Double NAT: How to Detect and Fix It

10 Sep 2026

Double NAT is one of those networking problems that can remain invisible until you try to do something more demanding than ordinary web browsing.

Your internet may appear to work normally. Websites load, video streams play and phones connect to Wi-Fi. Problems begin when you try to use:

Online gaming
Port forwarding
Remote access
A VPN server
Voice or video calling
Peer-to-peer applications
Smart-home hubs
Security cameras
A home server
Certain business applications

You may see strict or moderate NAT warnings, failed incoming connections, broken game chat or devices that work locally but cannot be reached from outside the property.

Double NAT usually occurs because two devices on the network are both acting as routers. Each device creates its own private network and translates addresses before traffic reaches the internet.

The problem is often straightforward to fix once you identify where the second layer of routing is happening.

What Is NAT?

NAT stands for Network Address Translation.

Most homes receive one public internet address from their broadband provider, but contain many devices:

Phones
Computers
Televisions
Consoles
Printers
Cameras
Smart-home products

The router gives those devices private addresses, such as:

192.168.0.25
192.168.1.40
10.0.0.12

Private addresses cannot normally be routed directly across the public internet.

When a device accesses a website, the router translates the private source address into the router’s public address. It keeps track of the connection so the returning data can be sent to the correct device.

This is normal NAT and is used in almost every home network.

What Is Double NAT?

Double NAT occurs when traffic passes through two separate layers of network address translation.

A common arrangement looks like this:

Internet

Provider router

192.168.0.1

Personal router or mesh system

192.168.1.1

Your devices

The personal router receives a private address from the provider router. It then creates another private network for the devices connected behind it.

Traffic is translated once by the personal router and again by the provider router before reaching the internet.

That is double NAT.

Why Double NAT Happens

Double NAT is usually created when new networking equipment is added without changing the role of the existing router.

Common causes include:

Connecting a personal router behind the internet provider’s router
Installing a mesh system in router mode
Using a firewall appliance behind another router
Adding a 4G or 5G router behind a fixed-broadband router
Connecting a travel router to a home network
Using a router supplied with a business security service
Placing a router behind a satellite internet terminal
Running a virtual router inside another network
Connecting through building-managed internet
Using carrier-grade NAT from the provider as well as a home router

Not every two-device setup creates double NAT. A modem, network switch or access point does not normally perform NAT.

The important question is whether both devices are routing.

Why Ordinary Browsing Still Works

Most everyday internet traffic begins from inside your network.

When you open a website, the connection travels outward through both routers. Each router records the session and knows how to send the response back.

That is why double NAT may not affect:

Web browsing
Email
Streaming
Software downloads
Cloud applications
Social media

Problems are more likely when a service needs to create an incoming connection or discover the device directly.

Common Symptoms of Double NAT

Possible signs include:

A games console reports strict or moderate NAT
Port forwarding does not work
UPnP creates rules on the wrong router
Remote desktop cannot be reached from outside
A VPN server accepts no incoming connections
Game matchmaking takes longer
Peer-to-peer connections fail
Voice chat works inconsistently
A camera app cannot connect remotely
A home server is accessible locally but not over the internet
A business VPN disconnects or behaves unpredictably
Two router administration pages are available
The second router’s WAN address is private

These symptoms can have other causes, so verify the network before making changes.

How to Detect Double NAT

The quickest method is to compare the WAN address of your main router with the public address visible on the internet.

Step 1: Find the Router’s WAN Address

Sign into the router used by your devices.

Look for a page called:

Internet status
WAN status
Connection
Broadband
Network map
IPv4 status

Find the WAN IP address or Internet IP address.

When it begins with one of these private ranges, another router is probably upstream:

10.0.0.0 to 10.255.255.255

172.16.0.0 to 172.31.255.255

192.168.0.0 to 192.168.255.255

For example:

WAN IP: 192.168.0.15

This means the router does not hold a public address. It received a private address from another device.

Step 2: Compare It With Your Public IP Address

Use a reputable public-IP checker or inspect the address shown by a suitable internet service.

