Double NAT: What It Is and How to Fix It

Double NAT happens when your traffic passes through two network address translation (NAT) devices before reaching the internet. Each router rewrites the source address of your packets, and the second translation can break inbound connections, gaming, and some VPNs. This page explains how double NAT occurs, how to detect it in under a minute, and the three ways to resolve it—ranked by how much they affect your network.

How Double NAT Happens

A typical home network has one router that performs NAT, translating your private IP addresses (like 192.168.1.10) to your public IP address. Double NAT occurs when a second router is inserted between the first router and your devices, creating two layers of translation. This often happens accidentally:

• You connect a second router to extend Wi-Fi coverage, but you plug it into the LAN port of the first router instead of configuring it as an access point.
• Your ISP provides a modem/router combo, and you add your own router behind it without putting the combo in bridge mode.
• You use a cellular hotspot or a travel router that performs NAT, and then connect another router to it.

Each router creates its own private subnet. For example, your ISP router might assign 192.168.0.x, and your personal router might assign 192.168.1.x. Your device gets an IP from your personal router, which then gets an IP from the ISP router. Both routers translate your traffic, hence the name.

How to Detect Double NAT

Detection is simple and takes less than a minute. The key is to compare the public IP that your router sees with the public IP that a website sees.

1. Find your router’s WAN IP. Log in to your router’s admin page and look for the WAN or Internet status. Note the IP address shown there.
2. Find your actual public IP. On a device connected to your network, visit a website like whatismyip.com or search “what is my IP” in a search engine. Note the IP address shown.
3. Compare the two. If the IPs are different, you have double NAT. If they match, you do not.

Why this works: Your router’s WAN IP is the IP that the upstream device (the second router) assigned to it. That IP is private (like 192.168.0.5). The website sees your public IP, which is assigned by your ISP. If those differ, you have two layers of NAT.

Alternative: Check the Subnet

If you cannot access the router’s admin page, check the IP address of your router’s WAN port from a device. On Windows, open Command Prompt and run:

ipconfig

Look for the “Default Gateway” under your active adapter. That is your router’s IP. Then log in to your router and find the WAN IP. If the WAN IP is in a private range (10.x, 172.16-31.x, or 192.168.x), you are behind another NAT.

The Three Ways Out

There are three common fixes, ranked here from least to most disruptive. The right one depends on what you need to achieve and what equipment you control.

1. Bridge Mode (Best for Most Cases)

Put the upstream router (the one closer to the internet) into bridge mode. This turns it into a modem or switch, disabling its NAT and routing functions. Your own router then gets the public IP directly from your ISP, eliminating double NAT.

How to do it: Access the upstream router’s admin page and look for a setting called “Bridge Mode,” “Modem Mode,” or “IP Passthrough.” Enable it. If the upstream router is your ISP’s modem/router combo, you may need to contact your ISP to enable bridge mode, as some lock it.

What it breaks: Bridge mode disables the upstream router’s Wi-Fi and any routing features. If you have devices connected to it, they will lose internet unless you connect them to your own router. Also, if you have a TV box or VoIP phone that relies on the ISP router’s settings, bridge mode may break those.

When it applies: You have a separate router that you want to use as the main router, and you have access to the upstream router’s settings.

2. DMZ on the Upstream Router

If you cannot use bridge mode (e.g., your ISP router doesn’t support it), you can place your router in the upstream router’s DMZ. This forwards all inbound traffic from the internet to your router, bypassing the upstream router’s firewall and NAT for that traffic.

How to do it: On the upstream router, find the DMZ setting (often under “Security” or “Firewall”). Enter the IP address of your router’s WAN port. Your router’s WAN IP must be static—set a DHCP reservation on the upstream router for that IP so it doesn’t change.

What it breaks: DMZ exposes your router directly to the internet, so it relies on your router’s firewall for protection. It also does not fully eliminate double NAT for outbound traffic; your router still sees a private IP on its WAN, so some applications that check for a public IP may still fail.

When it applies: Bridge mode is unavailable, and you need to forward ports to a device behind your router. It is a compromise, not a full fix.

3. Port Forwarding on Both Routers

If you only need to allow specific inbound connections (e.g., for a game server or a security camera), you can forward ports on both routers. This is the most complex and least reliable method, as it requires careful configuration on both devices.

How to do it:

1. On your personal router, forward the needed ports to the device’s private IP.
2. On the upstream router, forward the same ports to your personal router’s WAN IP.

What it breaks: Port forwarding only works for the specific ports you configure. Other inbound connections still fail. It also requires that the device has a static IP, and it can break if the upstream router’s DHCP lease changes.

When it applies: You cannot use bridge mode or DMZ, and you only need a few ports open. It is a last resort.

What People Get Wrong About Double NAT

A common mistake is to assume that double NAT is the same as having two Wi-Fi networks with the same SSID. That is a different issue—it causes roaming problems, not NAT problems. Double NAT is about IP translation, not wireless coverage.

Another misconception is that double NAT is always a problem. For many users, it causes no noticeable issues. Web browsing, streaming, and most applications work fine because they only need outbound connections. The problems appear when you need inbound connections: hosting a game server, using port forwarding, or connecting to a VPN from outside. So the fix is only necessary if you actually need those features.

A third error is to try to fix double NAT by changing the IP address of one router. Changing the LAN IP of your personal router to something like 192.168.1.1 does not remove the second NAT; it only changes the subnet. The translation still happens on both routers. The fix must disable NAT on one of them, not just change IPs.

When You Can’t Fix It

Sometimes you cannot resolve double NAT because you do not control the upstream equipment. For example:

• Cellular networks: If you use a mobile hotspot, the carrier often uses carrier-grade NAT (CGNAT). You cannot disable that, and bridge mode is not an option. Your only workaround is to use a VPN or a service that provides a public IP, but that is beyond the scope of this page.
• ISP-owned routers: Some ISPs do not allow bridge mode on their provided routers. You may need to ask them to enable it, or you may need to replace the router with one you control.
• Apartment buildings or shared internet: If the building provides internet through a router you cannot access, you are stuck with double NAT unless you use a VPN that can punch through.

In these cases, the fix is not technical—it is a matter of contacting the owner of the upstream equipment. If that is not possible, you may have to accept the limitations.

Comparison of Fixes

Related Issues

Double NAT is a symptom of a larger networking issue: multiple layers of NAT. To understand the mechanics, see types of NAT and port forwarding. If you are experiencing slow internet or disconnects, double NAT might not be the cause—check for Wi-Fi interference or ISP issues first.

If you have a gaming console and cannot connect to multiplayer sessions, double NAT is a likely culprit. The fix is the same as above. If you are using a VPN, double NAT can cause the VPN to fail; bridging the upstream router often resolves it.