How to Fix Double NAT on Your Home Network
Double NAT means two devices in your home are each doing the job of a router, so your traffic is translated twice on its way to the internet. The usual fix is to make only one of them route: put the provider’s modem-router into bridge mode, or switch your extra router to access point mode. If your Xbox is reporting a strict or double NAT, this is the most common cause, and it is usually a 20 minute job once you know which box is doing what.
Below, we cover how to confirm you really have it, the fixes in order of how often they work, what to do when bridge mode is not available, and when you can safely leave it alone.
TL;DR
Double NAT happens when two routers (for example the modem-router from your internet provider plus a second router you bought) both manage your network.
Confirm it by checking the WAN or Internet IP address on your second router. If it is a private address starting with 10., 192.168. or 172.16 to 172.31, you have double NAT.
Fix it by bridging the provider’s device, or by turning your second router into an access point. Only one device should route.
If your Xbox still shows a restrictive NAT afterwards, your provider may be adding its own translation upstream, and the fix is a different one.
Plain browsing and streaming usually work fine with double NAT, so do not rebuild a network that is working for you.
Table of Contents
What double NAT actually is
NAT stands for Network Address Translation. Your home has one public internet address from your provider, but many devices: phones, laptops, TVs, consoles. Your router hands each of them a private address and swaps those private addresses for the single public one as traffic goes in and out. It also keeps a table of who asked for what, so replies reach the right device.
That is normal and it is one reason unsolicited traffic from the internet does not simply land on your laptop. Double NAT is what you get when two devices do this in a chain:
The provider’s modem-router translates your traffic once.
Your own router, plugged into it, translates it a second time.
You end up with two separate private networks, one nested inside the other. Devices on the inner network can reach the internet and reply traffic finds its way back. What breaks is anything that needs the outside world to start a connection to a device inside your home.
How most Australian homes end up with it
The pattern is almost always the same. A provider supplies an all-in-one gateway that does the modem, router and Wi-Fi job. Then something happens at home:
The Wi-Fi does not reach the back bedroom, so someone buys a better router or a mesh kit and plugs it into the gateway.
A gamer buys a high-end router for lower lag and connects it to the gateway.
A home office adds a router to create a separate network for work devices.
A previous occupant or installer left a router in the chain that nobody remembers.
In each case the new router is set to its factory mode, which is router mode, and it faithfully does its own NAT behind the gateway’s NAT.
Some providers supply a simple modem with no routing function. In that case your own router is the only one doing NAT and you are not affected. Combined gateways are the ones that most often create the problem when you add your own router.
Symptoms that point to double NAT
The network itself rarely looks broken, which is why this one hides for years. Common signs:
Console or PC games report a strict, moderate or “double” NAT type, with trouble joining parties or voice chat dropping out.
Port forwarding rules do nothing. You set the rule on your router, but an outside test still shows the port closed.
Remote access fails. A security camera app, a home server, a NAS or remote desktop connects at home but not from outside.
UPnP does not work as expected. Games and apps ask the router to open ports automatically, but only the inner router hears the request.
VPN or video call oddities in some setups, particularly peer to peer calling.
None of those is proof on its own. Several things cause them. The check below is what confirms it.
How to check if you have double NAT
You need to find the WAN (sometimes called Internet) address of your own router, the one you suspect is the second one in the chain.
Connect a laptop to the second router, by cable if possible.
Open its admin page. The address is usually printed on a label on the router or in its app.
Find the status page showing the WAN, Internet or Uplink IP address.
Read the address.
If it begins with 10., 192.168. or 172.16 through 172.31, it is a private address, which means something upstream is handing it out. That upstream device is doing NAT too, so you have double NAT.
If it is a public address (anything outside those ranges), your router is talking straight to the provider’s network and you do not have double NAT from your own equipment.
A second quick test: on a device connected to the provider’s gateway, run a trace to any website and look at the first two hops. Two private addresses in a row means two routers.
One catch. Some providers use carrier-grade NAT, where the provider itself shares public addresses between customers. In that case your router’s WAN address can look unusual even with a single router at home. We cover this further down, because it changes the fix.
The fixes, in the order we try them
The goal is the same every time: one device routes, everything else just passes traffic along.
Fix 1: Put the provider’s gateway into bridge mode
This is the cleanest fix when you want your own router to be the boss, for example because it has better Wi-Fi, parental controls or gaming features.
