What double NAT is, and when it matters
Google defines double NAT as what happens when another router is connected to the ISP modem or gateway, so traffic passes through network address translation twice. It notes the extra delay is very small, but that double NAT can cause problems for online games, port forwarding rules and UPnP, and that the two private networks can keep devices such as a computer and a printer from reaching each other. [1]
So the first decision is whether anything is broken. Ordinary browsing, video calls and outbound VPN apps usually start connections from inside, which NAT handles. Hosting something that others connect to, or a device on one network reaching a device on the other, is where double NAT shows up.
Step 1: identify which NAT you have
GL.iNet documents a simple check: note the WAN IP address shown in your router admin panel and compare it with the result of a "what is my IP" search. If the two match, you have a public IP address on that router. [3]
If they differ, read the router WAN address. An address in 100.64.0.0/10 is the shared address space that RFC 6598 reserves for carrier-grade NAT between the provider and customer equipment. An address in a common private home range, such as one handed out by your ISP gateway, usually means the ISP gateway is also routing in front of you. [4]
| What you see | Likely cause | Next step |
|---|---|---|
| Router WAN IP matches "what is my IP" | No extra NAT in front of this router | Look elsewhere: firewall rules, the service itself |
| WAN IP is a private home address from the ISP gateway | Double NAT in your home | Use the fix order below |
| WAN IP is in 100.64.0.0/10 | Carrier-grade NAT at the provider [4] | Ask the ISP; plan remote access without inbound ports |
| Both of the last two | Double NAT at home plus CGNAT | Fix the home layer; the provider layer remains |
Step 2: fix in the documented order
Google recommends removing the ISP-provided router when the modem and router are separate devices. When they are one device, it recommends enabling bridge mode on the ISP modem-router so it stops performing NAT. Putting your own Wi-Fi device in bridge mode is listed as not recommended, because it turns off routing and DHCP on that device. [1]
Bridge mode has real costs on the device that is bridged. Google lists features that become unavailable on a bridged Google router, including guest Wi-Fi and DNS and WAN settings, and notes bridge mode only works with a single Wi-Fi device rather than a mesh. [2] GL.iNet similarly lists features unavailable in its Access Point mode, including VPN, Tailscale, port forwarding, Multi-WAN and guest network. [6]
If you cannot bridge: the workaround and its limits
When the ISP gateway cannot be bridged and you need a feature only router mode offers, you can leave double NAT in place and forward the required ports on both devices: the ISP gateway forwards to your router, and your router forwards to the device. GL.iNet documents port forwarding and a DMZ option that sends all inbound packets to one internal address; it warns that if DMZ priority is higher than port forwarding rules, the rules are invalidated. [5]
Treat any DMZ setting as a security decision, not a convenience switch. Exposing a whole router or computer to inbound traffic widens what the internet can reach. Forward only the ports a named service needs, record each rule, and remove rules you no longer use.
Worked example: a fictional game console and printer
Lee added a router behind the ISP gateway. Browsing and calls are fine, but a console reports a strict NAT type and a laptop on the new router cannot see a printer still plugged into the ISP gateway. The router WAN IP is a private address from the ISP gateway and not in 100.64.0.0/10, so this is double NAT at home.
The gateway supports bridge mode. Lee records its current settings, bridges it, moves the printer behind the new router and retests both symptoms. Had the WAN IP been in 100.64.0.0/10, bridging would have removed only the home layer; inbound connections would still need the ISP or a different remote-access approach.
Pitfalls
This guide is a documentation-based procedure. We have not tested a specific ISP gateway, and bridge options and their effects vary by provider and model.
- Bridging the wrong device: bridging your own router removes the features you bought it for. [1][6]
- Assuming a speed fix: double NAT adds very little delay; slow speeds need their own diagnosis. [1]
- Fighting CGNAT with router settings: the 100.64.0.0/10 layer is at the provider. [4]
- Losing the way back: record ISP gateway settings before bridging, because recovering may require a factory reset of that device.
Questions before you decide
Is double NAT slowing my internet?
Google describes the added delay as very small. Double NAT mainly causes problems with port forwarding, UPnP and some online games, and it can stop devices on the two networks from reaching each other. Diagnose speed problems separately.
Can I fix carrier-grade NAT myself?
Not with router settings. If the router WAN address falls in 100.64.0.0/10, the shared address space reserved for carrier-grade NAT, the extra translation happens at the provider. Ask the ISP about a public IPv4 address or use a remote-access method that does not need inbound ports.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Google Nest Help: Fix Double NAT when two routers run at the same time Accessed 13 Oct 2026
- Google Nest Help: Bridge mode Accessed 13 Oct 2026
- GL.iNet docs: How to check if your ISP assigns you a public IP address Accessed 13 Oct 2026
- RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space Accessed 13 Oct 2026
- GL.iNet docs: Port forwarding (firmware 4) Accessed 13 Oct 2026
- GL.iNet docs: Network mode (firmware 4) Accessed 13 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.