Double NAT means two routers are each translating your IP address in series before traffic reaches the internet. The quick fix is to put your ISP's gateway into bridge mode so it stops doing NAT and lets your own router handle it alone. If bridge mode is locked or unavailable, switching your second router to access point mode eliminates the second NAT layer with minimal disruption.
What Double NAT Actually Means
Every router that performs Network Address Translation maps the private addresses on its LAN side to a single IP on its WAN side. When two routers do this in series, packets travel through two separate NAT tables before reaching the open internet. Your laptop sits on a private subnet behind Router 2, which itself sits on a private subnet behind Router 1, which finally connects upstream to your ISP.
The setup is common in several situations: a rented ISP modem-router combo running alongside your own Wi-Fi router, a mesh system plugged into an ISP gateway that was never put into bridge mode, or a second router added to extend coverage without being reconfigured. Each device does its job correctly in isolation. The problem is the interaction between them.
The definitive test is the WAN IP shown in your router's admin panel. Log in and find the WAN or Internet status page. If that IP falls inside a private range — 10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, or 192.168.0.0 to 192.168.255.255 — your router's upstream connection is itself behind another NAT device. If the WAN IP begins with 100.64 through 100.127, that is carrier-grade NAT space, a distinct but related problem covered below.
Why Double NAT Causes Problems
A single NAT layer is invisible to everyday browsing because modern TCP stacks handle the translation cleanly. Two layers compound the problem in ways that are hard to diagnose without knowing what to look for:
- Port forwarding stops working. You can forward a port on the inner router, but the outer router has no matching rule. External traffic never makes it past the first hop. Game servers, remote desktop, CCTV systems, and any self-hosted service fail silently.
- Gaming NAT type degrades. PlayStation and Xbox consoles report Moderate or Strict NAT instead of Open. Matchmaking pools shrink, party invites drop, and peer-to-peer sessions refuse to form.
- UPnP produces conflicting mappings. Both routers may try to register UPnP port entries independently. The inner router maps a port, but the outer router has no corresponding rule. Clients that rely on UPnP get inconsistent behavior that is difficult to reproduce.
- VoIP and video calls stutter. SIP signaling and WebRTC need predictable port mapping. Double NAT makes that mapping unpredictable and session setup can time out.
- VPN tunnels fail or fragment. WireGuard, IPsec, and OpenVPN all behave poorly traversing multiple NAT layers, particularly when neither device is aware of the VPN session in progress.
How to Detect Double NAT
The test has two steps: find your router's WAN IP, then compare it to your actual public IP.
Finding Your Router's Admin Panel
Your router's LAN IP is the default gateway shown by your device. Do not assume a common address — check directly. On Windows, open Command Prompt and run:
Find the Default Gateway line under your active adapter. On macOS, open Terminal and run:
or use the routing table:
On Linux:
Open the gateway address in a browser, log in, and navigate to the WAN or Internet status section. Note the IP shown as the WAN or external IP.
Comparing to Your Real Public IP
Use the DNS Lookup tool or any public IP check service to find your actual public-facing address. If your router's WAN IP matches your public IP, you have clean single NAT. If the router's WAN IP is a private or CGNAT address while your public IP is something entirely different, double NAT is confirmed.
iOS and Android
On iOS, go to Settings > Wi-Fi, tap the connected network name, and read the Router field — that is the gateway IP. On Android, tap the network in Settings > Wi-Fi, then look under Advanced or Network Details for the Gateway field. Enter the gateway IP in a browser to reach the router admin panel and check the WAN IP from there.
Three Ways to Fix Double NAT
Choose the option that fits your hardware and ISP arrangement. Option 1 is the cleanest because it gives your own router full control with no compromises.
Option 1: Bridge Mode on the ISP Gateway
Bridge mode disables routing and NAT on the ISP's modem-router combo, turning it into a passthrough device. Your own router then receives the real public IP on its WAN port and handles all NAT, firewall, and routing duties alone.
The general procedure, regardless of brand:
- Connect a device directly to the ISP gateway, bypassing your own router, so you can reach the gateway's admin panel.
- Find the gateway's LAN IP using ipconfig, networksetup, or ip route as described above.
- Log into the ISP gateway. Look for a section labeled Advanced, Internet, Connection, or Gateway Function.
- Find a Bridge Mode, IP Passthrough, or DMZ Host setting. Enter the WAN MAC address or LAN IP of your own router as the passthrough target.
- Save and reboot both devices. After rebooting, check your router's WAN IP — it should now display a public, non-private address.
Exact menu paths vary significantly by model and firmware version. Step-by-step guides for the most common Canadian ISP hardware:
Once bridge mode is active, the ISP gateway's Wi-Fi, built-in firewall, and DNS server all stop functioning. Your own router takes over those roles entirely. Confirm your router is configured before making the switch, or you will lose network access until it is set up.
Option 2: Remove the Second Router Entirely
If the ISP gateway covers your space adequately and has the port forwarding and firewall controls you need, removing the extra router eliminates the second NAT layer completely. Plug devices directly into the ISP gateway or into unmanaged switches hung off it. This is the fastest path to resolution but you lose any advanced features your own router was providing — custom DNS, a built-in VPN server, traffic shaping, or granular firewall rules.
Option 3: Convert Your Router to Access Point Mode
When the ISP gateway's bridge mode is locked — some ISPs disable it in their firmware — you can disable NAT and DHCP on your own router and run it as a Wi-Fi access point only. The ISP gateway handles all NAT; your router provides wireless coverage and nothing more.
