How to Fix Double NAT on Home and Office Networks

Updated 2026-10-09 • By Elena Rostova, CCNP (Network Infrastructure Architect)

Double NAT occurs when two routers sit in series on your network—most commonly an ISP fiber/cable gateway connected to your own third-party WiFi router or mesh system—forcing every packet through two separate Network Address Translation tables. While basic web browsing still works, Double NAT breaks inbound port forwarding, WireGuard/IPsec VPN servers, and peer-to-peer gaming.

How to Confirm Double NAT Using WAN IP & Traceroute

Normally, your ISP assigns a single globally routable public IPv4 address to your home or office, and a single router uses NAT (Network Address Translation) to translate that public IP to your private LAN subnet (192.168.1.0/24). When you plug a new Nighthawk, Archer, UniFi, or Eero router into an ISP combo modem-router without reconfiguring either box, the ISP box NATs the public IP to 192.168.1.x, and your new router NATs 192.168.1.x again to 10.0.0.x or 192.168.68.x.

You can confirm Double NAT in 10 seconds with two checks:

• Router WAN IP Check: Log into your primary WiFi router and inspect the WAN / Internet IP (not the LAN IP). If it shows a private RFC 1918 address (192.168.x.x, 10.x.x.x, or 172.16.x.x–172.31.x.x), you have local Double NAT.
• Traceroute Check: Run tracert -d 1.1.1.1 (Windows) or traceroute -n 1.1.1.1 (macOS/Linux). If Hop 1 and Hop 2 are both private RFC 1918 IP addresses, two local routers are routing your traffic.

Solution A: Enabling Bridge Mode or IP Passthrough on the ISP Gateway

If you bought a capable third-party router or firewall (such as Ubiquiti UniFi, Asus, MikroTik, Netgear Nighthawk, or TP-Link) and want it to control DHCP, firewall rules, VPNs, and port forwarding, you must neutralize the router inside your ISP gateway:

• Xfinity xFi Gateways (XB7/XB8): Log into http://10.0.0.1 (admin / password), click Gateway > At a Glance > Bridge Mode > Enable, and connect your router to Port 4 (2.5GbE port on XB7/XB8).
• AT&T Fiber Gateways (BGW210 / BGW320): Log into http://192.168.1.254, disable the 2.4GHz and 5GHz WiFi radios under Home Network > Wi-Fi, then go to Firewall > IP Passthrough. Set Allocation Mode to Passthrough, Passthrough Mode to DHCPS-fixed, select your downstream router's MAC address, and reboot both units.
• Verizon Fios (CR1000A): If you only have Fios Internet (no Fios TV coax boxes), unplug the Verizon router completely and plug your own router's WAN port directly into the Ethernet cable coming from the Fiber ONT!

Solution B: Switching Your Downstream Router/Mesh to AP Mode

What if your ISP gateway does not allow Bridge Mode (common on certain 5G Fixed Wireless gateways like T-Mobile 5G Home Internet or regional fiber ONT combos), or you prefer to keep the ISP gateway as your main firewall and only bought a mesh kit for better WiFi coverage? In that case, eliminate Double NAT on the downstream device by switching your mesh system or secondary router from Router Mode to Access Point (AP) / Bridge Mode.

In AP Mode, your mesh system disables its own NAT firewall and DHCP server, bridging all wireless clients directly onto the ISP gateway's subnet so every device in the building shares a single flat network. Be sure to still log into the ISP gateway and turn off the ISP gateway's built-in WiFi radios so its antennas do not cause co-channel interference next to your main mesh unit.

When It Is Not Your Router: Diagnosing ISP CGNAT (100.64.x.x)

Sometimes you only have a single modem and router, yet port forwarding still fails and game consoles report Strict NAT / NAT Type 3. Check the first two octets of your router's WAN IP: if it falls between 100.64.0.0 and 100.127.255.255 (100.64.0.0/10), your ISP is using CGNAT (Carrier-Grade NAT)—common on Starlink, 5G cellular home internet, and many regional fiber providers.

Because CGNAT happens inside the ISP's core data center rather than in your house, Bridge Mode cannot bypass it. To reach home servers or get an Open NAT across CGNAT, either call your ISP to request a dynamic or static Public IPv4 address (often free or $5/month on fiber ISPs), enable native IPv6, or use an outbound encrypted mesh overlay like Tailscale or Cloudflare Tunnel.

Tailscale punches straight through CGNAT using STUN/DERP coordination and WireGuard encryption without requiring a single inbound port forward on your router.

NAT Topology Diagnosis by Router WAN IP & Traceroute Hops

Double NAT Resolution & Verification Checklist

1. Compare your router's WAN Status IP against a public IP lookup (such as https://ipv4.icanhazip.com) to see if they match.
2. Run tracert -d 1.1.1.1 and verify that only Hop 1 is a private RFC 1918 IP address.
3. If enabling ISP Bridge Mode or IP Passthrough, unplug all other LAN devices from the ISP gateway so only your router is connected.
4. Disable the ISP gateway's 2.4GHz and 5GHz WiFi radios to prevent RF interference with your primary router.
5. Reboot the ISP gateway first, wait 2 minutes, and then reboot your primary router so its WAN DHCP lease acquires the public IP.
6. If your WAN IP starts with 100.64–100.127 (CGNAT), contact your ISP to opt out of CGNAT or deploy Tailscale for remote access.

Frequently Asked Questions

Does Double NAT slow down normal web browsing or video streaming?

On modern gigabit hardware, an extra local NAT hop adds less than 0.3 milliseconds of latency, so Netflix, YouTube, Zoom, and regular HTTPS web browsing work normally. However, Double NAT breaks inbound port forwarding (Plex, NAS, game servers), dynamic UPnP on consoles, and split-horizon DNS.

Why does my AT&T BGW320 still hand out 192.168.1.x after turning on IP Passthrough?

After enabling DHCPS-fixed IP Passthrough on an AT&T BGW210 or BGW320 and selecting your router's MAC address, you must reboot the BGW320 and then release/renew (or reboot) your downstream router's WAN interface. Also ensure your downstream router's LAN subnet is changed from 192.168.1.x to something like 192.168.2.x or 10.0.0.x.

What if I place my router in the ISP gateway's DMZ instead of Bridge Mode?

Placing your downstream router's static WAN IP into the ISP gateway's 'DMZ Host' (Default Server) forwards all unsolicited inbound ports to your second router, which allows port forwarding and Open NAT gaming to work when true Bridge Mode is missing, though both routers still maintain separate NAT state tables.

Related Router Troubleshooting & Engineering Guides

• Linksys Router Setup Guide (Velop & Hydra Pro) — Configure Linksys Velop mesh and Hydra Pro routers via 192.168.1.1 or myrouter.local, unlock hidden CA advanced web settings, and optimize Channel Finder.
• How to Fix WiFi Connected but No Internet — Solve 'WiFi Connected, No Internet' errors in 60 seconds using the 3-Ping isolation test to pinpoint LAN DHCP failures, WAN modem dropouts, or DNS outages.
• How to Set Up a Router — Set up a home or small office router from scratch: connect WAN/ONT cables, release ISP DHCP leases, configure WPA2/WPA3 WiFi, and harden admin access.
• Port Forwarding Guide for Home Routers — Set up port forwarding safely on any router: create static DHCP reservations, map TCP/UDP ports, troubleshoot CGNAT/Double NAT, and avoid exposing RDP or NVR.