Owen Bradley You bought a better router, plugged it into the box your internet provider supplied, and everything mostly works. Then the problems start: game consoles report a strict or moderate NAT type, VPN connections fail to establish, port forwarding rules you carefully created do nothing, and remote access to your home cameras times out. The culprit is almost always double NAT, a situation where two devices on the same line are both performing router duties. Learning to fix double NAT is mostly a matter of demoting one of those devices, and the usual answer is putting the provider gateway into bridge mode.
What Double NAT Actually Is
Network address translation is the trick that lets many devices share one public internet address. Your router holds the public address on its outside interface, hands private addresses to everything inside, and rewrites traffic as it passes through so replies find their way home. One layer of that is normal and invisible.
Double NAT means the translation happens twice. The provider gateway holds the public address and creates its own private network. Your own router then plugs into that private network, treats the address it receives as if it were public, and creates a second private network behind it. Traffic leaving your laptop is translated once by your router and again by the gateway.
For ordinary browsing and streaming this rarely matters. Outbound connections work fine either way. The breakage appears with inbound connections, because anything arriving from the internet lands on the outer gateway and has no idea that a second private network exists behind it. That is why gaming, self-hosted services, VPN servers and remote camera access are the things that fail.
How to Confirm You Have Double NAT
- Check your router’s WAN address. Log into your own router and look at the status or internet page. If the WAN address begins with 192.168, 10., or falls between 172.16 and 172.31, it is a private address and something upstream is routing.
- Compare against your real public address. Look up your public address from any device on the network using a what-is-my-IP service. If it does not match your router’s WAN address, there is a second layer.
- Watch for the 100.64 range. An address in 100.64 to 100.127 means carrier-grade NAT at the provider level, which is a different problem that bridge mode alone will not solve.
- Read the console diagnostics. Game consoles and many smart TVs report NAT type directly. A persistent strict or Type 3 result after correct port forwarding is a strong double NAT signal.
- Count your boxes. If there is a provider gateway with its own Wi-Fi name broadcasting alongside your router’s network, you almost certainly have two routers running.
Preparation Before You Change Anything
- Note your provider account details and any support phone number, because some providers must enable bridge mode from their end.
- Write down the gateway’s admin address and password, usually printed on a label on the unit itself.
- Export a configuration backup from your own router if the option exists.
- Have a wired laptop ready, since Wi-Fi may drop out during the change.
- Check whether your provider’s phone service or television boxes run through the gateway, as bridging can disable them.
That last point matters more than any other. If your landline or TV service depends on the gateway routing traffic, bridge mode may not be an option and you will need one of the alternatives later in this article. If you are still deciding what hardware belongs where, our explainer on modem versus router versus gateway clarifies which device is doing which job on your line.
Step by Step: Putting the Gateway in Bridge Mode
- Connect directly to the gateway. Plug a laptop into one of the gateway’s LAN ports, or join its Wi-Fi network. You need to reach its admin page without going through your own router.
- Log in to the gateway. Enter its address in a browser, usually 192.168.0.1, 192.168.1.1 or 10.0.0.1. The admin password is generally on the sticker unless you changed it.
- Find the bridge setting. Look under Advanced, Gateway Function, Home Network, or IP Passthrough. Vendor names vary: Bridge Mode, Transparent Bridging, Modem Mode, RG Passthrough or Disable Router Mode all describe the same idea.
- Read the warning carefully. The gateway will tell you that its Wi-Fi, firewall and LAN services will stop. That is the intended outcome, but confirm you are not relying on any of them first.
- Apply the change and wait. The gateway reboots, usually taking two to five minutes. Its status lights may cycle through several states before settling.
- Cable your router correctly. Run an Ethernet cable from the gateway’s active LAN port, often port one specifically, into the WAN or Internet port on your own router. Not a LAN port.
- Power cycle your router. Unplug it for thirty seconds, then plug it back in so it requests a fresh address on the newly bridged line.
- Verify the WAN address. Reopen your router’s status page. The WAN address should now be a public one that matches what a what-is-my-IP lookup reports. That match is your proof that double NAT is gone.
- Re-test the broken thing. Recheck the console NAT type, retry the VPN, or hit your port forward from outside the network. Port forwards should now behave, because there is only one device translating.
