How to Detect and Fix Double NAT Issues (Bridge Mode & More)

A Double NAT problem happens when two devices on your home network are both acting as routers and performing Network Address Translation (NAT). This commonly occurs when you connect your own router behind an ISP-provided modem-router gateway.

For standard web browsing, you might never notice it. But Double NAT can cause headaches with:

• Online gaming and Strict/Moderate NAT types (Xbox, PlayStation, PC)
• Port forwarding and hosting servers
• Remote desktop and incoming camera access
• Certain VPN tunnel protocols
• Smart-home devices that require direct incoming connections

The good news is that you don't need to guess whether Double NAT is causing your connectivity issues. You can identify it quickly by checking your router's Internet/WAN IP address and tracing your equipment layout.

What Is Double NAT?

NAT allows multiple devices in your home to share one internet connection and public IP address. In a standard home network:

Internet → Modem → Router (NAT) → Your devices

In this setup, a single router handles NAT and issues local IP addresses.

A Double NAT setup looks like this:

Internet → ISP Gateway (NAT #1) → Personal Router (NAT #2) → Your devices

Both the ISP gateway and your personal router are performing address translation, creating two separate private subnets:

• ISP Gateway: 192.168.1.1 (Subnet A)
• Your Router WAN IP: 192.168.1.50 (Receives private IP from Gateway)
• Your Router LAN Gateway: 192.168.0.1 (Subnet B)
• Your End Devices: 192.168.0.x

Your personal router is receiving a private IP address from another router instead of connecting directly to the public internet.

How to Detect Double NAT

Method 1: Check Your Router's WAN IP Address

This is the fastest and most reliable method. Log into your router's admin panel and look for a section called Internet, WAN, Internet Status, Connection Status, or Network. You can usually access your router by entering its local gateway address such as 192.168.1.1 or 192.168.0.1 in your browser. (If you're unsure how to log in, read our router admin login guide).

Look at the assigned WAN IP address (or Internet IP). If it falls within any of the standard RFC 1918 private IP ranges, your router is sitting behind an upstream private network:

Private IP Range (RFC 1918)	Subnet Class	Common Home Usage
10.0.0.0 – 10.255.255.255	Class A (/8)	Common on Xfinity / Comcast Gateways (10.0.0.1)
172.16.0.0 – 172.31.255.255	Class B (/12)	Enterprise gateways and guest subnets
192.168.0.0 – 192.168.255.255	Class C (/16)	Default home routers (192.168.1.1, 192.168.0.1)

Example: If your personal router has a LAN IP of 192.168.0.1, but its WAN IP reads 192.168.1.25 (or 10.0.0.15), that strongly proves an upstream modem/gateway is routing traffic in front of it.

Important: Don't Confuse Double NAT With CGNAT

A non-public WAN IP address does not automatically mean you have two routers inside your house. Many modern ISPs (especially fiber, fixed wireless, and mobile 5G internet) use Carrier-Grade NAT (CGNAT).

CGNAT means your internet provider shares a single pool of public IP addresses across multiple residential customers. The dedicated CGNAT address block is:

100.64.0.0 to 100.127.255.255 (CIDR prefix 100.64.0.0/10)

If your router's WAN address starts with 100.64.x.x through 100.127.x.x, the NAT is occurring on the ISP's upstream infrastructure. Putting your router into Bridge Mode will not fix CGNAT; you must contact your ISP to request a dedicated static or dynamic public IPv4 address.

Method 2: Compare Your WAN IP With Your Public IP

Compare the WAN/Internet IP shown inside your router's dashboard with your public IP address (which you can check on our IP Address Checker tool). If the IP shown in your router is private (or in the CGNAT block) while your public IP is completely different, an upstream device is performing NAT.

Method 3: Look at Your Physical Network Equipment

Inspect the hardware chain connecting your home to the wall outlet:

• Do you have an ISP-provided modem/router combination unit?
• Did you plug a standalone Wi-Fi router (e.g. TP-Link, NETGEAR, ASUS, Linksys) into one of its yellow LAN ports?
• Did you connect a mesh Wi-Fi system (e.g. eero, Nest Wifi, Orbi) downstream of an ISP gateway without switching modes?

If two active routing units are plugged into each other, Double NAT is virtually guaranteed.

Method 4: Run a Traceroute

A traceroute shows every hop between your device and a public server:

• Windows: Open Command Prompt and type tracert 8.8.8.8
• macOS / Linux: Open Terminal and type traceroute 8.8.8.8

Look at the first two hops. If Hop 1 is a private IP (like 192.168.0.1) and Hop 2 is also a private IP (like 192.168.1.1 or 10.0.0.1) before reaching the public internet, you have two local routing hops.

What Problems Can Double NAT Cause?

Double NAT is not harmful to standard browsing, streaming Netflix, or downloading files. However, it disrupts services that rely on inbound peer-to-peer handshakes or port mappings:

Online Gaming

Game consoles (Xbox, PlayStation, Nintendo Switch) and PC games require direct peer-to-peer matchmaking. Double NAT causes Strict NAT (Type 3) or Moderate NAT (Type 2) warnings, which prevents hosting lobbies, drops in-game voice chat, and causes matchmaking timeouts.

