The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The cleanest fix is to make only one device perform routing. Put the ISP modem/router gateway in Bridge mode so your added router receives the public connection and handles NAT, DHCP and firewall duties. If the ISP gateway cannot be bridged, switch the added router to Access Point (AP) mode; the gateway remains the router and both devices share one LAN.
Double NAT is usually harmless for ordinary web browsing and streaming, but it can interfere with online games, port forwarding, UPnP, remote access and discovery of printers or other local devices. Use the checks and decision table below before changing settings so you know which device should receive each responsibility.
What double NAT means
Network Address Translation (NAT) lets multiple private devices share one public internet address. In a common two-router setup, the ISP modem/router translates traffic once, and the added router translates it again. A typical path looks like this:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Internet → ISP gateway → added router → phones, computers and smart-home devices
#1 Best Overall
- Free Omada Essentials Cloud Management: Free cloud management with no additional fees, everything is managed in the cloud without the need for hardware or software controllers. Simply launch the Omada app, scan the S/N code on the package, and you're ready to deliver
- Ultra-Fast True Wi-Fi 6 Speeds: Designed with the latest wireless Wi-Fi 6 technology featuring 1024-QAM, HE60 and Long OFDM Symbol, the EAP650 boosts dual-band Wi-Fi speeds up to 2976 Mbps
- Ultra-Slim Design: Compact design ensures simple installation while saving space. The elegant appearance makes EAP650 blend into any modern office, hotel, classroom, or cafe
- Integrated into Omada SDN: Omada Software Defined Networking (SDN) platform integrates network devices including access points, switches and gateways with multiple control options offered - Omada Hardware controller, Software Controller or Cloud-based controller. Standalone mode also supported
- Cloud Access Omada Compatibility: Remote Cloud access and Omada app enables centralized cloud management of the whole network from different sites, all controlled from a single interface anywhere, anytime
That arrangement creates two private networks. A device connected to the added router may be unable to initiate a connection to a printer or computer connected directly to the ISP gateway. Inbound connections also have to pass two routing and firewall layers, so a port opened on only one device may still be unreachable.
Google’s official guidance says that, for most people, double NAT does not affect Wi-Fi performance, but it can matter for online games, IP-address assignments, port-forwarding rules and Universal Plug and Play (UPnP). Google characterizes the extra delay from a second translation as “of the order of milliseconds” (page accessed 2026). The practical issue is usually reachability and control, not raw download speed.
Common signs
- A game reports a strict, moderate or double NAT type.
- Port forwarding appears correctly configured but an external test cannot reach the service.
- UPnP creates mappings on the wrong router or fails intermittently.
- A printer, file share or media device is visible from one side of the network but not the other.
- The second router’s internet or WAN address is private instead of publicly routable.
- Remote-access software works on the old network but stops after the second router is installed.
Check the topology before changing anything
Do not begin by randomly disabling DHCP, changing IP addresses or moving cables. First identify which box is doing what and whether the second router is actually routing.
1. Identify each device
- ISP gateway: The modem/router combination supplied or managed by your internet provider. It may provide the cable, DSL, fiber or cellular connection, NAT, DHCP and Wi-Fi.
- Added router: The device you installed for better coverage, more Ethernet ports, mesh features, parental controls or VPN support.
- Uplink cable: Note whether it runs from a gateway LAN port to the added router’s WAN/Internet port, or from LAN to LAN.
In normal router mode, the added router’s WAN/Internet port is the boundary between its private LAN and the upstream gateway. In AP mode, vendors generally specify a LAN-to-LAN or designated AP connection; follow that model’s instructions rather than assuming every port behaves identically.
Rank #2
- FREE Omada Essential Platform Centralized Remote Management: Unlock numerous advanced features by integrating with Omada Cloud Management Platform, such as network monitoring, remote network configuration, AI features, ZTP (Zero Touch Provisioning) etc. More possibilities you can find with your network management
- Dual-Band 4-Stream Wi-Fi 7: Up to 5.0 Gbps, 4324 Mbps on 5 GHz + 688 Mbps on 2.4 GHz. Powered by Wi-Fi 7 technology, enjoy faster speeds with Multi-Link Operation, increased reliability with Multi-RUs, and 120% more data capacity with 4K-QAM, delivering enhanced performance for all your devices
- Future Proof 2.5G Port: Equipped with a 2.5 Gigabit Ethernet port to support high-speed networking and future broadband upgrades-no hardware replacement required when switching to multi-gig internet plans
- Abundant Networking Features Available to Develop: Network monitoring, VLAN segmenting, Bandwidth management, Schedule Setup, Security features, PPSK all seated and right there waiting to be developed for you
- Premium WiFi Experience: Seamless roaming, Mesh, Airtime fairness and other business level wifi experience features are provided here
2. Read the added router’s WAN address
- Connect a phone or computer to the added router.