When the public address differs from the router’s WAN address, another translation layer exists upstream.

Example:

Router WAN address: 192.168.0.15

Public internet address: 81.22.45.90

This strongly suggests double NAT or provider-level NAT.

Step 3: Check the Default Gateway

On Windows, open Command Prompt and run:

ipconfig

Look for:

Default Gateway

On macOS or Linux, you can use:

ip route

or:

route -n

The default gateway is usually the router your device is using.

Sign into that device and inspect its WAN address.

Step 4: Run a Traceroute

Traceroute shows the network hops traffic passes through.

On Windows:

tracert 1.1.1.1

On macOS or Linux:

traceroute 1.1.1.1

When the first two or more hops use private addresses, there may be more than one router.

Example:

1 192.168.1.1

2 192.168.0.1

3 81.22.40.1

This suggests:

Your router: 192.168.1.1
Upstream router: 192.168.0.1
Provider network begins after that

Traceroute is useful evidence, but some routers do not respond to traceroute packets. Missing hops do not prove that double NAT is absent.

Double NAT vs. Carrier-Grade NAT

Not every private WAN address is caused by a second router in your home.

Internet providers may use Carrier-Grade NAT, often called CGNAT.

With CGNAT, several customers share one public IPv4 address. The provider performs NAT inside its own network.

Addresses commonly associated with CGNAT come from:

100.64.0.0 to 100.127.255.255

This range is reserved for shared address space.

You may also see an ordinary private range on some provider networks.

A network can contain:

NAT on your home router
NAT on the provider network

Technically, that is also more than one NAT layer, but you cannot remove the provider’s layer through your own router settings.

How to Identify CGNAT

CGNAT is likely when:

The router is connected directly to the provider equipment
No second router exists
The WAN address is within 100.64.0.0/10
Port forwarding never works
The public IP differs from the router WAN address
The provider confirms shared IPv4 addressing
Mobile or fixed-wireless broadband is being used

Contact the provider and ask whether the connection uses CGNAT.

Possible solutions include:

Requesting a public IPv4 address
Paying for a static IP
Using IPv6
Using a reverse tunnel
Using a cloud relay service
Using a VPN provider that supports inbound port forwarding

The available options depend on the provider.

Does Double NAT Always Need Fixing?

No.

Double NAT may be acceptable when you only use:

Web browsing
Streaming
Cloud applications
Email
Ordinary mobile apps
Outbound business services

It may also be intentional when one network must remain isolated from another.

For example, a tenant may use a private router behind a landlord’s network to create a separate household network.

The arrangement becomes a problem when you require reliable inbound connectivity, automatic port mapping or low-friction peer-to-peer communication.

The Best Fix: Use One Router

The cleanest solution is to ensure that only one device performs:

Routing
NAT
DHCP
Firewalling

Other devices should operate as:

Modems
Access points
Network switches
Mesh nodes
Bridges

There are several ways to achieve this.

Fix 1: Put the Provider Router Into Modem or Bridge Mode

This is often the best option when you want your own router to manage the network.

In modem or bridge mode, the provider device stops acting as the main router. It passes the internet connection directly to your personal router.

The arrangement becomes:

Internet

Provider modem or bridge

Personal router

Devices

Your personal router receives the public address and becomes the only NAT device.

Advantages

One layer of NAT
One firewall to manage
Port forwarding works from one place
UPnP operates on the correct router
Cleaner network design
Better compatibility with gaming and remote access

Possible disadvantages

Provider digital phone services may stop working
Some television services may depend on the router
Support staff may have limited visibility
Special VLAN or login settings may be required
The provider may not offer bridge mode
The provider device’s Wi-Fi may need to be disabled manually

Record the existing settings before changing anything.

Modem Mode vs. Bridge Mode

The terms are often used interchangeably, but manufacturers may define them differently.

Modem mode

The device acts primarily as the broadband modem or cable termination device.

Bridge mode

The device bridges the provider connection to another router without performing normal routing.

