The cleanest fix is to leave only one device doing routing. Put the ISP modem/router gateway into Bridge mode so your added router owns the public connection, NAT, firewall and DHCP. If the ISP gateway cannot be bridged, switch the added router to Access Point (AP) mode; the gateway then remains the router and the second device supplies Wi-Fi and Ethernet coverage without creating another NAT layer.
Do not start by buying a switch or by randomly disabling DHCP. First identify which device has the public IP, then choose bridge mode or AP mode, rewire the devices as that mode requires, and test the activity that exposed the problem—gaming, port forwarding, UPnP, printer discovery or remote access.
As an Amazon Associate I earn from qualifying purchases.
What double NAT means
Network Address Translation (NAT) rewrites private home-network addresses so many devices can share one public internet address. A typical ISP gateway already performs NAT. When you connect a second router through its WAN/Internet port and leave it in normal router mode, that second router performs NAT again. Internet traffic is translated twice before it reaches the public internet: this is double NAT.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →The two routers also normally create two separate private networks. A computer connected to one network may not be able to discover a printer, camera or media device connected to the other. Google’s official guidance says that, for most people, double NAT does not change Wi-Fi performance, but it can cause problems with online games, IP-address assignments, port-forwarding rules and Universal Plug and Play (UPnP). The extra translation generally adds delay “of the order of milliseconds,” so the configuration problem matters more than raw speed.
#1 Best Overall
- Free Omada Essentials Cloud Management: Free cloud management with no additional fees, everything is managed in the cloud without the need for hardware or software controllers. Simply launch the Omada app, scan the S/N code on the package, and you're ready to deliver
- Ultra-Fast True Wi-Fi 6 Speeds: Designed with the latest wireless Wi-Fi 6 technology featuring 1024-QAM, HE60 and Long OFDM Symbol, the EAP650 boosts dual-band Wi-Fi speeds up to 2976 Mbps
- Ultra-Slim Design: Compact design ensures simple installation while saving space. The elegant appearance makes EAP650 blend into any modern office, hotel, classroom, or cafe
- Integrated into Omada SDN: Omada Software Defined Networking (SDN) platform integrates network devices including access points, switches and gateways with multiple control options offered - Omada Hardware controller, Software Controller or Cloud-based controller. Standalone mode also supported
- Cloud Access Omada Compatibility: Remote Cloud access and Omada app enables centralized cloud management of the whole network from different sites, all controlled from a single interface anywhere, anytime
Typical symptoms
- A game reports a strict, moderate or otherwise restricted NAT type.
- Port forwarding appears correctly configured but an internet-hosted service is unreachable.
- UPnP opens ports inconsistently or fails.
- Devices on opposite routers cannot find one another for printing, casting or file sharing.
- A remote-access service works inside the house but not from cellular data or another outside network.
- The added router’s Internet/WAN address is private rather than public.
Check your topology before changing settings
Write down the physical path from the internet to your devices. In the common problem layout, a coax, fiber or DSL line enters an ISP modem/router combo; an Ethernet cable runs from a gateway LAN port to the added router’s WAN/Internet port; clients then connect to the added router. That is a router behind a router.
- Find the ISP gateway—the device supplied by, or required by, your internet provider.
- Find the added router and note whether the cable from the gateway enters its WAN/Internet port or a LAN port.
- Log in to the added router and open its Internet, WAN or connection-status page.
- Record the WAN address shown there. If it is a private address, the added router is behind another NAT layer. Ubiquiti also treats a non-public WAN as consistent with double NAT or carrier-grade NAT (CGNAT).
A private WAN address does not by itself prove that the ISP gateway is the only cause. Your provider may place customers behind CGNAT upstream, where the provider—not your home gateway—shares a public address. That distinction becomes important after you apply a local fix.
