What Is Double NAT? How to Check and Fix It
Double NAT means two routers both doing NAT. It breaks port forwarding and causes strict NAT in games. Here is how to check and fix it.
Double NAT happens when your traffic passes through two devices that both perform Network Address Translation, usually an ISP modem-router and your own router behind it.
Double NAT means two devices both do NAT, usually an ISP modem-router and your own router. Browsing still works, but port forwarding, game hosting and some voice calls can break.
Browsing works fine, but port forwarding, game hosting, VPN servers and some voice calls can break. Consoles often report Strict or Type 3 NAT. Here is how to spot it and fix it.
How double NAT happens
Your ISP gateway gives your own router a private address, such as 192.168.1.2. Your router then gives your devices a second private range, such as 192.168.0.x. Every connection is translated twice, and incoming traffic has to pass both routers.
| Layer | Example address |
|---|---|
| Public internet IP | 203.0.113.45 |
| ISP gateway LAN | 192.168.1.1 |
| Your router WAN | 192.168.1.2 (private: double NAT) |
| Your router LAN | 192.168.0.1 |
| Your device | 192.168.0.25 |
The second private range is the clue I look for first on any setup.
How to check for double NAT
- Log in to your own router and look at its WAN or Internet IP. If it starts with 192.168, 10. or 172.16 to 172.31, you have double NAT.
- Compare that WAN IP with What Is My IP. If they differ, there is another NAT in front.
- A WAN IP starting with 100.64 to 100.127 means carrier-grade NAT from your ISP, which you cannot fix at home.
- Many router apps, like eero and Nest WiFi, warn about double NAT directly.
The WAN address is the check I do before anything else on a suspected double NAT.
How to fix double NAT
- Put the ISP gateway in bridge mode. It stops routing and passes the public IP to your router. Look for Bridge Mode, Modem Mode or Gateway Function in the gateway settings.
- Put your own router in access point mode. If the ISP gateway must stay a router, switch your router to AP or bridge mode so only one device does NAT.
- Use DMZ or IP passthrough. If neither has bridge mode, set the ISP gateway DMZ to your router WAN IP, so all incoming traffic reaches it.
- Forward ports on both. As a last resort, forward the same ports on the gateway to your router, then on your router to the device.
Bridge mode is the fix I reach for first when the ISP box allows it.
When you cannot fix it
If your ISP uses carrier-grade NAT, you share a public IP with other customers. Ask the provider for a public or static IP, use IPv6 where supported, or use a tunnel or VPN service for remote access.
A public IP is the ask I make when the ISP owns the problem.
Does double NAT actually hurt you?
For a lot of homes, honestly, no. Web browsing, Netflix, YouTube and video calls all work fine behind two routers. You only notice double NAT when something needs a connection to come in from the internet rather than go out.
That is where the trouble starts. Online games often show a Strict or Type 3 NAT type, voice chat in party lobbies cuts out, and port forwarding rules you set on the second router seem to do nothing. Security cameras and home servers that you want to reach from outside will usually fail too.
- Gaming consoles: Xbox shows “Double NAT detected” in network settings, PlayStation shows NAT Type 3.
- Remote access: Plex, NAS boxes and camera apps can’t reach home without a relay.
- VPN servers at home: WireGuard or OpenVPN servers stop accepting outside connections.
- Everyday use: mostly unaffected, so don’t panic if you just browse and stream.
Strict NAT on a console is the symptom I hear about most.
Bridge mode vs access point mode: which to pick
Both fixes do the same job, they just switch off routing on a different box. The question is which device you want to keep in charge.
Put the ISP modem in bridge mode
Use this when you own a better router and want it doing all the work: WiFi, DHCP, firewall, port forwarding. The ISP box becomes a plain modem. Some providers call this “modem mode” or “IP passthrough”. If you can’t find it, the ISP’s support line can usually switch it on remotely.
Put your own router in access point mode
Use this when the ISP box is locked down or you need its phone or TV features. Your router stops handing out addresses and just adds WiFi. On TP-Link it’s under Operation Mode, on ASUS it’s Administration then Operation Mode, and on Netgear it’s Advanced Setup then Router / AP Mode.
After either change, restart both devices in order: modem first, wait two minutes, then the router. Then check your WAN IP again on the router status page. If it no longer starts with 192.168, 10. or 172.16 to 172.31, double NAT is gone.
The restart order is the step I never skip after either change.
Double NAT with mesh WiFi and extenders
Mesh systems are the most common way people end up with double NAT without realising it. You plug a new Deco, eero or Nest WiFi into the ISP router, the app sets it up in router mode by default, and now two boxes are both handing out addresses.
The fix is the same idea: let only one device route. In the Deco app it’s under More, Advanced, Operation Mode, then Access Point. In the eero app it’s Settings, Network settings, DHCP & NAT, then Bridge. Google Home calls it Network settings, Advanced networking, Network mode, then Bridge.
Plain WiFi extenders don’t cause double NAT, because they just repeat the existing network. If you see double NAT with an extender, something else in the chain is routing, often an old router someone plugged in years ago and forgot about.
The forgotten old router is the cause I find most often in these cases.