Bridge mode switches off the gateway’s routing and NAT, so it acts as a modem only. Your router then receives the public address and does the only NAT in the chain.
The general steps:
Log into the provider’s gateway admin page.
Look for a setting called bridge mode, modem mode or IP passthrough. The name varies by brand and model.
Enable it and save. The gateway will restart.
Connect your own router’s WAN port to a LAN port on the gateway (some gateways designate a specific port for this, so check the label).
Restart your router and any devices that were having trouble.
Check the router’s WAN address again. It should now be a public one.
Two things to watch. First, if your connection uses a login (PPPoE) or specific VLAN settings, your router may need those details entered once the gateway stops handling them. Your provider’s support page for your plan usually lists them. Second, if the gateway also provides your home phone service, bridging it can cut that off on some models, so check before you flip the switch.
IP passthrough is a softer version of bridge mode that hands the public address to one device while the gateway keeps running its own network. It often works, but you can still end up with a partial double NAT situation that is not always a practical problem.
Fix 2: Turn your second router into an access point
If the gateway cannot be bridged, or you added the second router only for Wi-Fi coverage or extra ports, go the other way. Keep the gateway as the router and make the new device a plain access point.
Log into the second router’s admin page.
Switch its operating mode to access point (some call it AP mode or bridge mode).
Turn off its DHCP server if it is not switched off automatically.
Plug a cable from a LAN port on the gateway into the access point’s LAN port (not the WAN or Internet port, unless the manual says otherwise for that model).
Give it a fresh restart.
Now the second box just spreads Wi-Fi and the gateway does all the routing. Everything is on one network, which also helps with things like printing and casting, since devices can find each other. If you have ever had a printer vanish from your phone because it sat on the other network, that is the same root cause. Our AirPrint troubleshooting guide covers that side.
A word on mesh systems: most home mesh kits have an access point or bridge mode, and it is usually the right choice when the gateway stays in charge. The trade-off is that some features of the mesh, such as guest networks, certain security tools and detailed network controls, may be switched off in that mode, because the mesh is no longer the router.
Fix 3: Use the right tool for the job you wanted
Many double NATs begin with a purchase that was never needed:
Weak Wi-Fi in part of the house: a mesh system or wired access point does this properly, set to access point mode.
Not enough Ethernet ports: an unmanaged switch costs little and adds ports without adding a second router.
A separate network for guests or work: use your router’s guest network or VLAN features rather than a second NAT.
If you are not sure why that second router is there, it may be doing nothing useful, and unplugging it is the fix.
Fix 4: Put the DMZ or a static address on the second router
If you must keep two routers routing (some business or rental arrangements force this), you can reduce the damage. On the first router, give the second router a fixed address and set it as the DMZ host or forward the needed ports to it. Then forward the same ports again on the second router to the end device. It works, but it is fiddly, fragile after a reboot if addresses change, and it exposes that second router more than you might like. We treat it as a last resort.
Fixing double NAT for Xbox and other consoles
Xbox owners find this page more than anyone, so here is the practical sequence.
Confirm the cause first. In the console’s network settings, test the NAT type. A message about double NAT or a strict type fits the symptoms above.
Fix the chain using Fix 1 or Fix 2 so only one router routes.
Enable UPnP on the one remaining router. UPnP lets the console ask the router to open the ports it needs, without you forwarding anything by hand. It is usually found under advanced or NAT settings in the router’s admin page.
Restart in order: modem or gateway first, then router, then console.
Re-run the NAT test on the console.
If that gives you an open NAT type, you are done. If it does not, there are three likely reasons:
UPnP is off or blocked. Some gateways disable it by default, and some security settings override it.
A hidden second router. A powerline adapter with its own router features, an old Wi-Fi extender in router mode or a smart TV hub can sit in the chain. Check the WAN address on every device that has one.
Carrier-grade NAT at your provider. Some providers share one public address across several customers as standard on some or all plans. You can clear every bit of double NAT inside your house and still see a restrictive NAT type, because the extra translation happens in the provider’s network. Your provider’s help pages will say whether it applies to your service, and some will move you to a public address on request or on a particular plan.
Port forwarding by hand is the alternative to UPnP: reserve a fixed address for the console, then forward the ports your game lists to that address. It only works when your router has a public address, so fix the chain first.
