How to Detect and Fix Double NAT on a Home Network

To fix double NAT, leave only one device in router mode. Either put the ISP gateway in bridge or IP passthrough mode and keep your own router in charge, or put the second router in access point mode and let the ISP gateway route the network. Before changing anything, find the second router’s WAN IP and map how the boxes are connected. A private WAN address suggests another routing layer, but it could be a router in your home, an apartment network, or NAT at the ISP.

What double NAT looks like

Network address translation, or NAT, lets many devices share one IPv4 address. One NAT layer is normal on a home network. Double NAT appears when traffic passes through two routers that both perform NAT:

Internet
   |
ISP modem-router or gateway  [NAT 1]
   |
Personal router or mesh      [NAT 2]
   |
Phones, computers, consoles, TVs

This often happens after someone connects a new router or mesh system to an ISP gateway without changing either device’s operating mode. It can also happen in an apartment, dorm, or managed building where the wall connection already sits behind a router.

A plain cable modem or fiber ONT is not automatically a router. If it only converts the provider’s signal and passes the public IPv4 address to your router, it does not create home double NAT. The important question is how many devices are routing, running DHCP, and translating IPv4 traffic.

Is double NAT always a problem?

No. Web browsing, video streaming, email, and most outbound connections may work normally through two NAT layers. Google and eero both note that the trouble is more likely to appear with applications that need inbound connections or automatic port mapping.

Possible symptoms include:

• A game console reports a moderate, strict, or double NAT type.
• Port forwarding works on one router but the service remains unreachable from the internet.
• UPnP opens a port on the inner router but cannot open the matching path through the outer router.
• Peer-to-peer games, voice applications, VPN hosting, remote access, or DDNS do not work as expected.
• Devices connected to different routers cannot discover one another for casting, printing, or local sharing.

Double NAT does not automatically explain slow downloads, high ping, jitter, or packet loss. Two consumer routers add processing, but a stable setup can still perform well for ordinary outbound traffic. If lag is the main symptom, first compare the measurements in our guide to packet loss, ping, and jitter instead of assuming NAT is the cause.

How to detect double NAT

The following checks concern IPv4. IPv6 normally uses different addressing and firewall behavior, so do not use an IPv6 address to interpret the private IPv4 ranges below.

1. Map the physical path

Follow the cable from the internet connection to your devices. Write down every box between the provider line and the computer or console:

• Modem or fiber ONT
• ISP gateway with Ethernet ports and WiFi
• Your own WiFi router or mesh gateway
• Switches and access points

An Ethernet switch or access point does not normally perform NAT. A device marketed as a modem may also contain a router, firewall, DHCP server, and WiFi radio. Look at its operating mode rather than relying on the name printed on the box.

2. Find the downstream router’s WAN address

Sign in to the router closest to your devices. Open a page named Internet, WAN, Connection Status, or something similar. Record its IPv4 address. Do not use the LAN address shown as the default gateway for your phone or computer.

Private IPv4 ranges defined by RFC 1918 are:

• 10.0.0.0 through 10.255.255.255
• 172.16.0.0 through 172.31.255.255
• 192.168.0.0 through 192.168.255.255

The shared address range reserved for carrier-grade NAT is 100.64.0.0 through 100.127.255.255. Some providers use other private ranges internally, so the address is an important clue, not the entire diagnosis.

3. Compare the WAN address with your public IPv4 address

While connected through that router, check the public IPv4 address reported by a reputable IP lookup service. Then compare it with the router’s WAN IPv4 address.

A private WAN address alone does not tell you who controls the upstream NAT. If the address comes from your ISP rather than another box in your home, changing your router to access point mode will not give you a public address.

4. Use traceroute only as supporting evidence

A traceroute may show more than one private hop near the start of the path, but that is not proof of double NAT. Routers can hide, rate-limit, or answer diagnostic traffic differently from normal traffic. ISP networks can also contain private hops. The WAN-address comparison and the physical topology are more useful.

Choose which device should remain the router

The clean fix is to create one routed home network. Pick the device that should control DHCP, firewall rules, port forwarding, parental controls, and any QoS settings.

Do not put both devices into bridge or access point mode unless another router is present. A home network still needs one device to route traffic, assign addresses, and enforce the firewall.

Fix option 1: bridge the ISP gateway

This option keeps your personal router in router mode. The ISP gateway stops routing and passes the internet connection through. Depending on the provider, the setting may be called bridge mode, modem-only mode, or IP passthrough.

1. Back up or photograph the current settings on both devices.
2. Check whether the connection uses a PPPoE username and password, VLAN ID, static IP details, or a provider-specific IPTV or phone configuration.
3. Confirm that your own router supports the required internet settings.
4. Enable bridge or passthrough mode on the ISP gateway by following the provider’s instructions.
5. Connect the gateway to the WAN or Internet port of your own router.
6. Restart the gateway first. Wait for its connection light to stabilize, then restart your router.
7. Check whether your router now receives the public IPv4 address.

TP-Link warns that PPPoE and VLAN information may need to move from the modem-router to the wireless router after bridging. Record those details before making the change. If the gateway supplies managed phone or TV service, ask the ISP whether bridge mode affects it.

Mesh systems can have their own limits. For example, Google says the primary Wifi or Nest Wifi router cannot be placed in bridge mode while it is supporting a multi-device mesh. In that setup, the usual design is to bridge the upstream ISP gateway and leave the mesh gateway in its normal router mode.

