🛒
This post helps you deal with the situation where you want to improve your home Wi-Fi network yet can't (or don't want to) get rid of your ISP-provided gateway (or any existing router.)
Router vs. gateway
A gateway is a hardware box containing a Wi-Fi router and a built-in Internet terminal device—a Cable modem or a Fiber-optic ONT. So, a gateway encompasses and is, first and foremost, a router.
It's a question of Single NAT vs. Double NAT.
If those "NAT" terms seem scary or strange, you're reading the right post. You'll know how to handle them as comfortably as the next guy when you're through. And there's a chance you won't have to deal with them at all.
Before going further, make sure you're comfortable handling a home Wi-Fi router and, most importantly, have mastered the differences between common home networking devices (modem, ONT, router, gateway, etc.)
Done? Let's dive in!
Dong's note: I first published this piece on December 30, 2018, and last updated it on November 16, 2022, with additional relevant information.
Each of the two creates a single NAT (standard) network by itself. If you connect the router's WAN port to one of the four LAN ports of the gateway, you now have a double NAT setup by default.
Double NAT is when you use a router on top of—or behind—another router.
How to best deal with that ISP-provided gateway, or an existing router, you can’t replace
Ideally, you should use just one router for your home network. The standard way to have any local network is to connect your router to the Internet terminal device—generally a Cable modem or a Fiber-optic ONT.
In this popular case, you have a single NAT configuration, which is generally implied—there's no need to even mention "NAT". But since we'll have to deal with double NAT later, let's find out what NAT is.
What is NAT?
NAT stands for network address translation and is one of the major functions that define a router.
There's one set of private IP addresses, and the router connects to the Internet directly. The Internet terminal device (modem or ONT) receives and passes the Internet WAN IP address to the router.
Single NAT
NAT allows the router to use a single WAN (public) IP address (provided by the broadband provider) to deliver Internet access to many connected devices by creating a separate sub-set of local (private) IP addresses.
NAT is necessary because to connect, each device needs an IP address for itself, and generally, an entire home gets only one single IP (the public IP) from the provider. So in a way, NAT is a method that "splits" one IP address into many.
A simple analogy:
You can think of a router's NAT function as the mailroom of a big condo building.
It handles packages between the building and the outside world, allowing those in different apartments to share the same shipping address yet be able to send/receive personal mail and packages.
In this case, the building is your local network, its mailing address is your WAN IP address, each home within the building is a local device, and the apt number is the device's local IP address.
Each router has a NAT function. So when you use one router or a gateway, your local network has a single NAT setup. In this case, the "NAT" notion is implied—there's no need to even mention it.
Double NAT
But sometimes, you have to use more than one router in a network, such as when you have to keep that ISP-provided gateway—which is essentially a router—and yet want to expand or upgrade your system.
In the diagram above, you put a router (or the router unit of a mesh system) on top of an existing gateway.
In this case, devices of the 1st set of private IP addresses hosted by the gateway can't talk to those of the 2nd set hosted by the router locally. The upper-NAT router (black) doesn't connect to the Internet directly—it does so via the gateway (which is the first router). Consequently, the black router doesn't have a public IP address, but only a local IP address was given out by the gateway.
No matter what your reason, when you use a router on top of another, you get a double NAT situation.
Continuing the analogy above:
A double NAT is when you have a second building attached to the back of the first, which shares the same front door shipping address, yet has its own mailroom.
As you can imagine, all traffic of the 2nd building and the outside world has to go through the 1st building, and the mailing service for those in the 2nd building can be complicated—they have to deal with two mailrooms.
A double NAT setup is non-standard and can be a pain for certain networking needs. But in many cases, such as when Internet access is all you need, it'll work fine, and you might not even notice it. We'll talk more about this below.
Now that we're on the same page in single NAT vs. double NAT, let's continue with how to handle that existing router (the ISP-provided gateway) gracefully when replacing it is not an option.
The counterargument: The benefits of using an ISP-supplied gateway
While it's clear that it's best to use your equipment, there are some benefits to using a gateway provided by your Internet provider.
Here are a few examples:
- Ease of use: You don't need to do anything. The provider will set up the home network work for you and manage the hardware, including firmware updates, troubleshooting, etc.
- Less cluttering: You only have one hardware box instead of two. (A retail gateway applies, too.)
- Hassle-free hardware replacement: If the gateway dies, call the provider, and you'll get a replacement pronto—all free of charge. The provider also upgrades the equipment when needed.
- Easy management: With some providers, you can manage certain aspects of your home network, like changing the Wi-Fi password, via your online account. (That is if you're OK with the potential privacy risks.)
- Unlimited data cap: Some providers, such as Comcast Xfinity, give you half the cost ($25 vs. $50/month) of an unlimited monthly data cap when you use their gateway.
In short, using ISP-proved equipment is not all bad. For some, the benefits are enough to justify the monthly "rental" fee.
Assuming you can't replace that gateway, I'll walk you through when to use it as a single NAT (A) and when as a double NAT (B). In each case, I'll mention different scenarios with further details.
A. Making the most of an ISP-provided gateway: The Single-NAT approach
Many modern gateways have advanced networking options—a bit of customizing will give you a much better home network.
In this case, we have two main scenarios.
- In the first scenario, you're happy with the gateway's Wi-Fi coverage—you don't need additional Wi-Fi hardware.
- In the second, you're not happy with your current Wi-Fi and need or want to use additional or better Wi-Fi broadcasters.
Let's tackle these two, one at a time
A1. The single-box scenario—no extra Wi-Fi hardware is needed
If you're happy with the gateway's Wi-Fi coverage, you only need to make a few changes.
Generally, you shouldn't use the gateway with the default settings left by the ISP's technician. Further configuring it will make a much better network.
Below are three things you should do to an ISP-provided gateway.
ISP-provided gateways generally have a web user interface. You can handle them the same way you do a regular Wi-Fi router.
1. Change the default access to the gateway
All gateways come with default admin access. Anyone with that knowledge can log into its interface when being part of the network.
A Comcast Xfinity residential gateway's default password is almost always highspeed.
For security, you should change that password to something else.
To do that, log in to the gateway's web interface by pointing a browser to its IP address and log in with the default password (or access code). You can generally find this information on the side or bottom of the device.
Once you've logged in, navigate the interface to the area where you can change the password and create a new, more secure one—make sure it's different from your Wi-Fi network's password.
2. Make a meaningful Wi-Fi network (SSID)
By default, each gateway has a default Wi-Fi network, of which both the name and password are hard to remember or type in, especially when you need to do that on a small screen or via remote control.
