Many families, unhappy with the Wi-Fi of the modem supplied by their provider, buy a better router and plug it in behind the first one with a cable. The Internet works, the Wi-Fi is stronger and everything looks fine. Then one day the games console reports a strict NAT type, opening a port has no effect, or the VPN for reaching home from outside will not connect. The cause is often double NAT.
What double NAT is
NAT is the function that lets every device in the home go out to the Internet with a single public address. The router translates the internal private addresses into the public one and keeps track of connections.
When you chain two routers, each with its own NAT enabled, traffic is translated twice: by the inner router towards the modem's network, and by the modem towards the Internet. From outside nobody sees the inner router, and an incoming connection stops at the modem, which does not know where to forward it.
How to recognise it
The quickest way is to look at your router's WAN address, the one it receives on the port connected to the modem. If it is a private address, the NAT is double:
| Router WAN address | Meaning |
|---|---|
| 192.168.x.x, 10.x.x.x, 172.16-31.x.x | The router sits behind another NAT in the home |
| 100.64.x.x - 100.127.x.x | Provider NAT (CGNAT), cannot be fixed at home |
| Public address | No double NAT |
Another check is a traceroute to any site:
tracert 1.1.1.1 (Windows)
traceroute 1.1.1.1 (macOS and Linux)
If the first two hops are both private home addresses, for example 192.168.1.1 and then 192.168.0.1, there are two routers in a row.
What problems it causes
For normal browsing, streaming and email, double NAT is almost invisible. The problems concern incoming connections and a few sensitive services:
- port forwarding configured on the inner router does not work, because the request stops at the modem;
- UPnP opens ports only on the inner router, so games and apps that rely on it stay blocked;
- consoles report a moderate or strict NAT type, with trouble in online matches;
- a VPN server at home cannot be reached from outside;
- troubleshooting is more confusing, because there are two networks, two DHCP servers and two firewalls.
Solution 1: modem in bridge mode
The cleanest solution is to put the provider's modem into bridge mode. The modem then stops acting as a router: it only converts the line signal and hands the connection directly to your router, which gets the public address and becomes the only NAT in the home.
Not every modem allows this, and some providers lock the option. If it is available, write down the connection parameters before enabling it: after bridging, your router will have to authenticate with the provider.
Solution 2: your router connected directly to the line
With many fibre connections the provider's modem can be replaced entirely. Your own router connects to the fibre terminal or to the line and handles the connection itself, often via PPPoE with a username and password, sometimes with a provider-specific virtual network identifier (VLAN). The exact parameters depend on the operator and should be requested or looked up in the official documentation.
This is the setup with the most control, but it must be done carefully: if even one parameter is missing, the connection will not come up. And some provider services, such as a landline built into the modem, may need extra arrangements.
Solution 3: DMZ to the inner router
If bridge mode is not available, almost all modems offer a DMZ feature (sometimes "exposed host"). By setting your router's WAN address as the target, the modem forwards all unsolicited incoming traffic to it. Technically the NAT is still double, but in practice the inner router receives connections as if it were directly exposed.
For this to work reliably, the inner router must always have the same address on the modem's network: set a DHCP reservation on the modem or a static address on the router's WAN port.
Solution 4: use the inner router as an access point
If the goal was only better Wi-Fi, you can keep the modem as the only router and configure the new one in access point mode. The new device broadcasts Wi-Fi but no longer does NAT or DHCP. You lose its routing features, but the network becomes a single one. In my work this is often the simplest choice when the second router's advanced features are not needed.
In short
- Two chained routers with NAT enabled create double NAT.
- You can spot it from a private WAN address or two private hops in a traceroute.
- It breaks port forwarding, UPnP, online gaming and incoming VPN connections.
- The fixes are bridge mode, a direct PPPoE connection, DMZ or access point mode.
- A 100.64.x.x address means provider CGNAT, which cannot be fixed at home.