Choose the right fix: Bridge mode or AP mode
| Question | Bridge mode on ISP gateway | AP mode on added router |
|---|---|---|
| Which device performs NAT? | The added router | The ISP gateway |
| Which device normally provides DHCP and firewall functions? | The added router | The ISP gateway |
| Where is port forwarding configured? | On the added router | On the ISP gateway |
| Does the added router receive the public WAN address? | It should, unless the ISP uses CGNAT | No; it operates as an access point behind the gateway |
| Does the ISP have to support the mode? | Yes | No, although the second router must support AP mode |
| What happens to advanced features? | The added router can normally remain in router mode; bridge limitations on a primary mesh system may disable some controls | Routing-dependent features on the added router may disappear |
Use bridge mode when the ISP allows it and you want the added router to control the home network. Use AP mode when the gateway cannot be bridged, when the ISP requires the gateway to remain the router, or when you prefer to keep the provider’s routing and firewall functions.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- FREE Omada Essential Platform Centralized Remote Management: Unlock numerous advanced features by integrating with Omada Cloud Management Platform, such as network monitoring, remote network configuration, AI features, ZTP (Zero Touch Provisioning) etc. More possibilities you can find with your network management
- Dual-Band 4-Stream Wi-Fi 7: Up to 5.0 Gbps, 4324 Mbps on 5 GHz + 688 Mbps on 2.4 GHz. Powered by Wi-Fi 7 technology, enjoy faster speeds with Multi-Link Operation, increased reliability with Multi-RUs, and 120% more data capacity with 4K-QAM, delivering enhanced performance for all your devices
- Future Proof 2.5G Port: Equipped with a 2.5 Gigabit Ethernet port to support high-speed networking and future broadband upgrades-no hardware replacement required when switching to multi-gig internet plans
- Abundant Networking Features Available to Develop: Network monitoring, VLAN segmenting, Bandwidth management, Schedule Setup, Security features, PPSK all seated and right there waiting to be developed for you
- Premium WiFi Experience: Seamless roaming, Mesh, Airtime fairness and other business level wifi experience features are provided here
Fix 1: Put the ISP gateway in Bridge mode
Bridge mode turns off the gateway’s routing/NAT function and passes the provider connection through to the added router. Google recommends this arrangement when a customer wants to use a second router as the sole router.
Step 1: Prepare for the change
- Have the ISP account credentials or support contact available. Some providers enable bridge mode only through their customer portal or support desk.
- Expect the gateway’s own Wi-Fi and router controls to stop working or become unavailable. Arrange your wireless networks on the added router first if possible.
- Note any settings you will need to recreate, such as Wi-Fi names, passwords or device reservations.
Step 2: Enable Bridge mode on the gateway
- Connect a computer or phone to the ISP gateway and open its administration interface.
- Look under Internet, WAN, Advanced networking, Operation mode or a similarly named section for Bridge mode.
- Enable Bridge mode and apply the change. The exact menu and terminology vary by gateway model and ISP; if the option is absent, ask the ISP whether they support bridge mode for that device and service.
- Wait for the gateway to restart or for its status to show that it is bridged.
Step 3: Connect and configure the added router
- Run Ethernet from the bridged gateway port specified by the ISP to the added router’s WAN/Internet port.
- Restart the added router, then open its Internet/WAN status page.
- Set the WAN connection type required by the ISP, such as automatic addressing or another provider-specified method. Do not guess credentials or VLAN settings; obtain them from the ISP if the router does not connect.
- Confirm that the added router now receives the public WAN address, unless the ISP uses CGNAT.
- Let the added router provide DHCP, NAT, firewall protection and the home Wi-Fi network.
Bridge-mode trade-offs
Bridge mode gives one device clear ownership of routing and port forwarding, but it can remove gateway features. If the gateway is also a mesh or managed Wi-Fi system, bridging the primary mesh device can disable family controls, priority-device settings, guest Wi-Fi and other security functions, as Google warns. Recreate any required feature on the added router only if that router supports it.
Fix 2: Put the added router in Access Point mode
AP mode converts the second router into a wired access point. ASUS describes AP mode as extending an existing router over Ethernet; NETGEAR and TP-Link likewise describe it as avoiding a second routing layer. The ISP gateway remains responsible for NAT, DHCP, firewalling and port forwarding.
