If your games keep flagging a strict NAT, your port forwards never take, or your VoIP calls drop for no clear reason, the usual suspect is double NAT. So what is double NAT? In plain terms, it is when two routers on the same connection each perform network address translation, stacking one private network inside another. It is extremely common in 2026, usually harmless, and easy to fix once you know what to look for.
What changed in 2026
- All-in-one ISP gateways are the default. Most cable, fiber, and 5G providers now ship a combined modem-router-WiFi box in routing mode. Plug in your own router or mesh and you get double NAT out of the gate.
- Mesh systems are everywhere. Eero, Deco, Nest, and Orbi are the number-one cause now — people drop a mesh node behind the ISP box without bridging anything.
- CGNAT has spread. Carrier-grade NAT is common on 5G home internet and some fiber/cable plans. That adds an upstream layer you cannot control, and it looks a lot like double NAT but is not.
- IPv6 quietly helps. Many services now work fine over IPv6 even when your IPv4 path is double-NATed, so the problem bites less than it used to. Worth checking before you touch anything.
How double NAT actually happens
Each router hands out addresses on a private range — usually 192.168.x.x, 10.x.x.x, or 172.16–31.x.x. In a normal setup, one router translates your private addresses to the single public address your ISP gives you. Double NAT means your device sits behind Router B, which itself sits behind Router A, so your traffic gets translated twice before it hits the internet. The dead giveaway: the WAN (internet) address on your router is itself a private address instead of a public one.
How to check if you have double NAT
You do not need special tools. Try these in order:
- Read your router's WAN IP. Log into your router and look at the internet/WAN status page. If that address starts with
10., 172.16–172.31, or 192.168., something upstream is doing NAT too.
- Watch for a
100.64–100.127 address. That range means CGNAT on the ISP side — a different problem you cannot bridge away yourself.
- Run a traceroute to
8.8.8.8. Two private hops at the very start point to double NAT.
- Check the built-in test. Xbox and PlayStation network tests, plus Nest and some mesh apps, will literally say "Double NAT detected."
How to fix double NAT
Pick one method. Bridging the upstream device is almost always the cleanest.
| Method |
What it does |
Best for |
Watch out |
| Bridge mode on ISP gateway |
Turns the ISP box into a plain modem |
Most setups |
Loses ISP box WiFi and phone/TV features |
| IP passthrough / DMZ |
Hands the public IP to your router |
Gateways with no true bridge |
Names and menus vary wildly |
| Your router in AP mode |
Disables routing on your gear |
Keeping the ISP box in charge |
You manage WiFi on the ISP box |
| Double port forward |
Forwards ports on both routers |
Last resort |
Fragile and easy to break |
Bridge mode is the goal: the ISP gateway becomes a modem, and your router does all the routing and NAT once. If your gateway lacks a real bridge option, IP passthrough achieves nearly the same result. If you would rather keep the ISP box running the network, flip your own router or mesh into access-point (bridge) mode so it stops doing NAT entirely.
When double NAT does not matter (what to skip)
Honestly, if every app and game works, leave it alone. Double NAT adds only a sliver of latency and barely touches download or upload throughput. It mainly breaks inbound connections — self-hosting, port forwarding, some peer-to-peer games, and older VoIP setups.
Skip stacking DMZ rules and double port forwards to paper over it; that is fragile and hard to debug later. Skip buying a new router — this is configuration, not hardware. And if the culprit is CGNAT, no consumer router fixes it; you either request a public/static IP add-on from your ISP (often a small monthly fee — verify the current cost yourself) or lean on IPv6.
FAQ
Does double NAT slow down my internet?
Not meaningfully for raw speed. It adds a tiny bit of latency and can break inbound connections, but your download and upload numbers stay roughly the same.
Is double NAT a security risk?
No. The extra layer is neutral to mildly helpful, but it is not a real firewall and should not be treated as one.
Can a mesh system cause double NAT?
Yes, and it is the most common cause now. Put the mesh in bridge/AP mode, or bridge the ISP gateway so only one device does NAT.
How do I tell double NAT from CGNAT?
Check your router's WAN IP. A 100.64.x.x address means CGNAT on the ISP side; 192.168, 10., or 172.16–31 means a double NAT you can fix yourself.
Where to go next
If you are tuning the rest of your setup, our take on 1440p vs 4K in 2026 helps you match your display to your GPU, AMD vs Nvidia in 2026 breaks down the graphics-card tradeoffs, and 5G vs home WiFi in 2026 is essential reading if your double NAT traces back to a cellular gateway.