AT&T Internet Air: IP Passthrough & Own Router Setup (CGW450)

Updated 2026-10-29 • By Marcus Vance, CCNA (Senior Network Engineer)

To use your own router with AT&T Internet Air, log into the CGW450-400 All-Fi Hub at http://192.168.1.254, navigate to Firewall → IP Passthrough, set Allocation Mode to Passthrough, and choose DHCPS-Fixed with your router's WAN MAC address. You must also change your router's internal LAN subnet to 192.168.2.1 to prevent IP collisions.

AT&T Internet Air Overview: The CGW450-400 All-Fi Hub

As AT&T decommissions legacy copper DSL networks across the country, millions of suburban and rural households are being migrated to AT&T Internet Air. Delivered over mid-band 5G (n77) and low-band 5G (n5), the service relies on a custom gateway known as the CGW450-400 All-Fi Hub.

Fortunately for homelabbers and prosumers, AT&T did not strip enterprise routing features from the All-Fi Hub. It runs the exact same underlying software stack found in AT&T Fiber's flagship BGW320-500 gateway. This means you do not have to settle for Double NAT; you can configure true IP Passthrough.

Under IP Passthrough, the CGW450 acts as a transparent bridge for your chosen router. It hands its public cellular IPv4 address directly to your router's WAN interface via DHCP, disables translation tables for that port, and allows your third-party router to manage firewall policies, VPN tunnels, and local wireless networks.

Step 1: The Mandatory Router Subnet Change (Stop IP Collisions)

Before touching the AT&T All-Fi Hub, you must configure your third-party router's internal IP address to avoid a fatal subnet overlap:

• The AT&T CGW450 All-Fi Hub has a permanent internal IP of 192.168.1.254 with a subnet mask of 255.255.255.0. It owns the entire 192.168.1.0/24 subnet.
• Almost all commercial routers (ASUS, Netgear, Linksys, UniFi, eero) default to 192.168.1.1.
• If your router tries to route traffic between a WAN interface on 192.168.1.x and a LAN interface on 192.168.1.x, routing fails completely and you will have zero internet access.

The Fix: Disconnect your third-party router from the AT&T hub. Connect your PC to your router, log into its management page (e.g., 192.168.1.1), navigate to LAN → LAN IP, and change the router IP to 192.168.2.1 (or 192.168.50.1). Save and let your router reboot.

Step 2: Configuring IP Passthrough in the CGW450 Web Interface

Now, connect your computer directly to one of the yellow LAN ports on the back of the AT&T CGW450 All-Fi Hub using an Ethernet cable:

1. Open your browser and navigate to http://192.168.1.254.
2. Navigate to Firewall → IP Passthrough. The hub will prompt you for the Access Code printed on the white sticker on the back of the unit.
3. Under Allocation Mode, select Passthrough from the dropdown.
4. Under Passthrough Mode, select DHCPS-Fixed. (Do not choose DHCPS-Dynamic or Manual; Fixed ensures your router always receives the lease).
5. Under Passthrough Fixed MAC Address, click Manual Entry and type the physical WAN MAC address of your third-party router (found on its bottom label or in its GUI status page), or select it from the device list if already plugged in.
6. Click Save.

Step 3: Disabling All-Fi Hub Wi-Fi Radios

To eliminate wireless interference, navigate to Home Network → Wi-Fi → Advanced Options. Set both the 2.4 GHz Wi-Fi Operation and 5 GHz Wi-Fi Operation dropdowns to Off. Click Save.

Step 4: Offloading Firewall Processing & Verification

Because your third-party router runs its own stateful firewall, letting the AT&T All-Fi Hub inspect packets a second time wastes processing power and introduces latency jitter:

1. In the CGW450 web GUI, navigate to Firewall → Firewall Advanced.
2. Toggle the following settings to Off: Packet Filtering, Block Ping, Flood Limits, and Strict UDP Session Limits.
3. Click Save.

Now connect a Cat6 Ethernet cable from LAN Port 1 on the AT&T CGW450 into the WAN port of your third-party router. Power cycle your third-party router.

Log into your router's status dashboard. The WAN IP will display AT&T's public cellular IP address with a default gateway of 192.168.1.254. You have successfully eliminated Double NAT.

AT&T Internet Air Gateway Technical Parameters

AT&T Internet Air Router Setup Checklist

1. Reconfigure your third-party router LAN IP to 192.168.2.1 before connecting to the AT&T hub.
2. Log into the CGW450-400 All-Fi Hub at http://192.168.1.254 using the unit's Access Code.
3. Set Allocation Mode to Passthrough and Passthrough Mode to DHCPS-Fixed.
4. Enter your third-party router's WAN MAC address in the Passthrough Fixed MAC field.
5. Disable 2.4 GHz and 5 GHz Wi-Fi radios in Home Network > Wi-Fi > Advanced Options.
6. Turn off Packet Filtering in Firewall Advanced to reduce processing latency on the gateway.

Frequently Asked Questions

Can I access the AT&T CGW450 admin page after setting up IP Passthrough?

Yes! Because the All-Fi Hub resides on 192.168.1.254 and your third-party router sits on 192.168.2.1, your router will automatically route requests for 192.168.1.254 out through its WAN interface. You can view 5G signal bars and cellular diagnostics from any device on your LAN without changing cables.

Does AT&T Internet Air support port forwarding for security cameras or servers?

Yes. When IP Passthrough is configured, inbound port forwarding rules configured inside your third-party router function normally. However, cellular IP addresses are dynamic, so you should configure a Dynamic DNS (DDNS) client on your router.

What speeds should I expect with AT&T Internet Air?

Typical download speeds range from 75 Mbps to 225 Mbps, with upload speeds between 10 Mbps and 30 Mbps, depending on your distance from the AT&T 5G cell tower and local network congestion. Placing the hub on a higher floor near an exterior window maximizes signal quality.

Can I replace the CGW450-400 All-Fi Hub with my own 5G cellular modem?

No. AT&T ties your Internet Air subscription strictly to the IMEI of the provided CGW450-400 All-Fi Hub. Moving the SIM card to a third-party cellular modem or mobile hotspot will trigger an automated carrier lockout.

Related Router Setup & Engineering Guides

• DNS Settings on a Router — Configure router DNS settings using Cloudflare 1.1.1.1, Quad9 9.9.9.9, or Google 8.8.8.8. Understand WAN vs DHCP LAN DNS, DoH/DoT encryption, and DNS leaks.
• IPv6 Router Settings Explained — Configure IPv6 router settings for Comcast Xfinity, AT&T Fiber, and Verizon Fios. Set up Native DHCPv6-PD, SLAAC, /56 or /60 prefix delegation, and firewalls.
• Parental Control Setup on a Router — Configure router parental controls that kids cannot bypass: set up Family DNS (1.1.1.3), defeat MAC address randomization, and create a Kid-Safe WiFi SSID.
• Port Forwarding Guide for Home Routers — Set up port forwarding safely on any router: create static DHCP reservations, map TCP/UDP ports, troubleshoot CGNAT/Double NAT, and avoid exposing RDP or NVR.