You can give your Wi-Fi network a personalized name and a password that you can remember.
Again, you can do this via the web interface and follow these password guidelines to keep your system secure.
3. Customize the gateway’s advanced settings
This part is optional, but most gateways have a decent set of features and settings that you can use—the amount varies from device to device.
Examples include port-forwarding, Dynamic DNS, separating the 2.4GHz Wi-Fi network from the 5GHz, etc. Again, you can use the interface to customize these.
In short, just because you don't use a standard off-the-shelf router doesn't mean you can't make your network with specific advanced settings. Dig into your gateway's web interface; you might get surprised by how much you can get out of it.
A2. The multiple-hardware-box scenario: You need additional Wi-Fi hardware
This scenario applies when your gateway's Wi-Fi coverage is insufficient for the entire home.
In this case, you will need additional broadcasters to extend the coverage—you want better Wi-Fi coverage or performance while keeping your home network in a single NAT configuration.
In most cases, you only need a single Wi-Fi extender or access point. But if your place is large or demanding, a new Wi-Fi mesh system or a high-end router is in order.
1. Getting an access point
It's best to get an access point if you can run a long network cable from the gateway to scale up the network. This is my first choice since it delivers a much better performance than an extender.
There are many options for APs, and most of them work similarly. It's best to use one of the same or better Wi-Fi standards than the existing router, but any will work.
You can also turn an old router into an access point or pick one of these—check out their review for more.
You can make the AP's Wi-Fi network (SSID) with the same name and password as the existing router. In most cases, that'd give you somewhat of a mesh system. Some access points, such as those in the TP-Link Omada family, can work as a robust enterprise system when you add a controller.
However, note that there might be no seamless signal handoff between the existing gateway and the AP. That's the general case of using an AP with an existing Wi-Fi router.
2. Getting an extender
An extender can quickly extend your Wi-Fi without you having to run a network cable.
However, using extenders means you get convenience at the expense of performance. Sometimes, the performance gets so bad the convenience is not worth it. Also, be mindful of the virtual MAC address issue.
Generally, Wi-Fi 6 extenders, such as the Asus RP-AX56, work better than their Wi-Fi 5 counterparts. Still, if you have fast Internet or use real-time communication applications, such as Voice over IP or video conferencing, no extender will cut it.
In short, extenders are for situations where you don't have other options. The result varies but is never great.
3. Getting a new mesh system (or router)
Sometimes, you might want an entirely new mesh system or a more powerful router on top of the gateway. Specifically, you'll connect the new hardware's WAN port to the gateway's LAN port.
In this case, to maintain the single NAT configurations, you have to do one of two things, not both:
- Make the gateway pass the WAN IP to the new router, effectively making it work simply as a terminal device (a modem or an ONT). Or
- Put your new mesh system (or router) into AP mode.
If you have a gateway in the place of the modem, you should either put the gateway in the bridge mode or the router in the AP mode.
Gateway-to-router WAN IP passing
Depending on the gateway you use, the configuration for this varies.
With some, like cable gateways, all you need to do is put it in the Bridge mode. In this mode, a gateway is, in effect, a terminal device (cable modem or Fiber-optic ONT)—you'll get no other features or network settings from it, including Wi-Fi.
When working in the bridge mode, only one of the gateway's LAN ports is active—it's equivalent to the LAN port of a modem. In most cases, you can use any of its LAN ports to connect to the router, but in some, you must use the first one.
With others, like DSL gateways, you need to configure the IP Pass-through and map that to the local IP address of the router.
Again, the objective is to make your router take over the WAN IP, not the gateway's local (private) IP, and remove the NAT function of the gateway.
When IP Pass-through or bridge mode is unavailable, another option is to use the gateway's DMZ setting to allow the upper-level router to get unfiltered Internet access.
And that's it. You now have a home network like one built with a standard terminal device and a router.
Generally, putting the gateway in the bridge mode is the best solution—it also prevents the ISP from spying on your network.
Turning your new mesh system or router into an Access Point
Most router and Wi-Fi systems can work as an access point (AP)—you can switch the mode via the web interface. If you use a mesh system, putting the primary router in the AP mode will turn the entire system into this mode.
The only mesh systems I'm aware of that can't work in the AP mode—as a system—are the variants of the Google (Nest) Wifi. But each unit can work as an independent AP.
Some vendors, such as Linksys or Google, call this AP mode "Bridge mode". Generally, if you see a router with three roles, router, bridge, and AP, pick the AP mode. If you see only the first two, the bridge mode will likely be the AP mode.
If your new router does not have an AP mode, you can manually turn it into an AP mode by connecting it to the gateway using one of its LAN ports (and not its WAN port—leave this port alone.)
Tip:
You might want to configure the router's Wi-Fi network before turning it into an access point. It's a bit hard, though not impossible, to access its web interface afterward—you'll need to figure out its IP address via the router unit.
In the AP mode, the hardware—your new router or mesh system—only extends the network hosted by the gateway. You cannot take advantage of its other settings and features. Also, again, generally, the AP and the existing Wi-Fi router (gateway) might not enjoy seamless signal handoff.
B. Making the most of an ISP-provided gateway: The Double NAT approach
The double NAT approach is much easier in terms of the hardware setup.
All you have to do is connect the new router's WAN (Internet) port—or the primary router unit of your mesh—to a LAN port of the gateway (or the existing router).
Now configure your new router to your liking, and you're all set.
Extra note on setting up a router on top of another
A different local IP address for each router is required
This part applies when connecting the new router to the existing gateway for the first time. The two must have different local IP addresses.
This address often appears as the "Default Gateway IP," a naming convention.
It's relatively rare that you have to worry about them having the same IP—chances are they are already different by default. Many routers are smart enough to automatically change their IP (from the default) when connected to a router (or gateway) that already uses the same one.
If the two share the same IP address—which tends to happen if the new router and the existing one are from the same manufacturers—you'll note that devices connected to the new router won't have Internet. There can be other issues, too.
In any case, you can always change a router's IP using the web interface. It's in the router's interface's LAN (or DHCP) area. This IP is often 192.168.x.1 or 10.0.x.1—change x to a different digit.
Double NAT: When it works well
Generally, if all you need is a connection to the Internet, a double NAT configuration will work well, and you'll run into no issues.
Also, a double NAT setup makes the top-level NAT network—hosted by your new router—isolated (and more secure) because devices in this network are behind two layers of firewalls and NATs. They are also invisible to those connecting to the lower-level NAT.
