Double NAT Explained: What It Is, Why It Breaks Things, and How to Fix It

The verdict up front: Double NAT means your traffic passes through two routers in a row, and each one is doing its own Network Address Translation — hiding a whole private network behind a single address. It usually happens when you put your own router behind an ISP-supplied modem/router gateway that's still in router mode. For everyday browsing, streaming, and most apps, Double NAT is completely harmless and you'll never notice it. It only causes trouble when something outside your home needs to reach in: port forwarding stops working, game consoles report a "Strict" or "Type 3" NAT, and remote access to cameras, servers, or VPNs fails. The fix is to make sure only one device does NAT — either put the ISP gateway in bridge mode or IP passthrough (best), or put your own router in access-point mode, or as a quick hack, forward all traffic to your router with a DMZ entry. The one version you often can't fix yourself is CGNAT, where your ISP is doing the second NAT on their side. Here's how to tell what you have and exactly what to change.

Your internet provider gives your home one public IP address. But you have a dozen devices — phones, laptops, TVs, a console, smart plugs. Network Address Translation (NAT) is the trick your router uses to let all of them share that single public address.

Inside your house, every device gets a private address (something like 192.168.1.20). When a device reaches out to the internet, the router swaps that private address for the home's one public address, remembers who asked, and swaps it back when the reply comes in. One public address, many devices, no collisions. That's NAT, and every home router does it.

The key thing to hold onto: NAT is a one-way door. Devices inside can freely start conversations with the outside world, but the outside world can't easily start a conversation with a specific device inside — the router doesn't know which private device the incoming knock is for. That's fine for browsing (you always start the conversation), and it's a big reason home networks are reasonably safe by default. It only becomes a problem when you want something outside to reach in.

Double NAT is exactly what it sounds like: that one-way door, twice, back to back.

It happens when you have two routers chained together, each running its own NAT. The classic setup:

Two routers, two translation layers, two closed doors. Your outbound traffic gets through both without issue — that's why browsing feels normal. But anything trying to reach a device inside your home now has to be let through both doors, and by default neither one is open.

Why it happens so often: people rarely set out to build Double NAT. It sneaks in when you add a router for better coverage but leave the ISP box in its default router mode. Mesh systems, travel routers, a second router used as "a switch," and even some Wi-Fi extenders in router mode all create it.

Three quick checks, easiest first:

1. Look for a warning. Many routers detect this and say so outright. Log into your router's admin page and look on the status/dashboard screen for a message like "Double NAT detected" or "You are behind another router." Netgear, ASUS, and TP-Link all flag it.

2. Check your router's WAN (Internet) IP. This is the definitive test. In your router's admin page, find the WAN or Internet IP address — the address your router got from whatever is upstream of it. If it starts with one of these private ranges, something upstream is doing NAT, and you have Double NAT:

If your router's WAN IP instead looks like a normal public address (e.g. 203.0.113.7), you're not double-NAT'd — you're connected straight to the internet.

3. Watch for the symptoms. If port forwarding "just won't work," your console shows a strict NAT type, or a security camera / remote-desktop / self-hosted service is unreachable from outside, Double NAT is the usual suspect.

Special case — the private range that isn't yours. If your WAN IP falls in 100.64.x.x through 100.127.x.x, that's CGNAT (carrier-grade NAT) — your ISP is doing the second NAT on their end. That's Double NAT you can't fix from inside your house. More on that at the bottom.

Here's the part that saves a lot of needless fiddling: most of the time, Double NAT does no harm at all.

Everything that starts from inside your home works fine through two NATs:

Plenty of homes run Double NAT for years and never notice. So if nothing is broken, you can leave it alone.

Double NAT does bite when something outside needs to reach a specific device inside:

If none of those apply to you, stop here — you're fine. If they do, pick a fix below.

The goal is always the same: make sure only one router does NAT. You either retire the outer router's NAT or the inner router's. Pick based on which box you want to keep in charge.

Bridge mode turns the ISP's combo box into a plain modem: it stops routing and hands the public IP straight through to your router. Your router becomes the only NAT device, and everything works normally.

If your ISP won't allow true bridge mode (common with AT&T fiber and some others), IP passthrough is the next best thing: the gateway keeps running but assigns its public IP to your router's WAN port, so your router effectively becomes the edge device.

If you only added your own router for better Wi-Fi — not for its advanced features — flip the script: put your router into Access Point / Bridge mode so it stops doing NAT and just extends the ISP gateway's single network.

If you can't change either box's mode, log into the outer (ISP) router and set its DMZ to point at your inner router's WAN IP. That forwards all unsolicited inbound traffic to your router, letting its port-forwarding rules take over.

If your router's WAN IP is in the 100.64.x.x–100.127.x.x range, you're behind carrier-grade NAT (CGNAT). To conserve their dwindling supply of public IPv4 addresses, your ISP puts many customers behind one shared public address — so there's a NAT layer on their side that you have no access to. This is increasingly common on newer fiber, 5G home internet, and mobile hotspots.

You can't bridge your way out of CGNAT because the second NAT isn't in your house. Your options:

Double NAT is two routers each translating your private network behind a single address — a second one-way door stacked on the first. For everything you start from inside your home, it's invisible. It only matters when something outside needs to reach a device inside, which is why it surfaces as broken port forwarding, strict gaming NAT, and unreachable cameras or servers.

The fix is never complicated once you see it clearly: only one router should do NAT. Bridge the ISP gateway, pass its IP through to your router, or drop your own router into access-point mode — whichever keeps the box you actually want in charge. And if your WAN IP is a 100.64 address, the second NAT is your ISP's, not yours — so reach for a public IP, IPv6, or a relay tunnel instead of chasing a setting that isn't in your house.