This setting had been enabled since I got the router almost a year ago but I unchecked it and power-cycled the router. Now the VPN works over strictly ethernet connections as well. After doing some research, I found out two things: 1) I don’t need to enable hardware NAT since I don’t have a gigabit home internet connection, and 2) VPNs don’t like to be double-NAT’d.

The crazy thing is that this was only a problem for me today but in truth, the VPN never worked over ethernet in my home. But because my laptop always had the WiFi connection enabled even when using ethernet, I just never noticed.

Advanced Options in Display Calibrator Assistant

TL;DR – Hold the Option key when clicking “Calibrate” in the Displays preference pane to have the option to enable “Expert Mode”.

Like many, I’m now working from home full-time. To help my home office, I bought an LG 29WK50S extra-wide monitor. It’s inexpensive and gets the job done a bit better than my previous external monitor. Once I got it mounted on my monitor arm and set at the right height, then came the annoying but necessary task of calibrating the color settings.

The monitor itself has the standard options for adjusting the brightness and contrast, and some pre-configured monitor modes which affect color temperature as well. And… that’s it. This is where Apple’s Displays pane in System Preferences comes in and will allow you to calibrate the display even more. Clicking the “Calibrate” button will open the Display Calibrator Assistant. By default, the Assistant limits your options to basically just adjusting the Target White Point. That’s good but not enough. In previous OS releases, there used to be an option to enable “Expert Mode” which would also give you control over Native and Target Gamma.

To get that checkbox back, you just need to hold the Option key on the keyboard and then click the “Calibrate” button. Boom! There’s the checkbox. IMO, this checkbox should always be there and just unchecked by default instead of hiding it.