That said, double NAT is an excellent setup if you want a particular group of devices to be isolated from another group. It's better than using Guest Wi-Fi networks.
Double NAT: When it doesn’t work (well)
The primary problem with double NAT is that devices belonging to one NAT will not communicate locally with those of the other NAT because each router has its own private set of local IP addresses shielded from the outside.
Specifically, a computer connected to the gateway can't print to a network printer connected to the new router. The two don't "see" each other. You'll also have issues with local services like data sharing, media streaming, network backup, etc.
All devices can see one another via the Internet, so using Internet-based printing or communications still works in double NAT.
Another thing is that your new router's advanced network settings, such as VPN, port-forwarding, etc., will not work as expected by default.
Pro Tips
Port-forwarding is possible in a double NAT, but it requires more work. Specifically, the forwarding entry needs to be programmed twice:
- At the first-level (lower) NAT, map the forwarded port to the IP of the router on the upper NAT.
- At the top-level (upper) NAT, map the forwarded port to the IP address of the destination device.
To access the top-level NAT router's interface over the Internet, set that up as a server port-forwarding entry at the first-level NAT.
A device of the upper-level NAT can still talk to a device belonging to the lower-level NAT if you use the latter IP address. The other way around is much harder, if possible at all.
Back to the building analogy above: A double NAT is like folks in one building can't see or hear those in the other building because they are isolated. Also, mail-forwarding from one building to another can be an issue since the first mailroom doesn't have the map of the second building.
What to do in a double NAT setup
Now that you're aware of double NAT and still want to use it, there's just one thing you need to do: make sure you know which network (which NAT, that is) you're using and connect devices accordingly.
If you want to only use the new router (the top-level NAT), then:
- Turn off Wi-Fi on the first router/gateway (you can do this via its web interface) and use only the Wi-Fi of your top-level router.
- Connect all wired devices to the top-level router (and not the gateway) for them to see one another locally.
Mission accomplished.
Alternatively, you can use both networks for security or isolation purposes. For example, you can keep the gateway's Wi-Fi network as a Guest network. In this case, ensure it has a different Wi-Fi name (SSID) from the one you use for yourself.
If using a double NAT proves too much trouble—as it can be for many homes—you should opt for the traditional single NAT route.
The takeaway
No matter your Internet situation, you can still customize your home network to your liking. It just takes a bit of work.
In my experience, having to keep the ISP-provided gateway is the most popular situation, and therefore, double NAT is also commonplace.
Keep that in mind the next time you troubleshoot your home or office network.
Thank you, Dong, for taking the time to help “us” learn (to some extent) how to do some complex network stuff. Your clear & concise posts have been invaluable to me.
👍
Hello, thanks for the great explanation and the amazing job you are doing!
However, I have a question:
Currently I am using only my ISP provider ONT (Nokia) which isn’t that good.
I want to add a 2nd router (Double NAT) after theirs.
It will be ROG Rapture GT-AX6000 which has 2 2.5G ports.
Since my Fiber speed is 2Gbps, and the Nokia ONT (Router) does not have bridge, it will be used as a switch. The Nokia does have one 2.5G WAN and one 2.5G LAN. If i use a LAN cable from 2.5G LAN port on the NOKIA and add it to the 2.5G WAN port on my GT-AX6000 will I lose some significant amount of speed and will I be able to use the 2.5G LAN port on my router for connecting to my PC for maximum speed?
Thank you!
If you turn off all traffic-related features (firewall, QoS, bandwidth monitoring, web filtering, etc.) on the Nokia gateway, you should get the full speed out of its 2.5Gbps LAN port. It’s best to see if you can get just the ONT from the provider, though. Good luck!
Thank you, Dong, unfortunately I can’t use just the ONT because it is connected to 3 IPTV boxes which have some configurations related to the NOKIA router.
I think I will be good, since I do not need the full 2Gpbs anyway, just didn’t want to lose half of it.
Time to cut the cords. Move to streaming TV, like YouTube TV, instead. But you’re set for now, especially with that reasonable attitude. You won’t loose much bandwidth, if any at all.
Thank you, have a great day/night and yes, my next home tv will definitely be streaming tv.
👍
I am presently renting the following from Comcast Business Class, for use in my home-based business/airbnb in which ensuring my guests aren’t able to hack into my private network is of the utmost priority:
1) Two Arista ap-c200’s (which make up Comcast’s “WiFi Pro” managed wifi set-up. Here are the instructions for setting them up correctly, but they are a bit too confusing for me
2) CGA4131COM Business Internet Gateway (CBR-T 8-port Modem/Router)
I own a:
3) Netgear AC1900 WiFi Mesh Extender Model: EX6400v3, NETGEAR Nighthawk Tri-band Whole Home Mesh WiFi 6 System (MK83) – AX3600 Router with 2 Satellite Extenders
My main reason for upgrading to a mesh system is because I am paying $200/month for a 1000 mbps plan, but am only getting around 25 mbps in my guest suite and I need my network to cover the entire property which is roughly 6000 sq ft on 2 different levels.
My questions are:
1. Are these devices compatible with each other and if so, how should I set them up? (i.e., what plugs into what)
2. Once connected, will they create the desired outcome of consistent high-speed wifi throughout the property in which my private network is bulletproof and not accessible by or through the managed guest wifi?
Sorry if these are dumb/rookie questions. I greatly appreciate your input and feedback!
To answer your questions, Shayla:
1. No.
2. Only you would know what the “desired outcome” is.
I’d recommend starting with this post on networking basics:
https://dongknows.com/home-wi-fi-network-explained-getting-the-basics/
And then this one on how to set up a mesh system:
https://dongknows.com/mesh-network-setup-tips-and-diagrams/
If you don’t have time to read to get things done yourself, hire a local professional. Good luck!
Thanks for the prompt response, Dong. To clarify, there is no way to use the managed wifi pro system offered via the Arista devices from Comcast Business Class with a mesh system. Is that correct? Is this true regardless of a whether I use a single NAT set up (with my gateway in bridge mode) vs a double NAT set up (using both my gateway’s internal router in addition to my own mesh router?)
Again, I apologize if I’m being redundant here. You seem to be somewhat of a Simon Cowell of networking, so I am doing my best to not upset you. Forgive me if I am failing in that attempt.
That’s not correct. Things works, at least to an extent, if you know how to use them. There are many variables and possibilities. You’re looking for absolute/easy answers without spending time knowing your hardware. It’s impossible for anyone to give you quick pointers since nobody knows what you already know. If you want to help yourself, you’ll have to spend time and read. For example, more on access points in this post.