- Open its administration app or web interface.
- Find the page labeled Internet, WAN, Connection or Network status.
- Record the WAN IPv4 address and the listed gateway.
If the WAN address is private, the added router is behind another NAT layer. Common private ranges include 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. A 100.64.0.0/10 address can indicate carrier-grade NAT (CGNAT), where the ISP itself places customers behind another shared address. Ubiquiti notes that a non-public WAN is consistent with double NAT or CGNAT, so the address alone does not prove which layer is responsible.
3. Compare the WAN address with the internet-facing address
Use the added router’s status page and a reputable “what is my IP” page viewed from a client behind it. If the router’s WAN address differs from the internet-facing address, an upstream NAT layer may exist. If the ISP gateway is already bridged and the added router still receives a private WAN address, contact the ISP about CGNAT or another upstream service layer.
Choose the right fix
| Arrangement | Who owns NAT, DHCP and firewall | Where port forwarding goes | Added-router features | When to choose it |
|---|---|---|---|---|
| ISP gateway in Bridge mode + added router in router mode | Added router | Added router | Usually retained, including routing-dependent mesh, parental-control, VPN and guest-network functions | Best option when the ISP allows bridge mode and you want the added router to be the main network controller |
| Added router in AP mode | ISP gateway | ISP gateway | Routing-dependent features may disappear or be limited | Use when bridge mode is unavailable, restricted or unsuitable |
| Both devices in router mode | Both devices | Often both devices, sometimes with a second forwarding rule | Both devices keep their full routing feature sets | Only when you intentionally need two isolated networks and accept the extra configuration |
Google warns that putting a primary mesh device into bridge mode can disable family controls, priority-device settings, guest Wi-Fi and other security functions. Check the feature list for your exact model before selecting AP mode or bridging the gateway.
Fix 1: Put the ISP gateway in Bridge mode
Bridge mode turns the ISP gateway into a pass-through device for the internet connection. Its NAT and router functions stop, and the added router becomes the only router on your home network. Menu names differ by ISP, firmware and connection type; the labels below are typical rather than universal.
Rank #3
- Superior Speeds with MU-MIMO: Outfitted with the latest 802.11ac Wave 2 MU-MIMO technology, the TL-WA1201 easily delivers dual-band Wi-Fi speeds of up to 1200 Mbps to multiple devices at the same time
- Multi-Mode 4 in 1: Supports Client, Multi-SSID, Range Extender, and AP operation modes to enable various wireless applications to give users a more dynamic and comprehensive experience when using your AP
- PoE for Easy Installation: TL-WA1201 supports Passive PoE power supplies, can be powered by the provided PoE adapter, making deployment effortless and flexible
- Boosted Wi-Fi Coverage: Four external antennas equipped with Beamforming technology concentrate Wi-Fi signals towards your devices to extend reliable Wi-Fi to every corner of your home or office, even over long distances
- Gigabit Ethernet Port: Features a Gigabit Ethernet port that provides high-speed wired connectivity for devices requiring stable and fast network connections
Before you start
- Find the ISP gateway’s administrator credentials and the added router’s administrator credentials.
- Write down the current Wi-Fi names, passwords, LAN subnet and any port-forwarding rules in case you need to restore them.
- Check whether the ISP requires a particular Ethernet port for bridged service, or whether bridge mode disables the gateway’s telephone, television or provider-managed services.
- Make sure the added router supports the connection type and authentication method your ISP uses.
Bridge-mode procedure
- Connect a computer to the ISP gateway, preferably by Ethernet, and open its administration page.
- Look under Advanced settings, Internet, WAN, Gateway mode or Router mode for Bridge mode, Modem mode or IP Passthrough.
- Read the provider’s warning. Some gateways reboot, reset their Wi-Fi settings or make their management page reachable only from a special address after bridging.
- Enable bridge mode and allow the gateway to restart fully.
- Connect the gateway’s designated LAN port to the added router’s WAN/Internet port. Do not connect the cable to a random port if the provider specifies one.