- Log into your router's admin panel.
- Find the operating mode setting. It may appear as Operation Mode, Working Mode, or a Router/AP toggle. Location varies by brand and firmware generation — check your model's documentation if it is not obvious.
- Select Access Point or AP Mode.
- Disable the DHCP server on your router. The ISP gateway will assign IP addresses to all clients.
- Connect a LAN port on your router to a LAN port on the ISP gateway using an Ethernet cable. In true AP mode, use a LAN port as the uplink rather than the WAN port — but confirm with your device's manual, as some manufacturers handle this differently.
- Reboot both devices. Clients connected through your router will receive addresses from the ISP gateway and share its single NAT layer.
Any port forwarding rules must now be configured on the ISP gateway, not your router. If UPnP was enabled on your own router, disable it as well to avoid residual conflicts.
OpenWrt and DD-WRT
On OpenWrt: go to Network > Interfaces, edit the WAN interface, and set the protocol to Unmanaged, or delete the WAN interface entirely. Disable the WAN firewall zone under Network > Firewall. On DD-WRT: go to Setup > Advanced Routing, set the operating mode to Router rather than Gateway, and disable the DHCP server under Services. These steps convert the device to a managed switch and access point.
The CGNAT Special Case
Carrier-grade NAT is different from domestic double NAT. If your router's WAN IP falls in the 100.64.0.0 to 100.127.255.255 range, the NAT is happening inside your ISP's own infrastructure before the connection even reaches your premises. This address space is formally defined in RFC 6598. Bridge mode does not help here because there is no dedicated public IP to pass through to your router.
Options when stuck behind CGNAT:
- Request a public IP from your ISP. Many providers offer a static or dynamic public IP as an optional add-on, sometimes at no extra cost. Ask explicitly; front-line support staff may not volunteer this information.
- Upgrade to a business-grade line. Business tiers commonly include a dedicated public IP as standard.
- Tunnel through a VPS. A WireGuard or SSH reverse tunnel to a virtual server with a static IP gives you a persistent, addressable public endpoint for inbound port forwarding, even through CGNAT. This is the standard workaround when the ISP will not assign a routable public address.
Verifying the Fix
- Log into your router's admin panel and confirm the WAN IP is now a public address, not a private or CGNAT range.
- Cross-check it against an external IP lookup — the two values should match exactly.
- Re-create any port forwarding rules, as they may have been cleared during a mode change.
- On a gaming console, run the network connection test. A clean single-NAT setup should report NAT Type Open on Xbox or NAT Type 2 on PlayStation.
- If a VPN was failing, reconnect and confirm the tunnel establishes without fragmentation errors.
CLI Verification
Run a traceroute from a connected computer and count the private-IP hops at the start of the path. With double NAT resolved, only one private-IP hop should appear before the route enters public ISP infrastructure.
Windows:
macOS and Linux:
If hop 1 is your router — for example 192.168.1.1 — and hop 2 is already a public or ISP address, the second NAT layer is gone. If hops 1 and 2 are both private-range IPs, the outer device is still performing NAT.
To confirm your external DNS-visible IP from the command line:
On Linux with systemd-resolved:
On Windows using nslookup:
Common Misdiagnoses
My router shows 192.168.x.x on its LAN side, so that must be double NAT. No. Every router's LAN uses a private address range by design. Double NAT is only confirmed when the WAN side of your router shows a private or CGNAT address — not the LAN side.
I added a DMZ rule on the outer router, so the issue is resolved. A DMZ forwards all unrequested inbound traffic to the inner router's WAN IP, which reduces friction. The inner router still performs its own NAT. This partial workaround improves things without eliminating double NAT. Port forwarding reliability remains compromised because requests through the inner router still originate from a private WAN address as far as the outer router is concerned.
Double NAT is making my internet slow. NAT processing overhead is negligible on any router built in the last ten years. Speed problems at gigabit levels are almost always a CPU limitation on the router, a Wi-Fi channel conflict, or a WAN provisioning mismatch — not the number of NAT layers in play.
My device shows a 169.254.x.x address, which means double NAT. No. Addresses in the 169.254.0.0/16 range are self-assigned APIPA addresses. They mean the device could not obtain a DHCP lease at all — a DHCP failure or physical connectivity problem, not a NAT issue.
2026 Notes
IPv6 sidesteps NAT entirely. If your ISP assigns a native IPv6 prefix and your router supports prefix delegation, every device on your network gets a globally routable IPv6 address. Double NAT is a pure IPv4 problem. Game consoles, video call apps, and peer-to-peer software increasingly prefer IPv6 when available, and NAT type restrictions simply do not apply to IPv6 traffic. Enabling IPv6 dual-stack on your router is often the fastest path to Open NAT for gaming without needing to touch the ISP gateway at all.
DNS-over-HTTPS and DNS-over-TLS are not affected by double NAT in terms of basic connectivity. However, browsers and operating systems that use a built-in DoH resolver may bypass the DNS server your router advertises. If you are chasing a DNS resolution anomaly alongside a NAT problem, confirm whether the client is using the router's DNS or its own encrypted resolver before concluding the cause is NAT-related.
DNSSEC responses and MTU fragmentation. Double NAT can introduce MTU mismatches that fragment large DNS responses, including the RRSIG records added by DNSSEC. If DNSSEC validation times out intermittently, check that both routers have their MTU set to 1500 and that path MTU discovery is not being blocked by firewall rules on either device.