Hi Dong,
Thank you for the informative post. In a Double NAT Guest Network scenario, how would I go about setting the the new router to use a different DNS than my existing router (that’s connected to the internet)?
Thank you
The same way you change the DNS of any router, James.
Hi Dong,
Apologize for the really stupid question. But I currently have my ISP provided XB7 Gateway set in bridge mode, it is connected to my asus router. When I log into the ISP XB7 gateway the WAN IP is different than the WAN IP on my asus router. Is the bridge mode working as intended? I thought the WAN IP should be the same on both since it is passed onto the router.
Then you’re not your gateway in the real bridge mode.
Thank you for your insightful article. I had to request my ISP to configure their router in bridge mode because the standard user settings didn’t grant access to that feature. After they made the changes, my mesh network was unable to connect to the internet. I even attempted to clone the MAC address, but it didn’t work. Surprisingly, once I switched my mesh connection from ISP router LAN port 3 to port 1, I finally had internet access. I’m not sure if this specific issue might be limited to Huawei routers.
That’s generally the case, Moe. As mentioned, if you use the ISP gateway in bridge mode, you can use only one of its LAN ports and in some cases the first port is the working one.
Hi Dong,
I use a smartphone Huawei p40 pro plugged to my Asus mesh system RT-AX92U’s USB port to provide internet at home. I wanted to access remotely my router and the attached storage plugged to the other USB ports of the routers but ddns or whatever else is not usable due to double nat (cgnat) and private IP assigned to the smartphone,which in turn can’t provide a public IP to the Asus router. Do I have any chances to achieve my goal by using port forwarding &/or DMZ or by plugging the smartphone to an additional router like,for example, one of those GL.iNet’s routers via USB and from such router’s LAN port to the Asus’ LAN port in some bridge mode fashion?I mean,would the GL.iNet translate the smartphone’s IP into a public IP and then assign it to the Asus’ one?So that I would then be able to use ddns to remotely access the asus and NAS attached devices I mentioned? on a side note, I change sim card of the smartphone monthly and even if the Mobile operator could provide me a public IP I couldn’t just do this every month..am I doomed?Thank you for any pointer..Max
You prolly won’t be able to do that with DDNS, Max. More here.
But you can access the router remotely using the Asus mobile app — go to Settings and bind it to an account.
on my Asus router I can see this message under ddns and other menu:
“The wireless router currently uses a private WAN IP address.
This router may be in the multiple-NAT environment and DDNS service cannot work in this environment.”
Neither works the asus “Instant Guard” app. Do you think that plugging the smartphone to an Gl.inet modem would then allow me to have a public IP from the Gl.inet modem which I the could bridge through the Asus router?Do you have any suggestion?I’m running out of ideas..
Like I said. You won’t be able to go the DDNS route. Asking the same question in different ways won’t get you a new answer. 🙂
I mentioned about ddns in my previous reply to inform you in relation to the Asus app you were suggesting,since it wasn’t working due to the same issue. Surely I don’t grasp the whole thing as you do. I found this service,I’ll contact them to ask if that might work in my scenario. {..}
Anyway,thanks for your pointer.
The app should work, Max. And the service you mentioned likely won’t work, either. No spamming, please.
Dong, Great Article and very informative. I am adding a TPLink mesh to my isp’s gateway. Planning on double nat ap’s since that is my current setup with a TPLink stand alone router. I will have 1 router satellite, 1 wired backhaul and 1 wireless backhaul (3 total). Will the lan ports out of the wired satellite be top level or 2nd level? How will the visibility be? How about the wireless sat?
Thanks!
Give this post a serious read, John, and also this one. After that, rephrease your question. Take your time! As is, I’m a bit lost in trying to understand you.
I read the full article, but not all the comments, so I apologize if this has been asked and answered…
Can’t you get the lower tier subnet to communicate with the higher tier with a static route?
Generally, David, by default, only a device of the upper NAT (A) can initiate the connection with a device the lower-NAT (B) by calling B’s IP address (not its name.) The other way around is not possible.
However, with specifical setting and configurations, not necessarily available in home routers, you can make devices of all and any subnets communicate with one another. But that’s the realm of advanced/enterprise networking.
Finally–it’s refreshing to read something positive about being “double NATed”, and that it can work just fine! So many articles won’t explain both sides of the single vs. double NAT issue–they say don’t go there (double NAT) and strongly advise putting the ISP gateway in Bridge Mode–period.
I’ve been using the double NAT scenario for almost two years with absolutely no issues! {…}.
Thanks for detailing both sides of the NAT issues–well done.
Sure, Edward. And just a reminder, you’re at a no-nonsense website. Thanks for sharing the experience, but I removed the spam-like portion of your comment that violated the rules. You probably didn’t include that intentionally. Still, please note the rules next time. 🙂
Great article. Just updated my home network to use 5G Broadband router which provides internet access for my existing ASUS Wi-Fi router. However, Xbox complains of double NAT. On the broadband router, there are 2 cellular WAN – both set as routing and both have NAT enabled. The ethernet WAN connection of the broadband router is set to bridge mode with no NAT and connects to ASUS WAN ethernet that DOES have NAT enabled. Can I just disable NAT on the ASUS WAN ethernet connection to eliminate the double NAT issue? Are there any issues in doing this – will it work? Many thanks.
You can try, Mark but it’s best to use the Asus in the AP mode as mentioned.
Hi Dong, Great article as always! I just got the Verizon 5G Home Internet Gateway which I would like to make it function as close as possible to a modem. The Gateway does not have a true Bridge Mode, but it has the DMZ Host and IP Passthrough settings which I have successfully used with my Asus RT-AC68U personal router. I would like to have a single NAT using my Asus in Router mode, rather than Access Point mode. As such, I have heard that if I turn off the DHCP server on the Gateway along with setting the Asus WAN Connection Type as Static IP, I will get more performance (higher download speed) from the Asus Router. I assume it is because only a single DHCP server being on belonging to the Asus Router. But how do I get a Static IP from the Verizon Gateway when its DHCP server is off? Can the Asus Static IP setting be the Verizon Public WAN IP along with its Subnet Mask and Default Gateway? Would I be able to log into the Gateway WebGUI afterwards? Do I need to set up DDNS? Please advise. Thanks in Advance.
That depends on the gateway, Alex. I don’t have one so I can’t say anything for sure.