The exact implementation depends on the hardware and broadband technology.

Follow instructions for the specific provider and model.

Fix 2: Put the Personal Router Into Access Point Mode

When you are satisfied with the provider router’s routing and firewall functions, convert the secondary router or mesh system into access-point mode.

The provider router remains responsible for:

NAT
DHCP
Firewall
Internet connection

The second system provides:

Wi-Fi
Ethernet ports
Additional coverage

The arrangement becomes:

Internet

Provider router

Access point or mesh in AP mode

Devices

Advantages

Usually simple to configure
Retains provider phone and television services
Removes double NAT
Keeps improved Wi-Fi coverage
Avoids broadband authentication changes

Possible disadvantages

Some features of the personal router may be disabled, including:

Parental controls
Traffic analysis
Advanced QoS
VPN server
Some guest-network options
Device isolation
Security filtering
Certain mesh features

Check which functions remain available in access-point mode.

Router Mode vs. Access Point Mode

A device in router mode normally provides:

NAT
DHCP
Firewall
WAN routing
Port forwarding

A device in access point mode normally provides:

Wi-Fi
Ethernet bridging
Connection to the existing network

Access-point mode does not create a separate IP network.

Fix 3: Use IP Passthrough

Some provider routers do not offer full bridge mode but provide IP passthrough.

This assigns the public address, or an equivalent connection role, to a selected downstream router.

IP passthrough may reduce many double-NAT problems while preserving some provider-device functions.

However, implementations vary. The provider router may still perform some firewalling or management.

Use the provider’s documented configuration rather than assuming IP passthrough is identical to bridge mode.

Fix 4: Use a DMZ Host as a Workaround

When bridge or access-point mode is unavailable, you can sometimes place the downstream router in the upstream router’s DMZ.

The provider router forwards unsolicited incoming traffic to the personal router.

The arrangement still contains double NAT, but inbound connections become easier to manage.

Basic process

Give the downstream router a fixed WAN address.
Sign into the upstream router.
Find the DMZ or exposed-host option.
Enter the downstream router’s WAN address.
Configure port forwarding only on the downstream router.
Test the required service.

Example:

Personal router WAN: 192.168.0.2

Provider router DMZ host: 192.168.0.2

Important limitations

Double NAT still exists
Some protocols may still fail
UPnP may remain unreliable
The downstream router receives more unsolicited traffic
Its firewall must remain enabled
Incorrect DMZ settings can expose the wrong device

Never place an ordinary computer, camera or storage device directly into the DMZ as a general solution.

The DMZ host should be the downstream router with its firewall active.

Fix 5: Forward Ports Through Both Routers

When you cannot change operating modes, port forwarding can be configured on both routers.

Suppose a server uses:

192.168.1.50

and the personal router’s WAN address is:

192.168.0.2

You would configure:

The provider router to forward the required port to 192.168.0.2
The personal router to forward the same port to 192.168.1.50

Example:

Internet port 8443

Provider router forwards to 192.168.0.2:8443

Personal router forwards to 192.168.1.50:8443

This can work, but it is more difficult to maintain.

You must also ensure that:

Both target addresses remain fixed
Both firewalls permit the traffic
The service is listening
The provider does not use CGNAT
No conflicting rule exists
The port is not blocked by the provider

Fix 6: Remove the Unnecessary Router

Sometimes the second router serves no useful purpose.

It may have been added because:

More Ethernet ports were needed
Wi-Fi coverage was poor
An old router was available
A printer needed a connection

Replace the unnecessary router with:

A network switch
A proper access point
A mesh node in access-point mode

A switch expands Ethernet capacity without creating another network.

Fix 7: Replace the Router With a Switch

A router and switch are not interchangeable.

Use a switch when you need:

Additional Ethernet ports
More wired devices
A connection to another room
A central network cabinet

A switch does not normally provide:

NAT
DHCP
Firewalling
A separate subnet

Replacing an unnecessary router with a switch removes the second NAT layer.

