Double NAT occurs when traffic passes through two address-translating routers, often an ISP gateway plus your own router. Browsing may work normally, while incoming services or some applications become harder to configure. Identify the devices before changing modes.
Draw the actual path
A common arrangement is Internet → ISP gateway → personal router → laptop. The ISP gateway creates one private LAN, such as 192.168.0.0/24. Your router's WAN gets 192.168.0.2, and its LAN uses 192.168.1.0/24. Both devices translate outgoing IPv4 traffic.
Record each device's LAN and WAN address. If your router's WAN address is private, inspect the next upstream device when you control it. If the provider owns the upstream translation, the issue may be CGNAT instead. A private hop in traceroute alone is not enough to settle that question.
Pick the device that should route
| Option | Result | Check first |
|---|---|---|
| ISP gateway bridge mode | Your router handles the Internet connection | ISP authentication, VLANs, voice/TV, management access |
| Personal router access-point mode | ISP gateway routes; personal device supplies Wi-Fi/switching | Which router features will be disabled |
| Keep two routers | Separate routing domains remain | Application needs and two-stage rules |
Bridge and access-point modes are different choices. Use the supported mode for the device rather than randomly disconnecting cables or disabling services. ISP equipment may integrate telephone, television, or provisioning features that must keep working.
If both routers must remain
Use distinct, non-overlapping LAN subnets. A downstream router whose WAN and LAN overlap can make routing confusing or invalid. Keep DHCP scoped to each routed LAN, and document which router supplies each client's gateway and DNS settings.
An inbound IPv4 service may require a rule at the upstream router to the downstream router's stable WAN address, plus a second rule to the actual server. This still does not overcome provider CGNAT. A broad upstream DMZ setting changes exposure and should not be a default fix.
Change one boundary and verify
- Save the configuration and record a management address or recovery procedure.
- Apply the chosen supported mode during a maintenance window.
- Reconnect clients and confirm their actual gateway and addresses.
- Retest browsing, DNS, calls, VPNs, and any incoming service.
Compare the new WAN/public relationship and remove obsolete forwarding rules. If you use IPv6, check prefix delegation and firewall behavior separately; simplifying IPv4 NAT does not automatically prove that the IPv6 configuration is correct.
Put it into practice
References & further reading
Protocol standards and official documentation supporting this guide. Device menus and provider policies vary; use the documentation for your equipment when applying a change.