May I send you mine for testing? I also live in Bay Area…
Thanks for the offer, Alex, but there’s nothing to test on this front. It’s just a matter of configuration. I generally don’t do tech support or private consultation via this site, and you probably won’t like my offline rate for the Bay Area.
Here’s a push in the right direction: try to figure out how to turn the gateway into the bridge mode from its default router mode. Give this post another good read! Good luck! 🙂
I don’t think this can work because when your Wan IP changes because is isn’t truly static, it won’t be passed to your router without DHCP being enabled, you’ll end up a broken connection.
You would need a static WAN ip from ISP in my opinion for pass through without DHCP on gateway to work.
For what it’s worth, I tested speeds with the DHCP Service turned off after already still having an assigned IP and there was literally no performance difference. I don’t think dhcp service with virtually no clients connecting to your gateway has any resource hit on a home network.
Thank you so much for this article, I learned a bunch! Chained a bunch of articles together, great cross-referencing!
Question: when adding mesh routers ( say Asus XT8) to an ISP gateway and when not able to put the ISP gateway into bridge mode, but we still want to access the top-level mesh routers VPN functionality. Will that work when using the gateway’s DMZ address setting and set that to the primary mesh routers IP address?
No, Rob. For that, you have to do double port forwarding, as mentioned. More about port forwarding in this post.
Brilliant idea to use the upstream as guest wifi. Instant isolation and no fiddling around with settings. Over the years I’ve wasted a lot of time configuring guest on openwrt and the likes. I’ve finally figured out to use a separate 20Eur router to take the guest traffic (with isolation)
Yeap, David, I mentioned that in the post on Guest networking, too. You can use an old router for that purpose.
Hi Dong, thank you for this article. I have a question- What are the pros and cons of keeping a Double NAT vs setting up router in AP mode?
My ISP doesn’t allow me to put the gateway in bridge mode, but the wifi of the ISP device is terrible. I’d like to set up a new Wifi 6 router. AP mode seems like the way to go but it doesn’t seem like Double NAT is a big deal (I’m not going to be doing any advanved port forwarding configurations).
I mentioned that in the post. This part. You should read the whole thing. Please do that before asking any more questions. 🙂
I just switched from Charter to Frontier fiber and I have been hosting my own web server since 2005 and was always able to access my websites until now. Since the switch to fiber, all of my websites time out. But if I check isitdown or pingdom, they say my sites are up. So a friend was also able to load my sites. It’s just me that can no longer see them. This makes it impossible for me to test changes and updates to my sites.
I tried connecting my router directly to Frontier’s ONT, but I still can’t see my server’s sites. IIS on my server can’t even do Localhost to view the sites. There is simply no way to work with this. I love the 100X faster upstream, but this problem makes it a pyrrolic victory.
There must be a simple way to make it so I can view my websites so I can maintain them without having to maintain two separate internet services just for that purpose.
When you’re within your local network (at home), Use the local IP address of your webserver, instead of your domain, MA.
Great article Dong,
You said
“You want to configure the router’s Wi-Fi network before turning it into an access point. It’s a bit hard, though not impossible, to access its web interface afterward.”
I cannot find a way to access my Netgear C6300BD after putting into Bridge Mode (by turning off NAT). It works as expected, but I would really like to know how I could talk to its web pages without doing a hardware reset.
Try routerlogin.net, Roger. If that doesn’t work, you need to find its IP address via the interface of the current router as mentioned in this post about IP addresses.
So I have a ont, isp modem + wifi (nokia with wifi disabled) and then an asus mesh in a double nat setup.
The ont is connected to the isp modem with a T1550 cable (fiber optic ). Then isp modem connected to asus mesh via ethernet.
Is there a adapter or a cable that would allow T1550 to connect to an ethernet port. Then I could get rid of isp modem.
Start with this post, Moe. Please don’t leave any more comments before you have really read that post in its entirety.
That’s a gateway that you have, not a modem, Moe. You need to turn it into the bridge mode as mentioned.
Hi Dong
I have VZ FIOs and did the double NAT for a few months. We had only two practical issues which caused me to rethink my setup. It was very simple, the VZ FIOs router was set normally. Then I attached a Netgear R8500 normally (not AP mode) with the VZ ethernet port connecting to the R8500 WAN port.
When surfing the net (all browsers) 25% of the time the page would not load and I would have to refresh. Annoying but once loaded it worked fine.
The second one was that certain secure pages (login/PW) just would not work at all.
So being unable to troubleshoot these, I hardwired a FIOs extender and turned on the guest network and went back to single NAT.
To be sure the double NAT was a much better setup since VZ FIOs does not do the guest network on 5G but only on 2.4g which is much slower. If there is a way to troubleshoot those connect issues I would try again.
That seems to be something wrong with the R85000’s settings, Daniel. Maybe its time and date were wrong. Fix that and try testing it, updating its firmware etc.
Would there be any speed difference / ping difference between a double nat setup
Vs isp modem in bridge with mesh
Supposedly yes, but very minor, Moe. Using a separate modem or the gateway in bridge mode is generally better for latency. Note that a modem is DIFFERENT from a gateway. Make sure you read.
Dear Dong
So if I put the isp gateway in bridge mode, in which device do I need to add the pppoe information – isp gateway or mesh system?
The router unit (of your mesh system). The settings should be provided by your ISP. Consider your gateway as a modem.
Thanks
Nice article, thanks for all the useful information. I have a mesh router on top/behind my ISP’s router. I do have some devices hard wired to the ISP’s router, using that address space (“set 1”). Other devices are using the wireless mesh router’s address space (“set 2”). I understood your article to say that devices in one address space would not be able to talk to devices in the other address spaces. I am not finding that to be the case. Ex. a PC in set 1 is able to print to a printer in set 2. I expected this to work, and it does, as that is the job of a router. I may have misunderstood your description in this article? Thanks again.
Generally, Rob, no they can’t see each other LOCALLY, but they can via the Internet — just like you and I are communicating right now. So if you do internet-based printing, that’s possible. Also, the top-level NAT can access the lower one when you use the local IP addresses, instead of device names. Also, your mesh router might be working in AP mode. Nothing is black and white. Give the post another series read.
Really informative article!
1. When you set up an ISP router/gateway in “Bridge mode”, does that mean your new Router (which could be a Mesh router) – connected by ethernet – manages the whole home network even if devices are connected to the original gateway?
2. Is the following setup possible?
Internet > ISP gateway (Bridge mode) with Wifi turned off > Mesh system (Brand A) in Bridge mode with Wifi turned on > Router (Brand B) in router mode with Wifi turned on
As in does the “main Router” have to be the device either plugged in to your ONT, or ISP gateway, or can it be later on in the chain?
