The short version
Double NAT means your internet passes through two routers that both translate addresses, usually your ISP’s gateway and your own router behind it. Browsing, streaming and a VPN router’s connection to your VPN provider all work fine through it. What it breaks is anything that needs to reach into your home: port forwarding, game hosting, remote access and UPnP. The fix is to make one of the two routers stop routing, with bridge mode, IP Passthrough or a direct connection to your fiber box.
If a game console just told you your NAT type is strict, or a port forward you set up does nothing, there’s a good chance you have double NAT. It’s one of the most common side effects of adding your own router to the box your internet provider gave you, and in most homes it’s fixable in a few minutes.
Key takeaways
- Double NAT happens when your router sits behind an ISP gateway that is also acting as a router.
- Everyday browsing, streaming and an outbound VPN connection work normally through it.
- It breaks inbound connections: port forwarding, hosting game lobbies, Plex remote access and remote access to your home network.
- Check your router’s WAN IP: a 192.168.x.x, 10.x.x.x or 172.16–31.x.x address means double NAT. A 100.64–100.127.x.x address means CGNAT, which is different.
- Fix it with bridge mode, IP Passthrough (AT&T), a direct line to the fiber ONT, or a DMZ pointed at your router.
What is double NAT?
Every home router does NAT, short for network address translation. Your provider gives your home one public IP address, and the router translates between that address and the private addresses it hands out to your phones, laptops and TVs. One router, one translation, and everything inside the house shares that single public address.
Double NAT is what happens when there are two of these translations in a row. Your ISP’s gateway holds the public address and translates once. Your own router, plugged in behind it, receives a private address from the gateway and translates again for your devices. Traffic going out passes both layers without trouble. Traffic trying to come in has to find its way through two sets of translation rules, and usually it can’t.
NAT, in one sentence
Network address translation lets every device in your home share one public IP address by keeping a table of which outgoing connection belongs to which device, so replies find their way back. Connections that start outside your home have no entry in that table, which is why they need port forwarding.
Is double NAT bad?
Not for most of what a household does online. Web pages, Netflix, video calls and app updates all start from inside your home, so the replies come back through both layers without a problem. Double NAT adds no meaningful slowdown on modern hardware.
It becomes a problem when something on the internet needs to start a connection to a device in your home. Here’s how that plays out:
| Activity | Behind double NAT |
|---|---|
| Browsing, streaming, video calls | Works normally |
| VPN router connected to your VPN provider | Works normally. The tunnel starts from inside your home. |
| Online gaming | Often shows strict or moderate NAT; joining or hosting lobbies and voice chat can fail |
| Port forwarding (game servers, cameras, Plex remote access) | Fails unless you forward on both routers |
| UPnP (automatic port opening) | Only opens ports on your router, not the gateway in front of it |
| Hosting a VPN server at home to reach your network remotely | Fails without a fix or a workaround |
How do I know if I have double NAT?
Check the WAN address on your router, the one your devices connect to. It’s on the router’s status or internet page, labeled WAN IP, Internet IP or similar. Ignore the 192.168.x.x addresses your router gives your devices; you’re looking at the address the router itself received.
| Your router’s WAN IP starts with | What it means |
|---|---|
| 192.168.x.x, 10.x.x.x or 172.16–172.31.x.x | Double NAT. Another router in front of yours is translating first. You can usually fix this. |
| 100.64.x.x to 100.127.x.x | CGNAT. Your provider is translating at its end, before the signal reaches your home. A different problem with different fixes; see our CGNAT guide. |
| Anything else | A public IP. No double NAT; if ports still won’t open, the problem is a local setting. |
A quick second check: run a traceroute (tracert 8.8.8.8 on Windows, traceroute 8.8.8.8 on Mac). If the first two hops are both private addresses, there are two routers in the path.
How to fix double NAT
Every fix works the same way: make one of the two boxes stop routing, so only one translation happens. Which option you have depends on your provider.
1Put the ISP gateway in bridge mode
Many cable gateways, including Xfinity’s, have a bridge mode setting that turns off the gateway’s routing and Wi-Fi and passes the public IP straight to your router. Your router becomes the only one doing NAT. Some provider app features stop working in bridge mode. See our Xfinity guide and Spectrum guide for the specifics.
2Use IP Passthrough (AT&T Fiber)
AT&T gateways don’t offer true bridge mode, but IP Passthrough hands the gateway’s public IP to your router so it can do the routing. The gateway stays in the path, but the double translation goes away. Steps are in our AT&T Fiber guide.