Rank #3
- Superior Speeds with MU-MIMO: Outfitted with the latest 802.11ac Wave 2 MU-MIMO technology, the TL-WA1201 easily delivers dual-band Wi-Fi speeds of up to 1200 Mbps to multiple devices at the same time
- Multi-Mode 4 in 1: Supports Client, Multi-SSID, Range Extender, and AP operation modes to enable various wireless applications to give users a more dynamic and comprehensive experience when using your AP
- PoE for Easy Installation: TL-WA1201 supports Passive PoE power supplies, can be powered by the provided PoE adapter, making deployment effortless and flexible
- Boosted Wi-Fi Coverage: Four external antennas equipped with Beamforming technology concentrate Wi-Fi signals towards your devices to extend reliable Wi-Fi to every corner of your home or office, even over long distances
- Gigabit Ethernet Port: Features a Gigabit Ethernet port that provides high-speed wired connectivity for devices requiring stable and fast network connections
Step 1: Confirm AP-mode support
- Connect to the added router’s administration page.
- Open the menu named Operation Mode, Working Mode, System Mode or a similar label.
- Select Access Point, AP or Bridge/AP, then read the on-screen warning about features that will be disabled.
- Apply the mode and allow the router to reboot. If no supported AP setting exists, do not guess at hidden DHCP or NAT switches; use a dedicated access point or ask the manufacturer for the supported procedure.
Step 2: Wire it as the manufacturer specifies
Use Ethernet from a LAN port on the upstream ISP gateway to the port required by the added router’s AP instructions. Some models accept the uplink on a WAN/Internet port in AP mode, while others require a LAN port. Follow the device’s AP-mode guide rather than assuming that the same port arrangement used in router mode applies.
Free tools Windows power users keep installed
One-click scans. No signup required.
Step 3: Keep one LAN
- Allow the gateway to assign client addresses through DHCP.
- Set the AP’s Wi-Fi name and security settings. You may use the same wireless name and password as the gateway for easier roaming, or a different name while testing.
- Reconnect clients and verify that they receive addresses from the upstream gateway.
- Confirm that the AP no longer shows a separate routed WAN network and that devices connected to either unit can reach one another.
What AP mode removes
Because the second device is no longer routing, features that depend on its WAN, NAT or DHCP engine may disappear. Depending on the model, that can include router-level VPN functions, parental controls, guest-network isolation, traffic-priority tools, device reservations and certain mesh controls. The gateway owns those functions in AP mode. Check the added router’s mode warning before switching if you rely on one of them.
Where port forwarding belongs after the fix
Forward ports on the device that owns the public IP and performs NAT.
Rank #4
- Free Omada Essentials Cloud Management: Free cloud management with no additional fees, everything is managed in the cloud without the need for hardware or software controllers. Simply launch the Omada app, scan the S/N code on the package, and you're ready to deliver
- Ultra-Fast True Wi-Fi 6 Speeds For Your Business: Designed with the latest wireless Wi-Fi 6 technology featuring 1024-QAM and Long OFDM Symbol, the EAP610 boosts dual-band Wi-Fi speeds up to 1800 Mbps. With 4 Spatial streams, multi-user throughput is incredibly increased to drive more applications
- Ultra-Slim Design: Compact design ensures simple installation while saving space. The elegant appearance makes EAP610 V2 blend seamlessly into any modern office, hotel, classroom, or cafe
- Integrated into Omada SDN: Omada Software Defined Networking (SDN) platform integrates network devices including access points, switches and gateways with multiple control options offered - Omada Hardware controller, Software Controller or Cloud-based controller. Standalone mode also applies
- Cloud Access Omada Compatibility: Remote Cloud access and the Omada app enable centralized management of your entire network across multiple sites. Control everything from a single interface, anywhere and anytime. Please verify device compatibility with SDN firmware in the product documentation or manufacturer's technical specifications
- After bridge mode: configure the forwarding rule on the added router. It is now the router facing the internet.