3. Do Mesh systems in general work better in Access Point mode rather than in Router mode in terms of stability and speed?
Thanks in advance!
1. That’s correct, Brill. The gateway is now just a modem.
2. In the bridge mode, Wi-Fi is turned off by default, you can’t use anything else of the hardware. For a gateway, it’s now a modem. For a router, it’s now a wireless-to-wired adapter. So your question is a moot point. But you can use either Brand A or Brand B router in the access point mode as mentioned in this post. Make sure you read this section well and pay attention — open the button — since the use of “bridge” and “access point” can be arbitrary. You need to know what it entails in a particular case.
3. Router mode is always the best. Again, read the link above.
Hi Dong, yes I read that section. Sorry I made a typo earlier. Let me try the question again:
Is this setup possible? (With the “>” representing an ethernet connection)
Internet (ONT) > Gateway (Bridge mode) > Mesh System Node 1 (Brand A) in Access Point mode, Wifi On > Node 2 of Mesh system (Brand A) > Router/Mesh system (Brand B) in Router mode
I get that you can have the Gateway in router mode, or something connected to the Gateway (single router, or mesh system) in router mode and place the gateway in bridge mode. I’m just wondering if it’s possible to put a Mesh system (in Access point mode) in BETWEEN the two if that makes sense.
No, you can’t, Brill, since an access point must be on top of a router — it can’t work by itself. A router must be at the bottom of a network, if you know what I mean. More in this post. So swap the positions of A and B.
We just changed ISP from 200 Mbps cable to 1 Gbps fiber. Our new ISP provides a free modem/wired router (a DZS ZNID-GPON-2424) which we have to use, that is in bridge mode. Our Netgear r6400 wi-fi router connects to this. The tech that installed everything pointed out that we are getting 956 Mbps down and 948 Mbps up through their router/modem but only 621 Mbps down (936 Mbps up) connected to a LAN port on the r6400. He said we need a newer router. Any thoughts on what we should get? He said something with faster NAT IP to IP routing speed, but I don’t see that spec anywhere.
You need one of these Multi-Gig routers, Maike, at least one with a Multi-Gig WAN.
Many thanks for the advice. I now have a Netgear RAX200 and everything is working perfectly. Actually I tried the RAX120 first but ran into a weird problem. The RAX120 worked great for every device we have except for the 2019 16″ MacBook Pro, which is my main computer. It worked fine in Mac OS but I do quite a bit of work in Windows 10 (using Boot Camp) and I was only getting around 90 Mbps download (upload was fine). I tried all the various settings in the RAX120 configuration (fortunately not many) without any improvement. I think there may be some sort of incompatibility between the Boot Camp Windows 10 Broadcom wi-fi driver and the RAX120’s Qualcomm chip set. I got exactly the same problem connecting to our daughter’s Eero 6 Pro, which also uses a Qualcomm chip set.
Anyway, I exchanged the RAX120 for the RAX200, which has a Broadcom chip set, and now everything is working great.
Good to know, Maike. Yeap, Qualcomm seems to have been buggier. Thanks for the update.
Hi,
Great article. I feel like the answer is in this article but I am missing it. I am not that tech savvy. I had a USB memory stick connected into USB port in ISP provided modem/router. I was using as a NAS to share files and record. It has worked great for last 2 years. I recently upgraded to Netgear Mesh RBK13 (no usb ports). I am not able to access my files or recordings as I disabled ISP modem/router IP to allow for true mesh. How can I access my USB on my ISP modem/router?
You can’t, Daniel. Or get a new router for that.
Would getting an inexpensive router with USB work? Plug in USB and use the IP of that router just for accessing storage. Allowing me to keep my Mesh.
Read the post I linked, Daniel.
Wow, what a resource this website is! Thank you all for this great guide! I had one question as it related to a double NAT system: In the following section you state: “Now that you’re aware of double NAT and still want to use it, there’s just one thing you need to do: Turn off Wi-Fi on the first router/gateway (you can do this via its web interface) and use only the Wi-Fi of your top-level router.”
I am attempting to set up two isolated networks for the security benefits you mention of two firewalls. I was planning on putting the smart tv, playstation etc on the gateway network (router #1), and my personal phone, desktop NAT etc on the downstream router #2. I understand that my trusted phone on router network #2 will not be able to cast or communicate with the tv on router network #1. However, if I had an old phone that I isolated to network #1, theoretically I could use this device to cast and communicate with the smart tv, without giving it access to network/router #2. However, I believe to do this I would need wifi enabled on network #1 in addition to my trusted network #2 (I would still like to use wifi for trusted devices on network/router#2). If these were named differently and had different passwords would this be possible?
Essentially, I see you state to only have 1 trusted (non-guest) wifi access on a single router in a two router setup. I’m curious if this is for ease of use and avoid accidentally connecting to both, or if there is a fundamental issue with having two wifi signals from two different routers in the house. Thank you!
That’s correct, Kyle. It basically means you use the lower NAT as your guest network. More in this post. My recommendation in turning off the lower NAT’s Wi-Fi so that folks don’t accidentally use both and run into trouble. If you’re aware of which is which, you’re in a good spot.
Thank you for the Reply Dong,
The shared link was helpful in understanding that security measures for low value targets like IOT devices mentioned can be more trouble than it’s worth. My limited understanding of how security risks manifest in the network however was that IOT devices on your local network are more easily breached, and if they are within a “trusted intranet” allows the intruder easier access to your more valuable targets like laptops and phones.
This was the rationale explained to me anyway on why you would want to isolate IOT devices in a guest network to make their exposure less harmful to other devices.
I am going to be spending more time on your fabulous website. Thank you again for all of the time and thought put into this site!
Hi Dong,
Thanks for all the rich info.
I would like to know which setup is a better performance for the single NAT?
NAT gateway with AP router
or
Bridge gateway with NAT router
I own “Huawei 5G CPE Pro 2” as my 5G gateway and “NETGEAR Orbi RBK50” as WiFi Mesh System.
I’ve tried both setups. The result was as follows:
The first setup provided better ping and acceptable downloading speed (12 – 18 ms and around 200 Mbps).
The second setup provided higher downloading speed but more latency (28 – 33 ms and 300 – 400 Mbps).
My personal results might be affected by other factors unknown to me.
That’s why I wanted to know if there are scientific or technical explanation for those results.
Thanks again,
Generally, a bridged gateway + a router is the best since it’s similar to having a modem and a router, Ahmed.