Port Forwarding Failures

When you set up a port forwarding rule on your personal router (e.g. port 25565 for Minecraft, or port 80/443 for a home server), incoming internet packets only make it to the ISP gateway and get dropped because the ISP gateway doesn't know where to forward them.

VPN and Remote Access Problems

Incoming VPN connections (WireGuard, OpenVPN, IPsec) and remote access tools (Plex Media Server, security cameras, home automation hubs) fail to establish handshake tunnels across two layers of firewall translation.

How to Fix Double NAT

Select the solution that best fits your hardware and network goals:

Fix 1: Put the ISP Gateway Into Bridge Mode (Recommended)

For most households, this is the cleanest solution. Bridge Mode disables the router and NAT functions of your ISP-provided gateway, turning it into a pure modem. Your personal router takes complete control of the network.

1. Connect a computer directly to the ISP gateway (or connect to its Wi-Fi).
2. Log into the ISP gateway's admin interface (e.g. 192.168.0.1, 192.168.1.1, or 10.0.0.1).
3. Navigate to LAN Settings, Gateway Settings, or Operation Mode.
4. Enable Bridge Mode (or set NAT to Disabled).
5. Restart both the ISP gateway and your personal router.

Note: Enabling Bridge Mode will disable the ISP gateway's built-in Wi-Fi and direct LAN routing. All devices must connect through your personal router.

Fix 2: Use IP Passthrough Instead

Some ISP equipment (notably AT&T fiber gateways and certain cable modems) does not feature a true Bridge Mode. Instead, they provide IP Passthrough or DMZplus mode. This passes the public IP address directly to your personal router's MAC address while bypassing the gateway's stateful firewall.

Fix 3: Put Your Second Router Into Access Point (AP) Mode

If you only bought your second router or mesh system for better Wi-Fi coverage or extra Ethernet ports, you don't need it to act as a router. Switching it to Access Point (AP) Mode disables its DHCP and NAT engines, allowing the ISP gateway to manage all IP addressing seamlessly.

1. Log into your personal router dashboard via its admin page.
2. Go to Advanced > Administration > Operating Mode (or Wireless > AP Mode).
3. Select Access Point Mode and save.
4. The router will reboot. All connected devices will now live on the single, unified subnet of your ISP gateway.

Fix 4: Remove the Unnecessary Second Router

If your ISP gateway provides adequate Wi-Fi coverage and speed, simply disconnecting the second router eliminates complexity and removes the extra point of failure entirely.

Fix 5: Use DMZ as an Alternative Workaround

If neither Bridge Mode nor AP Mode is viable, you can configure the ISP gateway's DMZ (Demilitarized Zone) to point to your personal router's WAN IP. This forwards all unmapped incoming traffic directly to your second router. Note: DMZ is a workaround and does not technically remove the second NAT translation layer, but it resolves most port forwarding and gaming NAT type restrictions.

Fix 6: Contact Your ISP If the Problem Is CGNAT

If you have only one router but your WAN IP falls in the 100.64.0.0/10 range, no local setting will fix the issue. Call your ISP and ask: "Do you use Carrier-Grade NAT, and can I purchase or request a public dynamic/static IPv4 address?"

Bridge Mode vs. Access Point Mode: Which Should You Choose?

Your Goal / Situation	Recommended Solution	Primary Device Handling NAT
You want your personal router to manage firewalls, QoS, and VPNs	Bridge Mode (or IP Passthrough on Gateway)	Your Personal Router
You only added the router for better Wi-Fi coverage or extra ports	Access Point (AP) Mode	ISP Gateway
Your ISP Gateway does not support true Bridge Mode	IP Passthrough / DMZ	Personal Router (via Passthrough)
You have an unnecessary second router	Remove second router	ISP Gateway
Only one router in house, but WAN is 100.64.x.x	Request Public IP from ISP (CGNAT)	ISP Infrastructure

Can You Fix Double NAT Without Bridge Mode?

Yes. You can use Access Point Mode on your downstream router, enable IP Passthrough on the gateway, configure a DMZ pointing to your router, or simply remove the duplicate routing hardware. Bridge Mode is the cleanest option when you want your personal hardware in charge, but it is far from the only solution.

Double NAT and Port Forwarding

If you need port forwarding for gaming servers, self-hosted web servers, or security cameras under a Double NAT network without changing modes, you have to configure Cascaded Port Forwarding:

1. Assign a static IP to your personal router on the ISP Gateway (e.g. 192.168.1.50).
2. Forward the desired port (e.g. 25565) on the ISP Gateway to 192.168.1.50.
3. Forward the same port (25565) on your personal router to your actual gaming PC or server (e.g. 192.168.0.100).

While this works, configuring Bridge Mode or AP Mode is significantly cleaner and less prone to configuration drift.

How to Confirm You've Fixed Double NAT

1. Restart all network equipment in order (gateway first, personal router second).
2. Log into your primary router's admin interface (via 192.168.1.1 or 192.168.0.1).
3. Check the WAN/Internet IP address. In Bridge Mode, it should now display a public IP matching your result on our IP Address Checker.
4. Run a multiplayer network test on your console to verify your NAT Type has changed to Open (Type 1).

Frequently Asked Questions