Fix 8: Configure the Mesh System Correctly

Mesh systems commonly create double NAT because their default setup assumes they will replace the existing router.

When connected behind a provider router, they may automatically start operating in router mode.

Look for settings called:

Access Point mode
Bridge mode
AP mode
Existing router mode

After changing modes, confirm that devices receive addresses from the provider router rather than from a separate mesh subnet.

Some mesh systems disable features when placed in bridge mode, so review the trade-offs.

Fix 9: Change the LAN Subnet

Changing the subnet does not remove double NAT, but it can resolve an address conflict.

A conflict occurs when both routers use the same range.

For example:

Provider router LAN: 192.168.1.0/24

Personal router LAN: 192.168.1.0/24

The downstream router may be unable to distinguish its WAN network from its LAN network.

Change one side to a different range:

Provider router: 192.168.0.0/24

Personal router: 192.168.1.0/24

This makes double NAT functional, although it does not eliminate it.

Do Not Use the Same Subnet on Both Sides

A router should not normally have overlapping WAN and LAN address ranges.

Incorrect example:

WAN: 192.168.1.10

LAN: 192.168.1.1/24

Better example:

WAN: 192.168.0.10

LAN: 192.168.1.1/24

Overlapping networks can cause:

Routing failures
Inaccessible devices
Broken administration pages
Intermittent connectivity
VPN conflicts

Fix 10: Ask the Provider for a Public Address

When the issue is CGNAT rather than a second physical router, local changes may not help.

Ask the provider whether it can supply:

A dynamic public IPv4 address
A static public IPv4 address
A business broadband package
Native IPv6
An opt-out from CGNAT

A public address may be free, chargeable or unavailable.

Static addressing is not necessary for every service. Dynamic DNS can track a changing public address when inbound connections are permitted.

Can IPv6 Avoid Double NAT?

IPv6 can provide globally routable addresses without traditional IPv4 NAT.

When supported correctly by:

The provider
Router
Client device
Application
Remote service

IPv6 may allow direct connectivity without IPv4 port forwarding.

However, this does not mean the device should be exposed without protection.

The router’s IPv6 firewall must remain enabled. Globally addressable does not mean publicly accessible by default.

Some applications still depend on IPv4, so IPv6 may not solve every NAT-related problem.

Double NAT and Online Gaming

Games consoles commonly display NAT classifications such as:

Open
Moderate
Strict
Type 1
Type 2
Type 3

The terminology varies between platforms.

Double NAT can interfere with:

Peer hosting
Voice chat
Matchmaking
Party systems
Direct player connections

The best fix is normally to use one router.

After removing double NAT:

Restart the console.
Restart the router.
Test NAT status again.
Enable UPnP if appropriate.
Add manual port rules only when necessary.

Do not enable every possible port or place the console directly on the internet without understanding the security implications.

Double NAT and UPnP

UPnP allows applications and devices to request port mappings automatically.

In a double-NAT setup, a console may create a rule on the inner router but not on the outer router.

The result is a successful-looking local rule that never reaches the public internet.

You can sometimes enable UPnP on both routers, but behaviour may be inconsistent.

Removing the extra routing layer is cleaner and more reliable.

Double NAT and Port Forwarding

A port-forwarding rule must exist at every NAT boundary.

When only the inner router has the rule, traffic stops at the outer router.

This is why users often report:

“The port is open in my router but the test says closed.”
“My camera works on Wi-Fi but not on mobile data.”
“Remote desktop works internally but not externally.”

Before blaming the port-forwarding rule, inspect the router’s WAN address.

Double NAT and VPN Clients

A VPN client that sends traffic outward usually works through double NAT.

Examples include:

Connecting a laptop to a workplace VPN
Using a commercial privacy VPN
Connecting a phone to a cloud VPN

Problems may still occur with certain older VPN protocols or badly configured firewalls.

Modern VPN protocols generally handle NAT traversal well.

Double NAT and VPN Servers

Hosting a VPN server behind double NAT is more difficult because clients must connect inward.