But with very fast internet connections, it could be better to keep the NAT on the original gateway because when in bridge mode, it’s generally a software bridge that could not handled the full potential of the connection.
In my case (8gbits connection) I cannot put my gateway in bridge mode because of that.
That’s a very special case, Thieryal. It might need a particular gateway/harware. But the principle remains, you want only the function of a modem there.
This is a continuation of the question I submitted earlier today. About not being able to access devices on my internal network.
Example: Router A is gateway. 192.168.0.1
Router B has static local IP of 192.168.0.2 on Router A.
Router B internal IP is 192.168.1.1 and is gateway for it’s devices.
Forwarding inside router A: external start port:55556 external end port:55556 send to IP:192.168.0.2
Forwarding inside router B: external start port:55556 external end port:55556 send to IP:192.168.1.55
What must I do to gain access to the device 192.168.1.55 on router B from the internet? When router B was the only router, access was no problem.
Assuming you use the same port for the external and internal sides of the forwarding (on both routers), that should work. If not, make sure you got the correct port. More in this post on Dynamic DNS. You can also put router B in the DMZ of router A. Again, pay close attention. This kind of setting requires exact configuration and is not something you can do loosely and expect it to work.
Hi and thank you for the reply.
In my effort to keep my post short, I omitted many things.
I have had DDNS for many years. Just as I have had access to all the devices on my network from anywhere in the world for many years. Once I put the new network ahead of the old, I lost all inward contact with the old network from the outside world.
That is why I asked the question, because nothing I can see should be keeping it from working. I have about thirty devices on the old network. They all still work, still send information out to the internet, as long as I am on that network locally, all is well. One of the main reasons I put the new router in place, is to take advantage of the additional firewall security for the old network. So, putting it in the DMZ would defeat that purpose.
There is something I’m missing in the setup of the new router. I was hoping you could point me in the right direction.
I just found the problem. Still at a loss to solve it. All of the ports that are forwarded in router A are closed in router A. I have always forwarded the desired port in order to open that port. They all show in the router as forwarded and active, yet when tested, they show as closed. I have power cycled the router after deleting and re-forwarding the ports. Still they are closed. Any idea’s?
Hi Doug,
I have read your article and all the questions. Unless I missed something, I could not find an answer to my question.
My situation is; I have two networks that I want to keep separate except that they share the same internet. Router A host Router B. All devices on each network work and communicate fine on their respective network. All devices on each network have access to the internet.
History: Router B has existed for many years as a normal single network. Current network/router A was added lately. Creating a double NAT.
My problem is that I can’t find a way to access devices on Router B FROM the internet. To accomplish this, I port forwarded all ports needed on router B inside router A. The network port forwarding tables in router B remain the same has they always have. When I try, I get the error message ” Remote device refuses connection”. What have I missed?
You missed a couple of things, Jay.
1. The name.
2. The Tips of the double-nat section in this post.
Pay a bit of attention, and you’ll figure it out.
Hi Dong,
Thanks for a great article. I have FIOS internet and TV (have the latest G3100 router). I have an ASUS router connected to it (FIOS LAN to ASUS WAN via ethernet). I am running into a double nat situation. I read through the article a few times and am not quite sure how to forward the WAN IP from the FIOS router to the ASUS router. I need to keep the FIOS router or else I will lose tv functionality (ie guide DVR etc..). Any ideas on this?
Thanks,
Chris
You probably can’t if you use the FiOS box also for TV. If not, you can turn it into the bridge mode. Also, get YouTube TV and use FIOS for internet only. You’ll have much better flexibility and likely save some money, too.
For now, you have to used the Asus router in the AP mode or use double NAT.
Thanks – would I be able to use the FIOS router’s DMZ settings to make this work? If I add the ASUS’s WAN IP to DMZ (the ASUS has it’s own firewall, so not terribly concerned about exposing it directly to the internet), would that make this a single NAT network?
No, Chris. That only allows the router to get all Internet packages but is still double NAT.
In the article you mentioned:
‘Another option is to use the gateway’s DMZ setting, if applicable, to allow the upper-level router to get unfiltered Internet access. This method is not the same as passing the WAN IP, but it does enable specific services/applications to work.’
Is that different from what I did? Sorry for all the questions, just trying to wrap my head around all of this.
Read that sentence again, Chris. It’s a hack to make certain things work — not a way to fix double NAT. Check out the section about Double NAT in this post again. Take your time and you’ll understand.
Hi Dong,
I have an ISP supplied ONT (phone, internet, and IPTV) and an ISP supplied gateway (internet and IPTV). I don’t use the WiFi on the ISP gateway. I have a commercial POE switch and access points. Presently, I don’t have my own router. I am considering adding my own router. Could you please elaborate a bit on the pros/cons of putting the self-supplied router into the DMZ (this is supported on my gateway). If I ever need port forwarding, does that work differently if the self-supplier router is inside or outside the DMZ of the ISP’s gateway?
DMZ doesn’t give the WAN IP address, Kevin. It only allows the router unfiltered access to the Internet. So you still have double NAT. I explained port forwarding in a double NAT in this part. Give this post another close read. It’s best to use your gateway in bridge mode (if available) or get just the ONT.
follow up to prior question – my Gateway does not support bridge mode and it also provides my IPTV, so I’m stuck with it.
I understand the DMZ doesn’t avoid the double NAT, what I wanted to understand better is what does “unfiltered access to the internet” really mean – what does that give you? what is benefit? why would you need/want it. i.e. when does one need to use the DMZ approach?
DMZ is a way to expose a device in a network so that others are safer. But it’s also necessary for services that must be exposed, such as a web server or an FPT server. In a double NAT, exposing the upper router gives you more options for advanced configurations. But if you have to ask about it, chances are you don’t need it. I’d go with Double NAT. As mentioned in the post, it’ll work fine as long as you’re aware of its shortcomings.
Dong,
Thank you for the great info. I recently switched to Google Fiber/Wi-Fi and so have a gateway that I’ve got set up for port forwarding and that has a few devices connected to it via Ethernet. However, the Google Wi-Fi hub does not have a USB port and I want to continue to access my USB HDD connected to my other router (an ASUS AC-68). Right now, it’s in a double-NAT situation but everything seems to work ok, at least if I only want to access my HDD via LAN (using the ASUS wi-fi connection). Two questions – should I make my ASUS router an AP to avoid the double NAT situation, and if so, will the USB connection still work? I assume if it would still work, I would have to change the IP address to connect.
Thank you for your help!