Provider Quirks Worth Knowing
Not every provider implements bridging the same way, and a few make it deliberately awkward.
Cable providers
Most cable gateways expose bridge mode in the admin interface, though some require you to call support or toggle it through the provider’s account app rather than the local page. On several platforms the change also disables the built-in Wi-Fi permanently until you reverse it. If your line runs on a major cable network and you are shopping for a router to sit behind the bridged gateway, our roundup of the best routers for Xfinity covers models known to negotiate cleanly on those networks.
Fibre and DSL providers
Fibre installations often use an optical network terminal plus a router in one box. Some allow full bridging, others only offer IP passthrough, which forwards the public address to one nominated device by its MAC address while the gateway continues to handle the physical line. Functionally that solves double NAT just as well. DSL gateways sometimes need the connection profile re-entered on your own router, including the authentication username and password.
When the provider says no
If bridging is locked out or would kill services you need, the usual middle ground is the DMZ or exposed host setting. You point the gateway’s DMZ at your router’s WAN address, and inbound traffic passes through to it. Technically double NAT still exists, but the outer layer stops blocking anything. Reserve a fixed address for your router on the gateway first, or the DMZ target will drift.
Alternatives to Bridging Entirely
Sometimes the cleanest fix is removing a box rather than reconfiguring one. If your provider allows customer-owned equipment, replacing the gateway with a single unit that handles both the line and the routing eliminates the second layer by design and often removes a rental fee at the same time. Our guide to the best modem routers covers combined units, while the comparison of best ISP routers explains which supplied boxes are worth keeping and which are worth replacing outright.
The other alternative is to demote your own router instead. Switching it to access point mode disables its routing and NAT, letting the gateway handle everything while your hardware provides Wi-Fi coverage. This kills double NAT too, but you lose your router’s firewall, quality-of-service and parental control features, so it only makes sense when the gateway is genuinely capable.
Verifying Only One Device Is Routing
After any of these changes, run a quick sanity check. Your router’s WAN address should be public and should match an external lookup. A traceroute to a public site should show one private hop before reaching provider infrastructure, not two. Only one device on the line should be handing out addresses. And the gateway, if bridged properly, should no longer broadcast its own Wi-Fi network.
If gaming performance was the original motivation, retest after the change rather than assuming. Latency-sensitive setups benefit from a router with solid buffer management and traffic prioritisation, which is exactly what the models in our best routers for gaming roundup are selected for.
Troubleshooting a Failed Bridge
No internet at all after bridging
Check the cable is in the gateway’s designated active LAN port and your router’s WAN port. Power cycle both in order: gateway first, wait for solid lights, then the router.
Router still shows a private WAN address
The bridge did not take effect, or the gateway needs a full power cycle rather than a soft reboot. Unplug it for a minute and try again.
You cannot reach the gateway admin page anymore
This is normal once bridged. Most gateways keep a management address such as 192.168.100.1 reachable from a directly connected computer if you need to reverse the change.
Everything broke and you need to undo it
Hold the gateway’s reset button for the documented duration to restore factory settings, which turns routing back on. This is why noting your provider authentication details beforehand matters.
Frequently Asked Questions
Does double NAT slow my internet down?
Usually not in terms of raw speed. The impact is on inbound connections, NAT type and latency-sensitive peer-to-peer traffic rather than download throughput.
Is bridge mode less secure?
No, provided your own router has a competent firewall, which every modern one does. You are simply moving the security boundary to the device you control.
Can I keep the gateway Wi-Fi running as a spare network?
Not in true bridge mode, since the radios are disabled along with routing. IP passthrough sometimes preserves them, depending on the vendor.
Will bridging affect my provider phone service?
It can. Voice services carried over the gateway often stop working when routing is disabled, so confirm with your provider before committing to the change.
Final Thoughts
Double NAT is one of the few home network faults with a genuinely clean fix. Confirm it first by comparing your router’s WAN address against your real public address, then decide which device should be the sole router on the line. Bridging the provider gateway is the standard answer, IP passthrough is the common fallback, and replacing the box entirely is the tidiest long-term move where your provider permits it. Whichever route you take, verify the result rather than assuming, and keep a note of how to reverse the change. Get this right once and the gaming, VPN and remote access problems that pushed you here in 2026 simply stop happening.