When bridge mode or router settings do not fix it
If you have bridged the gateway or set an access point and the symptoms remain, work through these in order rather than changing everything at once.
Recheck the WAN address on your main router. If it is still private, the gateway is not really bridged. Some gateways need a full restart or a reset of the connection after changing modes, and some silently refuse the change.
Look for a third device. Run a trace route and count the private hops before the first public address. More than one private hop means another NAT device somewhere.
Check for carrier-grade NAT. If your router has a public-looking WAN address that differs from what a “what is my IP” website shows, translation is happening upstream. Contact the provider and ask about a public or static address.
Update firmware. Old router software can mishandle UPnP and bridge settings. Update both devices and retest.
Reset the second router and set it up fresh as a router with the gateway in bridge mode, or as an access point, rather than carrying over old settings.
Try the console or app direct by cabling it into the router for a test. This separates a Wi-Fi quirk from a NAT problem.
Look at IPv6. NAT is an IPv4 matter. If your provider and router support IPv6, some traffic will bypass the issue entirely, though many games and services still rely on IPv4 today.
If you get to the end of that list and the NAT type is still restrictive, it is time to call someone who can log into both devices and read what they are really doing. That is a quick job for a technician and a slow, frustrating one for most households.
When you can leave double NAT alone
Not every double NAT needs fixing. For ordinary web browsing, streaming, video calls through major apps and email, most households never notice it. If nothing you use needs inbound connections, and the network works well, resist the urge to tinker. A badly done bridge change can leave you with no internet until someone sorts it out.
It is worth fixing when you:
play online games and want an open NAT type,
host anything at home, such as a camera system, NAS or game server,
rely on port forwarding or remote desktop,
run devices on both routers that need to talk to each other, such as a printer on one network and laptops on the other.
It is also worth sorting when the second router is simply redundant. Fewer boxes mean fewer things to fail.
Common mistakes to avoid
Changing both routers at once. Change one thing, restart, and test.
Plugging into the wrong port. Joining LAN to LAN versus LAN to WAN produces very different results. The mode you chose decides which is correct.
Two DHCP servers. In access point mode, only one device should hand out addresses. Two will cause random disconnections and address clashes.
Forgetting to write down the original settings. Before bridging, note any login or VLAN details your provider needs. A photo of the settings page takes ten seconds.
Assuming a faster router fixes it. Speed is not the problem here. Where the NAT happens is.
If your problem looks more like connected-but-no-internet than a NAT problem, start with our guide to Wi-Fi that says connected with no internet. For random drops, see how to stop home Wi-Fi dropouts, and if a wired device is the one misbehaving, run through these home Ethernet checks.
Want it sorted without the guesswork?
Bridge mode menus are different on nearly every gateway, and a wrong setting can take the whole house offline. We send a technician to your home to trace the chain, find every device doing NAT, set up your network so only one does, and test your console, cameras or remote access on the spot. We explain what we found in plain English, and our pricing is fixed after assessment. If we cannot fix it, you do not pay: that is our No Fix, No Fee guarantee.
See our in-home Wi-Fi and internet support or contact us through the NextGen IT home page. We visit homes across Brisbane, Logan, Ipswich and the Redlands.
FAQ
What is double NAT mode?
It is when two routers on the same connection each perform network address translation. It usually happens when you plug your own router into a provider’s modem-router. Traffic is translated twice, which can interfere with gaming, port forwarding and remote access.
Is double NAT a problem?
Often not. Browsing, streaming and email generally work normally. It causes trouble when something needs an inbound connection from the internet, such as online game hosting, port forwarding, security cameras or remote desktop.
Why does my Xbox keep getting double NAT?
Usually because a second router sits behind your provider’s gateway, so the console’s requests are translated twice. Fix the chain with bridge mode or access point mode, then enable UPnP on the remaining router. If the warning stays, your provider may be applying its own carrier-level translation.
How can I fix my NAT type?
First make sure only one router is routing. Then turn on UPnP or forward the console’s ports to a fixed address, restart the equipment in order and retest. If the type is still restrictive, ask your provider whether your service uses shared public addresses.
Can I fix double NAT without changing my modem?
Yes. Setting your own router to access point mode, or unplugging an unneeded second router, removes the extra layer without touching the provider’s gateway. Bridge mode on the gateway is the other option when you want your own router in charge.
Recommended
Comments