You need:

A public address
Correct forwarding on every router
Appropriate firewall rules
A reachable VPN port
No CGNAT blocking the connection

A reverse-tunnel or relay-based VPN service can avoid direct inbound forwarding.

Double NAT and Remote Access

Remote access tools fall into two categories.

Direct inbound services

These require a reachable port, such as:

Self-hosted remote desktop
SSH
A VPN server
A web server

Double NAT complicates these services.

Cloud-relay services

These create outbound connections to a provider and relay traffic through the cloud.

They often work through double NAT without special configuration.

The convenience comes with dependence on the cloud service and its security model.

Double NAT and Security Cameras

Many modern camera systems use cloud relay services and work through double NAT.

Problems arise when:

Direct port forwarding is required
A recorder must accept inbound connections
The camera app uses peer-to-peer discovery
The recorder has a strict NAT warning
A business system expects a fixed public address

Avoid exposing camera administration pages directly to the internet where a secure VPN or vendor relay can be used instead.

Double NAT and Smart-Home Devices

Most smart-home devices establish outbound cloud connections and are unaffected.

Local discovery may fail when devices are split across different subnets.

For example:

Phone: 192.168.0.20

Smart hub: 192.168.1.30

Broadcast and multicast discovery may not cross the router boundary.

Symptoms include:

Devices missing from apps
Casting not working
Speakers not appearing
Printers not found
Home-automation discovery failing

Use one flat home network unless you deliberately understand and manage inter-VLAN routing.

Double NAT and Casting

Technologies such as:

Chromecast
AirPlay
Network speakers
Smart televisions

often rely on local multicast discovery.

When the phone is connected to one router and the target device to another, discovery packets may not cross between the networks.

Putting the secondary router into access-point mode usually resolves this by placing both devices on the same subnet.

Double NAT and Printers

A printer behind the inner router may not be discoverable by devices connected to the outer router.

Manual IP printing may still work when routing and firewalls permit it, but automatic discovery often does not.

Again, use access-point mode when the networks are not intentionally separated.

Double NAT and Business Networks

Businesses may deliberately use several routing and firewall layers, but these should be designed rather than accidental.

Potential complications include:

Site-to-site VPN failures
VoIP problems
Remote-management issues
Overlapping subnets
Difficult troubleshooting
Broken inbound services
Inconsistent security policies
Duplicate DHCP services

A business firewall should normally be connected to a modem, bridge or properly configured provider handoff.

Do not place a business firewall behind an unmanaged consumer router unless the design specifically requires it.

Beware of Triple NAT

Networks can contain three or more NAT layers.

Example:

Mobile provider CGNAT

5G router

Mesh router

Travel router

Device

Each additional layer makes inbound access, troubleshooting and peer-to-peer connectivity more difficult.

Check every router in the path.

How to Find Every Router

Start from the device experiencing the problem and trace towards the internet.

Identify its default gateway.
Sign into that device.
Find its WAN address.
Determine which device owns the WAN subnet.
Sign into the upstream device.
Repeat until the public internet address is reached.

Document:

Device name
LAN address
WAN address
DHCP range
Operating mode
Wi-Fi network name

A simple diagram makes the problem much easier to understand.

Example Double-NAT Network

Public IP: 81.22.45.90

Provider router

LAN: 192.168.0.1

DHCP: 192.168.0.100–199

Mesh router

WAN: 192.168.0.20

LAN: 192.168.1.1

DHCP: 192.168.1.100–199

Console

IP: 192.168.1.120

The console sits behind two NAT layers.

Possible fixes:

Put the provider router into bridge mode
Put the mesh into access-point mode
Place 192.168.0.20 in the provider router’s DMZ as a workaround
Forward required ports through both routers

Confirming the Fix

After changing the network:

Restart the provider equipment.
Restart the main router.
Restart affected devices.
Check the router’s WAN address.
Confirm that devices receive the expected subnet.
Run traceroute again.
Test the affected application.
Test port forwarding where required.
Confirm that local discovery still works.
Check that firewall protection remains enabled.