- After AP mode: configure the rule on the ISP gateway. The AP is no longer routing, so a forwarding rule there cannot direct inbound traffic.
TP-Link describes port forwarding as useful for games, remote access and services hosted at home. Use the service’s required external and internal ports, select the correct internal device, and give that device a stable address using the gateway’s supported reservation feature. Test from outside your home network; a test made from the same LAN may be handled differently and does not prove internet reachability.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Retest the problem that led you here
Do not stop when the router status page looks normal. Test the actual failure in a controlled order:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Disconnect and reconnect a client so it obtains a fresh address.
- Check that the client can browse the internet.
- Try local discovery, such as printing or finding another device, from clients connected to both the gateway and the added AP/router.
- Run the game or application that reported a restricted NAT type.
- Test UPnP if you use it, then test any port-forwarded service from an external connection.
- Check the added router’s WAN status again in bridge mode, or check that the gateway is the address-assignment authority in AP mode.
Google’s guidance specifically identifies gaming, IP-address assignments, port forwarding and UPnP as areas where double NAT can surface. A successful web page load alone is therefore not a complete test.
Best Value
- Four stream 802.11AC Wave2 technology
- Supports 200+ concurrent users
- 802.3af PoE compatibility
- Optional covers (sold separately) allow the Unifi nanohd AP TO discreetyly blend into its setting
If the WAN address is still private
Bridge mode still shows a private address
If the added router is correctly connected to a bridged gateway but its WAN remains private, the ISP may be using CGNAT or another upstream NAT layer. Ubiquiti notes that a gateway without a public IP can indicate double NAT or CGNAT. Contact the ISP and ask whether the service uses CGNAT and whether a public IPv4 address or another supported inbound-access option is available.
AP mode has a private address by design
In AP mode, the second device is expected to sit behind the gateway and does not own a public WAN. That is not a remaining double-NAT fault because the AP is no longer translating or routing. Inspect the gateway’s own internet status when you need to determine whether the ISP connection is public.
The second router still behaves like a router
- Confirm that the mode change was saved and that the device rebooted.
- Check that the cable and port match the manufacturer’s AP instructions.
- Verify that clients are receiving addresses from the gateway rather than a second DHCP server.
- Remove any unsupported manual DHCP/NAT changes and re-enable the vendor’s AP mode.
Can both routers stay in the house?
Yes. Fixing double NAT does not require removing the second piece of hardware. You can keep both devices physically installed while assigning one clear role:
- In bridge mode, the ISP box acts as the modem or network handoff and the added router performs routing.
- In AP mode, the ISP box performs routing and the added device provides additional wired or wireless coverage.
What you should avoid is leaving both devices in ordinary router mode on the same home connection unless you have a deliberate, separately routed design and understand the forwarding and isolation consequences. For a normal household network, one NAT/routing layer is the reliable target.
Common mistakes to avoid
- Putting the added router in AP mode but forwarding ports on it: forwarding belongs on the gateway once the added device is an AP.
- Bridging the gateway without planning Wi-Fi: the gateway’s wireless controls may stop operating, so configure the added router before reconnecting clients.
- Assuming a private WAN always means local double NAT: CGNAT can remain after a correct bridge-mode setup.
- Disabling DHCP by trial and error: use the router’s supported AP mode instead of undocumented combinations that can create address conflicts.
- Expecting an Ethernet switch to fix NAT: a switch adds ports but does not disable either device’s routing function.
- Testing only from inside the home: remote-access and forwarding rules need an external test.
The practical decision
Choose Bridge mode when the ISP supports it and you want the added router to be the single, full-featured router. Choose AP mode when the gateway must remain in charge or cannot be bridged and your priority is extending coverage without another routed network. In either case, verify who owns NAT, DHCP, firewalling and the public IP before configuring port forwarding or troubleshooting an application.
NETGEAR’s support guidance was last updated July 7, 2025, and TP-Link published a bridge-mode explainer July 8, 2026; labels and supported features can still differ by model and firmware. Treat the mode names and wiring shown in your device’s current instructions as authoritative.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
