Double NAT: What It Is, How to Check for It and How to Fix It

Double NAT is one of the most common side effects of adding your own router or mesh system to a provider’s gateway. Everything seems to work — until a game console reports a strict NAT, port forwarding has no effect, or a VPN refuses to connect. Here is what is going on and how to fix it, based on NETGEAR’s and Google’s own guidance.

What Double NAT Is

Network address translation (NAT) is what lets all your devices share the single public IP address your provider gives you. The router replaces the private addresses of your devices with that public address on the way out, and keeps track of which reply belongs to which device. As NETGEAR describes it, NAT also protects the network by blocking direct access to local addresses from outside.

Double NAT means this happens twice in a row. The typical setup:

1. The provider’s gateway (a modem and router in one box) performs NAT and creates a private network, for example 192.168.1.x.
2. Your own router or mesh system is plugged into that gateway and performs NAT again, creating a second private network, for example 192.168.0.x.

NETGEAR’s summary: because each router performs NAT, your network is split into two different private networks. The same happens when two separate routers are connected one behind the other, for example an old router kept “for the extra ports” in front of a new one.

Does It Matter?

For browsing, streaming and video calls, usually not. Google notes that for most people double NAT does not create a noticeable effect on network performance.

It does matter for things that need incoming connections or must find devices on the network. NETGEAR lists problems with:

• online games — a Strict or Moderate NAT type, failed voice chat and matchmaking;
• VPN connections, especially when you host a VPN server at home;
• port forwarding and port triggering — rules set on your router never receive traffic, because the gateway in front of it drops it;
• some secure (SSL) websites.

Devices on the two networks also cannot see each other easily. A printer or a smart speaker connected to the gateway’s Wi-Fi may be invisible to a phone on your own router’s Wi-Fi.

How to Check for Double NAT

Look at your router’s internet (WAN) address. Sign in to your router — see what is my router IP — and open the status page. The WAN or Internet IP address tells you everything:

• If it starts with 192.168., 10. or 172.16.–172.31., it is a private address: there is another router in front of yours, so you have double NAT.
• If it starts with 100.64.–100.127., your provider uses carrier-grade NAT; see the section below.
• Anything else is a public address: your router is the only NAT in your home.

Compare with your public IP. Our What is my IP page shows the public address the internet sees. If it differs from the WAN address on the router’s status page, there is at least one more NAT in between.

Check the console. Xbox shows a “Double NAT detected” warning in its network settings, and PlayStation reports NAT Type 3 in many double NAT setups. See NAT type strict.

Count the boxes. If the provider’s device has Wi-Fi of its own and your router is plugged into one of its LAN ports, you almost certainly have double NAT.

How to Fix It

There are three ways. NETGEAR recommends the first one for the best performance.

1. Put the provider’s gateway in bridge mode

Bridge mode (sometimes “modem mode” or “IP passthrough”) turns off the routing part of the gateway. It then works as a plain modem and passes the public IP address on to your own router, which becomes the only NAT. The setting is usually in the gateway’s web page or app; the name and location differ by provider, so check your provider’s support pages. Some gateways cannot do it, and some providers do not allow it.

After switching to bridge mode, restart your router so that it picks up the public address. The gateway’s Wi-Fi stops working, which is what you want — your own router or mesh now provides Wi-Fi.

2. Put your own router in access point mode

If the gateway cannot be bridged, NETGEAR’s alternative is to turn off the gateway’s Wi-Fi and switch your own router or mesh system to access point (AP) mode. Your router then only provides Wi-Fi and Ethernet ports, and the gateway does all routing. The cost: features of your router such as parental controls, QoS and its own port forwarding no longer apply, because NETGEAR notes some router features are disabled in AP mode. Our guide on using a router as an access point shows the steps.

3. Remove the extra router

If the provider gave you a separate modem and router, Google recommends simply unplugging the provider’s router and connecting the modem directly to your own router or mesh. The same applies to an old router kept in the chain only for extra ports — replace it with a switch; see network switch vs router.

If you cannot change the setup

As a workaround, forward the needed ports twice — on the gateway to your router, and on your router to the device — or set your router’s address as the DMZ host on the gateway. The DMZ option sends all unsolicited traffic to your router, which keeps its own firewall, so it is safer than putting a console or PC in the DMZ directly. See how to port forward.

When the Second NAT Is at Your Provider

If your router’s WAN address starts with 100.64.–100.127. or another private range even though nothing sits in front of it, the second NAT is in your provider’s network. This is carrier-grade NAT, and you cannot fix it at home. Ask the provider for a public IPv4 address, or use IPv6 if the provider supports it. Details: what is CGNAT.

How to Avoid It in the First Place

When you add a router or mesh system to a provider’s gateway, decide right away who does the routing: either the gateway goes into bridge mode, or your new device goes into access point mode. Setup guides for TP-Link, NETGEAR and ASUS routers cover this step, and modem vs router vs gateway explains which box you have.