Fix option 2: put the second router in access point mode

This option leaves the ISP gateway in charge. The second device supplies WiFi and Ethernet access without creating another routed subnet. Vendors may call the setting access point mode, AP mode, or bridge mode.

1. Sign in to the second router or mesh system.
2. Find its operating mode and select access point or bridge mode.
3. Follow the device maker’s instructions for the uplink port. Some models use the WAN port in AP mode, while others specify a LAN port.
4. Wait for the device to restart, then reconnect phones, computers, and smart-home devices.
5. Confirm that clients receive addresses from the ISP gateway’s subnet.

ASUS states that NAT, IP sharing, and the firewall are disabled by default in its AP mode. The exact feature list varies by model. Parental controls, port forwarding, QoS, VPN server, and traffic statistics may no longer be available on the second device because those functions depend on routing. Configure them on the upstream gateway if it supports them.

Workarounds when neither device can change mode

Sometimes the ISP locks its gateway, a building network cannot be changed, or the second router needs to keep a separate subnet. The following workarounds may help a specific service, but they do not remove double NAT.

Forward the same port through both routers

1. Reserve a stable WAN address for the inner router on the outer router.
2. On the outer router, forward the required port to the inner router’s WAN address.
3. On the inner router, forward the same port to the final computer, console, or server.

This can work for a known inbound service. It is easy to break when an address changes, and it does not make UPnP span both routers automatically. Expose only the ports the application actually needs.

Use the outer router’s DMZ or exposed-host setting carefully

Pointing the outer router’s DMZ or exposed-host rule at the inner router sends unsolicited inbound IPv4 traffic to the inner router, whose firewall still has to handle it. This can reduce the need to duplicate every forwarding rule, but it is not bridge mode and double NAT remains. Keep the inner router updated, protect its admin interface, and do not point the DMZ directly at an ordinary client device.

Neither workaround removes carrier-grade NAT. If the ISP controls the outer translation layer, ask for a public IPv4 address, a static IP option, or an officially supported IPv6 solution. Our separate guide explains how to separate a WiFi link problem from an internet connection problem if basic access is also failing.

How to verify that double NAT is gone

• If your personal router remains in router mode, its WAN IPv4 address should match the public IPv4 address shown from a connected client.
• If your second device is now an access point, connected clients should receive addresses from the ISP gateway’s LAN subnet.
• Only one device should run DHCP for the main home network.
• Devices that should discover one another should now be on the same subnet.
• Test the game, VPN, remote-access service, or forwarded port that originally exposed the problem.

Do not judge the change only by a console label. Recheck the topology and then test the affected application. If Valorant still loses updates after the NAT path is corrected, continue with the checks in our Valorant packet loss guide.

Common double NAT mistakes

Turning off the upstream WiFi

Disabling a gateway’s wireless radio can reduce interference or remove an unused network name. It does not turn off routing, DHCP, or NAT. You can still have double NAT over the Ethernet cable.

Bridging the wrong device

If a multi-node mesh needs its main unit to remain a router, bridging that unit may disable mesh features or prevent the nodes from working as intended. Decide which device owns routing before changing modes.

Leaving two DHCP servers on one LAN

Manually connecting two routers LAN-to-LAN without enabling a supported AP mode can leave both DHCP servers active. Clients may receive conflicting gateways or DNS settings. Use the vendor’s AP mode when possible, or configure the manual layout carefully.

Calling DMZ a complete fix

An exposed-host rule changes how inbound traffic is forwarded. It does not remove the second private subnet or the second translation table. That distinction matters when troubleshooting discovery, UPnP, and address changes.

Frequently asked questions

Does double NAT slow down the internet?

Not necessarily. Two routers add another processing step, but normal browsing and streaming can remain fast. A weak WiFi link, overloaded router, congested upload, or ISP issue is more likely to explain a large speed or latency problem. Test the local link and internet path before replacing hardware.

Can one modem and one router cause double NAT?

Yes, if the so-called modem is actually a modem-router gateway and both devices are routing. No, if the modem or ONT simply passes the provider connection to the only router. Check the downstream router’s WAN address and the upstream device’s operating mode.

Is CGNAT the same as home double NAT?

No. Home double NAT usually means two routers under your control. Carrier-grade NAT is operated by the ISP and lets multiple customers share public IPv4 addresses. You cannot remove the ISP layer from your router settings.

Why does my Xbox or PlayStation still report NAT problems?

The console may need working UPnP, a supported port-forwarding setup, or an unrestricted upstream connection. Verify that only one home router performs NAT, restart the network and console, then check the platform’s current support guidance. A provider’s CGNAT can still restrict inbound connections after home double NAT is removed.

Can I intentionally keep two routed networks?

Yes. A separate lab, guest, or untrusted-device network may be useful. The design becomes a problem only when devices need automatic discovery or inbound connections across both layers. Document the subnets and manage the firewall rules deliberately.

Sources

• Google Nest Help: Fix Double NAT when two routers run at the same time
• TP-Link: Avoid double NAT when using a modem-router and wireless router
• eero Support: What is NAT?
• ASUS Support: Wireless router mode and access point mode
• TP-Link: Difference between access point mode and router mode
• IETF RFC 1918: Address Allocation for Private Internets
• IETF RFC 6598: Shared Address Space for carrier-grade NAT