When bridge mode is working, the personal router should normally receive the public address directly.

Do Not Disable Every Firewall

Double NAT is not fixed safely by turning off firewalls on both routers.

A firewall and NAT are related but separate functions.

The goal is to use one properly configured router and firewall, not to expose the network unnecessarily.

Keep the active edge router’s firewall enabled.

Do Not Factory-Reset Everything First

A factory reset may erase:

Broadband login details
Wi-Fi names and passwords
Phone settings
Port forwards
Parental controls
VPN settings
Business configuration

It also does not solve CGNAT.

Before resetting anything:

Draw the network
Record IP addresses
Identify device roles
Inspect WAN addresses
Back up configurations
Check provider instructions

Check Digital Phone Services Before Bridge Mode

Some provider routers support digital telephone services through their own hardware.

Bridge or modem mode may disable:

Landline ports
Digital voice
Provider voicemail
Emergency-calling configuration

Confirm how telephone service will operate before changing modes.

You may need to keep the provider router active or use a supported alternative configuration.

Check Television Services Before Bridge Mode

Provider television services may depend on:

Multicast
VLANs
Specific router ports
IGMP proxying
Provider DNS
Authentication through the supplied router

Changing the router mode can disrupt these services.

Check the provider’s official guidance for using third-party routers.

Check Business Authentication Settings

Some broadband services require:

PPPoE credentials
VLAN tagging
Static IP configuration
DHCP options
MAC-address registration
Provider-specific authentication

Your personal router must support the required settings before the provider device is bridged.

Security Considerations

Removing double NAT does not reduce security when the remaining router is configured properly.

NAT is not a substitute for a firewall.

The main router should provide:

Stateful firewalling
Secure administration
Updated firmware
Strong Wi-Fi encryption
Disabled remote administration unless required
Controlled port forwarding
Logging and monitoring where appropriate

Do not assume that two NAT layers provide meaningful defence against malicious software already inside the network.

A Sensible Troubleshooting Order

When you suspect double NAT:

Find your device’s default gateway.
Sign into the main router.
Record its WAN address.
Compare it with the public IP.
Run traceroute.
Identify any provider router, mesh router or firewall.
Check for CGNAT.
Decide which device should remain the router.
Put the other device into bridge, modem or access-point mode.
Restart the network.
Confirm that one NAT layer remains.
Retest gaming, port forwarding or remote access.

Use DMZ or dual port forwarding only when the cleaner modes are unavailable.

When to Keep Double NAT

You may deliberately keep double NAT when:

A tenant needs a separate network
A lab environment requires isolation
A temporary travel router is being used
A test network must remain separated
You understand the limitations
No inbound connections are required

In a deliberate setup, document both networks and use non-overlapping subnets.

When to Get Professional Help

Assistance is worthwhile when:

The provider router cannot be bridged
Digital phone or TV services must be preserved
The connection uses VLANs or PPPoE
CGNAT blocks a business service
A site-to-site VPN is failing
Several subnets overlap
The property contains multiple mesh and router systems
Port forwarding must be exposed securely
The network supports cameras, servers or business systems
You are unsure which firewall should remain active

One Router Is Usually the Right Answer

Double NAT is not inherently dangerous, and many ordinary internet activities work through it without difficulty.

The problems appear when devices need inbound connectivity, peer-to-peer communication or seamless local discovery.

The cleanest design normally uses:

One router
One DHCP service
One NAT layer
One edge firewall
Additional switches and access points as needed

Start by checking the WAN address of the router used by your devices. Then determine whether the upstream layer is another router in the property or CGNAT inside the provider’s network.

Once the network has one clearly defined router, gaming, port forwarding, VPNs and local device discovery become much easier to manage.

Hamilton Group can diagnose double NAT, configure provider equipment, deploy routers, firewalls and mesh systems, and resolve remote-access or gaming connectivity problems.

Call 0330 043 0069 or visit hgmssp.com to speak with one of our experts.