3Connect straight to the fiber ONT (Verizon Fios)
On an internet-only Fios plan, your router can plug into the ONT, the fiber box on the wall, by Ethernet and replace Verizon’s router entirely. Fios TV, MoCA and some extenders can keep Verizon’s router in the picture; our Verizon Fios guide covers which setup fits.
4Point the gateway’s DMZ at your router
If your gateway has no bridge or passthrough option, set its DMZ (sometimes called “DMZplus” or “exposed host”) to your router’s address. The gateway then forwards all incoming traffic to your router, which applies its own firewall. Point the DMZ at the router, never at a computer or console.
5Or leave it, if nothing is broken
If you only browse, stream and use a VPN, double NAT costs you nothing. Plugging a VPN router in behind the gateway is a perfectly good setup; our ISP router vs VPN router breakdown explains when it’s the right call.
Does double NAT affect a VPN?
Not the way most people use one. A VPN router connects out to your VPN provider’s server, the same direction as a web page request, so WireGuard and OpenVPN tunnels connect normally through double NAT. This is why the simplest VPN router setup, plugged in behind your provider’s gateway, works with every internet provider.
Where it does matter is when the VPN runs the other way: hosting a VPN server at home so you can reach your own network from a hotel or office. That needs an incoming connection, so it fails behind double NAT until you apply one of the fixes above. If you can’t remove the double NAT, a mesh tool such as Tailscale gets around it because both ends connect outward; we cover that in how to set up Tailscale on a router.
One related symptom that isn’t double NAT: if the VPN connects but some websites hang, that’s usually packet size. See VPN connected but websites won’t load.
What about T-Mobile, Verizon 5G Home and Starlink?
5G home internet and satellite services add a twist. T-Mobile’s gateway has no bridge mode, and these providers commonly use CGNAT, where the translation happens at the provider before traffic reaches you. Turning off your gateway’s routing can’t fix that layer. Check your WAN IP using the table above; if it starts with 100.64 through 100.127, the workarounds are different: a public IP add-on from your provider where one exists, a mesh tool like Tailscale for remote access, or a VPN provider that offers port forwarding. Our CGNAT guide covers each one. Provider-specific setups are in our T-Mobile and Starlink guides.
Built to sit behind any gateway
See the best VPN routers of 2026
Whether you bridge your gateway or plug in behind it, the router doing the work should handle your VPN, port forwarding and Wi-Fi properly. Our routers ship pre-flashed and tested at our offices, with VPN pre-configuration available as an add-on at checkout.
Compare the best routers of 2026 →Not sure which model fits your setup? Take the 60-second router quiz and we’ll match you to the right one.
Frequently asked questions
What is double NAT?
Double NAT is when your internet traffic passes through two routers that both perform network address translation, usually your ISP’s gateway and your own router behind it. Outgoing traffic works normally, but incoming connections such as port forwards and game hosting usually fail.
Is double NAT bad for gaming?
It often is. Consoles behind double NAT typically report strict or moderate NAT, which can block hosting, joining some lobbies and voice chat. Putting the ISP gateway in bridge mode, using IP Passthrough or pointing the gateway’s DMZ at your router usually brings it back to open NAT.
Does double NAT slow down internet speed?
Not in any way you’d notice on modern hardware. Each extra translation adds a tiny amount of processing, but speed tests and streaming are unaffected. The problems double NAT causes are about incoming connections, not speed.
Does double NAT affect a VPN router?
A VPN router connecting to your VPN provider works normally through double NAT because the tunnel starts from inside your home. Hosting a VPN server at home for remote access is what fails, and that needs bridge mode, IP Passthrough, a DMZ or a mesh tool like Tailscale.
How do I check for double NAT?
Look at the WAN or internet IP on your own router’s status page. If it starts with 192.168, 10, or 172.16 through 172.31, there’s another router in front of yours and you have double NAT. If it starts with 100.64 through 100.127, your provider uses CGNAT instead.
Is putting my router in the ISP gateway’s DMZ safe?
Yes, as long as the DMZ points at your router and not at a computer or console. Your router still applies its own firewall to everything the gateway forwards, so your devices stay protected.
One router in charge, no more strict NAT
Routers that bridge cleanly, handle port forwarding and run your VPN, pre-flashed and tested before they ship.
Compare the best routers of 2026 →Not sure which fits? Take the 60-second router quiz
100,000+ Routers Shipped · 15+ Years of VPN Expertise · Official NordVPN Partner · US-Based Experts