[Q]: What is the difference between NAT mode and Router?
[A]: The main difference is that users from outside (WAN side of the gateway) are unable to directly see the users inside (on the LAN side) the Gateway, when the Gateway is in NAT mode - please refer to the following diagrams. In addition, in Router mode, clients on the LAN side can be configured with public IP addresses.
[Q]: Why authentication fails when the Gateway is in Router mode? (The RADIUS setting of the AP is pointed to the external RADIUS server directly, instead of the gateway: AP ↔ Gateway ↔ Router ↔ RADIUS server)
[A]: This could be due to that the routing rules of the routing device on the WAN side cannot route the traffic to the AP. Normally, when the Gateway is in Router mode, the routing device on the WAN side must have the corresponding routing rules. Otherwise, traffic to this router would go through its default route, which is not to the Gateway.
[How-to Router mode example]