Why do I have two routers, and is double NAT causing my problems?
Keeping the provider's box and adding your own leaves your devices two translation layers from the internet. What that genuinely breaks, what it does not, and the three ways out in order of preference.
- Difficulty
- advanced
- Time
- 40 min
- Read
- 4 min
Short answer
If a provider router and your own router are both routing, every device sits behind two layers of address translation. Ordinary browsing is unaffected, which is why it goes unnoticed, but incoming connections, port forwarding and device discovery all break. Fix it by putting the provider box into modem or bridge mode, or by turning your own router into a plain access point.
Do this first
This arrangement usually happens by accident. Somebody buys a better router or a mesh system, plugs it into the provider's box because that is where the internet comes from, and everything appears to work. Months later a security camera cannot be reached from outside, a games console reports a strict connection type, or a printer on one network is invisible from the other, and nobody connects the two events.
Step by step
- Confirm you actually have it.Look at the address your device has, then at the address on your router's internet or WAN status page. If both are private ranges — starting 192.168, 10., or between 172.16 and 172.31 — your router is behind another router and you have double NAT. Many consoles and mesh apps also report it directly.
- Decide whether it matters to you.If nothing in the house needs to be reached from outside, and you have no discovery problems, you can leave it. Double NAT is untidy rather than harmful. Fix it when it is causing a symptom or when you are about to add something that needs incoming connections.
- First choice: put the provider router into modem or bridge mode.This makes it stop routing and simply pass the connection through to your router, which then does everything. Some providers support it and document it; some hide it; some do not offer it at all. Search the provider's support pages for your exact model plus modem mode.
- Second choice: turn your own router into an access point.Turn off its DHCP server, give it a fixed address in the provider router's range that is outside the range being handed out, and connect the provider router to one of its LAN ports rather than its WAN port. Your router then extends the existing network instead of creating a second one. Many routers have an access point mode that does all of this in one setting.
- Third choice, only if the first two are impossible: use the DMZ.Set the provider router to send all unsolicited incoming traffic to your router's address. It resolves the incoming-connection symptoms without removing the second layer. It is the weakest option and it removes the outer router's filtering for that address.
- Rejoin devices if the network name changed.If you moved everything onto one network, some devices may need rejoining. Smart devices are the ones that will need a factory reset and repair, so do them last and expect it.
- Retest the thing that was broken.Check the console's connection type, the camera's remote access, or the printer's visibility from the other side of the house — whichever symptom brought you here.
Tips
- Carrier-grade NAT is a related problem with a different cause: the provider itself puts you behind a shared public address, so even a single router cannot accept incoming connections. If bridging changes nothing, ask the provider whether you are on CGNAT and whether a public address is available.
- Mesh systems almost always have a specific bridge or access point mode in their app. Use it rather than reconfiguring by hand.
- Write down what you changed. The next person to look at this network — including you in two years — will not guess.
If it doesn't work
Console reports strict or type 3 connection
Cause: Two layers of translation blocking incoming connections — Fix: Resolve the double NAT. Port forwarding on the inner router alone cannot fix it because the outer router still blocks the traffic before it arrives.
A camera or NAS cannot be reached from outside the house
Cause: Same cause — Fix: Bridge or access-point mode. If neither is possible, many devices offer a relay or cloud-based remote access that works through double NAT, at the cost of routing your traffic through the manufacturer.
A printer or speaker on one router is invisible from the other
Cause: Discovery traffic does not cross between two separate networks — Fix: Get everything onto one network by using access point mode. There is no reliable way to make discovery cross two routers.
Port forwarding set correctly but nothing works
Cause: It is set on the inner router — Fix: Either resolve the double NAT, or set matching forwarding rules on both routers, which is fragile and breaks whenever an address changes.
Questions people ask
Does double NAT slow my internet down?
Not measurably for ordinary use. The cost is in what it prevents rather than in speed.
Can I just unplug the provider router?
Only if your own router can connect to the line directly, which depends on the connection type. On full fibre with a separate ONT, usually yes. On part-fibre or cable, the provider box often contains the modem and has to stay.
Is double NAT more secure?
It is not a meaningful security layer. Neither router is designed as a defence in depth and the incidental blocking it provides is the same blocking that is causing your problem.