- Open the added router’s internet settings. Set the WAN type to the method required by the ISP: commonly automatic/DHCP, or a provider-supplied username and password for PPPoE.
- Restart the added router if it does not obtain an address automatically.
- Check the added router’s WAN page. It should now receive the public IPv4 address, or the provider’s directly assigned address, rather than an address from the gateway’s private subnet.
After bridging, all clients should normally join the added router’s LAN and Wi-Fi. The gateway may still have a management interface, but it should no longer hand out addresses or perform the home network’s NAT.
If bridge mode breaks service
- No internet address: Verify whether the ISP requires PPPoE credentials, a VLAN setting, a fixed MAC address or a particular gateway port.
- Internet works but phone or television service fails: The provider may not support full bridge mode for bundled services. Ask whether IP Passthrough or a provider-specific bridge profile is available.
- You cannot open the gateway’s settings: Use the management address documented by the ISP, or temporarily connect directly to the gateway and follow its recovery instructions.
- The added router still shows a private WAN: The ISP may be using CGNAT. Bridge mode removes the gateway’s NAT but cannot create a public IPv4 address the ISP has not assigned.
Fix 2: Switch the added router to Access Point mode
AP mode is the fallback when the ISP gateway must remain the router. The added device supplies Wi-Fi and Ethernet access while the gateway continues to provide NAT, DHCP, firewall policy and port forwarding. ASUS describes AP mode as extending an existing router over Ethernet; NETGEAR and TP-Link likewise describe it as avoiding a second routing layer.
AP-mode procedure
- Sign in to the added router’s administration app or web interface.
- Open Operation mode, Advanced settings, System mode or a similarly named page.
- Select Access Point, AP or Bridge/AP mode, not a setting that merely repeats the Wi-Fi signal while leaving routing enabled.
- Read the feature warning. The device may disable its DHCP server, NAT, firewall, VPN server, parental controls, traffic prioritization or guest-network isolation.
- Choose the LAN address method requested by the firmware. Automatic addressing lets the gateway assign an address; a manual address can make administration easier if it is outside the gateway’s DHCP pool but inside the same subnet.
- Apply the change and wait for the device to reboot.
- Connect the gateway to the port specified by the router manufacturer for AP mode. Many models use a LAN port, while some accept the uplink on the former WAN port after AP mode is enabled.
- Reconnect clients to the AP’s Wi-Fi or Ethernet ports. They should receive their addresses, gateway and DNS settings from the ISP gateway.
Do not disable services through undocumented menus as a substitute for AP mode. Vendor-supported AP mode changes the required functions together and prevents partial configurations that leave routing active.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat changes in AP mode
- The gateway’s LAN subnet becomes the one home network.
- The AP’s management address may change, so use the gateway’s client list to find it if the old address stops working.
- Some mesh systems retain wireless backhaul and roaming, while routing-dependent controls are removed; the exact result is model-specific.
- Port forwarding, address reservations and inbound firewall rules belong on the gateway.
Where to configure port forwarding
Forward a port on the device that owns the public IP address. This rule prevents a common mistake: opening a port on the added router after switching it to AP mode.
Rank #4
- Free Omada Essentials Cloud Management: Free cloud management with no additional fees, everything is managed in the cloud without the need for hardware or software controllers. Simply launch the Omada app, scan the S/N code on the package, and you're ready to deliver
- Ultra-Fast True Wi-Fi 6 Speeds For Your Business: Designed with the latest wireless Wi-Fi 6 technology featuring 1024-QAM and Long OFDM Symbol, the EAP610 boosts dual-band Wi-Fi speeds up to 1800 Mbps. With 4 Spatial streams, multi-user throughput is incredibly increased to drive more applications
- Ultra-Slim Design: Compact design ensures simple installation while saving space. The elegant appearance makes EAP610 V2 blend seamlessly into any modern office, hotel, classroom, or cafe
- Integrated into Omada SDN: Omada Software Defined Networking (SDN) platform integrates network devices including access points, switches and gateways with multiple control options offered - Omada Hardware controller, Software Controller or Cloud-based controller. Standalone mode also applies
- Cloud Access Omada Compatibility: Remote Cloud access and the Omada app enable centralized management of your entire network across multiple sites. Control everything from a single interface, anywhere and anytime. Please verify device compatibility with SDN firmware in the product documentation or manufacturer's technical specifications
- Bridge mode: The added router receives the public connection, so create the forwarding rule there. Reserve the server’s LAN address, choose the correct TCP, UDP or both protocol setting, and restrict the external port when the application permits it.
