Double NAT means two routers in a row are each translating addresses. It usually happens when you plug your own router into a gateway from your provider that is still acting as a router itself.
To check: open your router’s status page and look at its internet (WAN) address. If it starts with 192.168, 10, or 172.16 to 172.31, there’s another router in front of yours, and you have double NAT. To fix it: make sure only one box is doing the routing, either by putting the gateway in bridge mode or by putting your own router in access point mode.
What double NAT is
A router lets all your devices share one internet connection using network address translation (NAT), which maps many private addresses onto a single address. When a second router sits behind the first, your traffic is translated twice.
- Wired (Ethernet)
- Wi-Fi
TP-Link describes the classic case: a modem router and a wireless router connected in series, which can cause problems with your internet service because of double NAT.
Does it matter?
Often less than people fear, but sometimes a lot. NAT is built for connections your devices start: in traditional NAT, sessions go out from the private network, and sessions coming in are allowed only by exception, through fixed mappings.
How to check for it
Log in to your own router (its app or web page) and find its internet, WAN or upstream IP address on the status page. Then compare it with this table:
| Router’s internet address starts with | What it means |
|---|---|
| 10., 172.16. to 172.31., or 192.168. | Private address: another router is in front of yours (double NAT) |
| 100.64. to 100.127. | Your provider is using carrier-grade NAT (see below) |
| Anything else | Your router has a public address: no double NAT at home |
The first row works because 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are the private address ranges reserved for local networks. The second is the shared address space set aside for carrier-grade NAT.
Fix 1: put the gateway in bridge mode
Bridge mode turns off the gateway’s router so that your own router does all the routing. Xfinity’s documentation describes it as turning off the gateway’s routing while leaving its modem on, so you can use your own router. It also lists the trade-offs: only one device can be connected to the gateway, and you lose the gateway’s network management and Xfinity’s Wi-Fi Extenders. TP-Link’s guidance for a modem router plus a wireless router is the same idea: bridge the modem router so the connection has a single NAT.
Choose this if you want your own router’s features and Wi-Fi. Provider names and steps differ, so check your provider’s documentation.
Fix 2: put your own router in access point mode
The opposite approach keeps the gateway as the router and turns your router into a plain Wi-Fi access point. TP-Link describes Access Point mode as using the router to turn a wired connection into a Wi-Fi network.
Fix 3: connect straight to a fiber terminal
If your provider installs a separate fiber terminal, plug your router directly into it rather than into another router. gFiber, for example, has customers connect their own router’s WAN port to the Fiber Jack’s Ethernet port.
Carrier-grade NAT is a different problem
If your router’s internet address starts with 100.64 to 100.127, your provider is sharing public addresses among customers using carrier-grade NAT. That address range is reserved for the link between the provider’s NAT equipment and your equipment.
For a plain-language explanation of modems, routers and gateways, see Modem vs router vs gateway. If you’re replacing equipment, How to choose a Wi-Fi router covers what to look for.