- AP mode: The ISP gateway remains the router, so create the rule there. The AP is no longer a routing hop and cannot deliver an inbound connection by itself.
- Intentional two-router network: You may need a rule on the outer router pointing to the inner router, plus a second rule on the inner router pointing to the server. This “double forwarding” is harder to maintain and does not remove double NAT.
After saving a rule, test from outside your home network, such as a mobile connection with Wi-Fi disabled. Testing from inside the same LAN can fail because some gateways do not support NAT loopback.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Retest the problem that led you here
- On a client connected to the intended home network, renew its network connection and confirm it receives an address in the expected subnet.
- Check that the default gateway shown by the client is the device you intend to be the router.
- From the added router’s status page, confirm whether it has a public WAN (bridge mode) or no separate routed WAN role (AP mode).
- Test printer discovery, file sharing or casting between two clients on the same LAN.
- Run the affected game and record its NAT type after restarting the game and router.
- Test UPnP only if you need it, and inspect which router reports the mapping.
- Test remote access or the forwarded service from an external network.
Troubleshooting when double NAT remains
The added router still shows a private WAN in bridge mode
Confirm that bridge mode actually applied and that the cable runs from the gateway’s bridged port to the added router’s WAN port. Power-cycle in this order: gateway first, wait until it is online, then the added router. If the WAN remains private, ask the ISP whether CGNAT is enabled. Ubiquiti identifies a non-public gateway WAN as consistent with double NAT or CGNAT; only the ISP can remove an upstream CGNAT restriction or provide a public address.
Clients receive addresses from the wrong device
Look at the client’s IP address and default gateway. In AP mode, the gateway should supply both. If the added router is still issuing addresses, its operating mode did not change, the firmware requires a different uplink port, or a second DHCP service is active. Re-enter the vendor-supported AP mode and follow its wiring diagram.
Internet works but local devices cannot see one another
Make sure all clients are connected to the same LAN rather than one device’s guest network or the gateway’s separate Wi-Fi. Guest SSIDs often intentionally block local access. Also check whether wireless client isolation is enabled on either device.
Best Value
- Four stream 802.11AC Wave2 technology
- Supports 200+ concurrent users
- 802.3af PoE compatibility
- Optional covers (sold separately) allow the Unifi nanohd AP TO discreetyly blend into its setting
Port forwarding works intermittently
Reserve the destination device’s LAN address so it does not change. Verify the protocol and internal port, then confirm that the router receiving the public address owns the rule. If the ISP uses CGNAT, ordinary IPv4 forwarding may be impossible without an ISP-provided public address or an alternative remote-access design.
Gaming improves but some controls disappear
This is an expected trade-off when a mesh or feature-rich router is bridged or placed in AP mode. Routing-based parental controls, guest isolation, VPN servers and priority-device policies may depend on NAT and DHCP. Decide whether those controls belong on the gateway, on the added router in router mode, or in a separate service before changing modes again.
Can you keep both routers without double NAT?
Yes, but not while both devices independently route the same household traffic. Keep the ISP gateway in router mode and use the second device as an AP, or bridge the gateway and let the second device route. You can also maintain two intentionally isolated networks, such as a work lab behind the second router, but expect separate address ranges, firewall boundaries and more complicated forwarding. An Ethernet switch or a longer cable only extends a network; it does not disable either router’s NAT.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Security and management after the fix
- Change default administrator passwords on whichever device remains a router.
- Keep firmware current, especially on the gateway that now handles the firewall in AP mode.
- Disable remote administration from the internet unless you have a specific, protected need.
- Use a separate guest network when visitors or untrusted devices should not reach household clients.
- Document the final topology, LAN subnet, DHCP range, reserved addresses and port-forwarding rules.
- When contacting the ISP, describe the exact WAN address shown by the added router and whether the gateway is bridged; this distinguishes a local configuration problem from CGNAT.
Bottom line
Use bridge mode when you want the added router to be the sole router and the ISP supports it. Use AP mode when the ISP gateway must keep routing. In either case, verify the WAN or DHCP results and place port forwarding on the device that owns the public IP. If the address remains private after the local NAT layer is removed, the remaining obstacle is probably ISP-level CGNAT rather than a second router in your home.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