Yes, K. The Asus’s USB port should still work in the AP mode. And yes, you’ll need to keep tabs on its IP. The Google Wi-Fi has minimal customization via the Google Home app. I haven’t tried the setup you’re imagining, but I think it’ll work.
Hi Dong,
Excellent article(s), I appreciated the time you take to put the details in.
For many over 10 years I’ve had unusual setup that is no longer unusual. However things are getting away from me now and I am struggling to figure out a solution. The setup is:
FIOs G3100 router (now with firmware 3.1.0.12) with several enet connections including a Netgear R8500 (in AP mode) along with a Netgear EX1700 as an extender into a Wi-Fi desert (my office). Additionally, I have the G3100 using only the 2.4g band (5g band turned off since I use the R8500) for my guest network. The guest network, and this is key, using your analogy, is for my in-laws. My in-laws have a few devices and one computer plus a network printer
All was well until the FIOs G3100 went from firmware 2.x to 3.x this week. Now the guest network does not allow (I can find no way to adjust this) devices on its subnet to see each other. So the printer does not work along with a media sharing device. It is critical to keep the guest network off my intranet because of work.
So options I am considering based on my limited knowledge is:
1) Put some type of extender or AP in the apartment with a separate wifi network (double NAT). Any guidance on the best way, if it is possible, to do this?
2) Double NAT my intranet and allow in-laws to use the regular FIOs wifi. As best I can tell from your article, the problem with this solution is that they, being at the 1st NAT (FIOs), will have access to my intranet but not vise-versa. So this is not an option.
3) If I could get a contractor (and take on some damage) there is a slight chance I can run a RJ45 (this is a last resort). If I take the RJ45 from the FIOs router and connect it to a new wifi router setup as a double NAT, then I assume that new network will not be able to see my intranet.
I know I may have misunderstood some of what you wrote and I am sorry to be a burden with such a long note. I do hope you can take a few minutes to guide me (or even correct me).
Best Regards,
daniel
In your case, Daniel, use the Netgear R8500 in the router mode for yourself, and you’re all set. Leave the Fios gateway (both bands) for your inlaws.
That is very helpful. Thank you!
Sure, Daniel.
Dong,
Thanks so much for your quality content. I’ve been reading for hours and have learned so much! I apologize if you’ve covered this question before, but would appreciate your insight.
We recently completed an addition to our house for my in-laws. We hard wired a coax cable from our ISP panel to their addition, thinking they would create their own network and be independent. Now, they’re thinking they want to create a mesh network so that if they come over to our side of the house they can switch to our network for a stronger signal.
In reading this article, it seems to me that we would be prohibited from running two routers as a single NAT because having two modems would prevent us from running either router as a bridge. Is that correct? Or is there a way to configure the IP addresses and the SSID of the two routers so that they can create a single NAT?
If that’s not possible, would I be correct in assuming my options at this point are to run a tri-band wireless mesh, or run a network cable from my router to their addition?
Read the post again, Michael. You just need to use the 2nd router in the AP mode.
Thanks for the reply, Dong. I tried reading it closely, this in particular (regarding APs) is what has me hung up:
“Get an access point if you can run a long network cable (or a set of power-line adapters) from the gateway to it.”
Since the network cable running to the addition isn’t connected to the original modem, will the second modem/router combo be able to function as an AP? Said differently, I thought that since there were two separate lines coming into the house that both routers would have to function as routers (and not as a router/AP combo). Is that not the case?
Thanks again for your help!
Looks like you’re confused between modem, router, and gateway, Michael, and I can’t answer your questions if we’re not on the same page in terminologies. That said, start with this post, if you still have questions, I might be able to address them then.
Thanks for the link, Dong, that article was helpful. Now I can better articulate my question:
Is it possible to setup a single NAT when we have two service lines coming in from our ISP?
Yes, Michael. But it’s not conventional. You either have to do a special VPN setup or use a dual-wan router.
Got it, thanks so much for your help (and your patience while I was figuring out how to ask my question)!
Cheers,
Michael
Sure, Michael! 🙂
Your explanation and thoroughness of these topics are amazing.
I’ve got a Wavlink AC3000 wifi mesh system.
I’m attempting to make it work like AP mode but cannot seem to find success. My end goal is to send video from the internet to a port forwarded port on a computer plugged into any of the mesh devices. Do you know if it’s possible with those devices? The wifi mesh will be plugged into my modem/router from Frontier, but I need to be able to take it to any router and either have the entire mesh be on the same network as the router, or allow traffic to that specific port.
Thanks!
If you go with electronic trash like that, Jason, not being able to use the AP mode is *the least* of your problems. Don’t be cheap on your networking equipment!
Haha, that’s really what I need to know, if it’s even possible. If the real answer is to use different devices, then I’m all for it. Do you recommend any specific wifi meshes? I’ll be connecting cameras to the wifi stations and sending the feed to a computer on the main station. But I also need to send feeds from phones on 4G to that same machine (typically done through a forwarded port). If you’ve got recommendations on wifi meshes that can accomplish this, I’m all ears.
Check out one of the AiMesh dual-band setups, Jason.
Thank you, Dong! I was able to pick up 2 RT-AC68U units and it’s working just as I’d hoped! I’m using AP Mode with the second unit as an AiMesh Node.
Thanks again!
Sure, Jason.
Hi,
Thank you for all the good work.
So I just bought Asus Xt8 2 pack and after I´ve set everything up I sa that I could not reach my Plex server from outside my network and that I’m running in double nat.
Is there no way to fix this without putting the node in AP mode?
Thanks
You can use the server’s IP address instead of the server name, Bogdan, assuming your Plex server belongs to the lower level NAT. If it’s on the upper-level NAT, you must use AP mode.
How do I know which may level the server is on?
If Router A connects to Router B then Router A (and all of its connected devices) are on top of Router B, etc. If you don’t understand “that” then I think you need to call a professional, or spend more time on this site and read about IP addresses, routers, switches, etc.
Ok it’s like I thought then, just needed to get that verified. So basically if I connect my server to router B then it should work properly?
Thank you.
It should if you use it’s local IP from the top level, or via WAN-level domain.
Hi Dong,
After reading your article I am fairly sure I am set up correctly but am still having issues with double Nat on Xbox one?
My set up is an Archer MR600 on LTE with a Deco m4 mesh run in ap mode ( main deco connected by cable to the modem router , other two decos wireless. I have added the IP address of the Xbox to the routers dmz and restarted all devices. The Xbox shows as open nat but then reverts to double Nat / moderate on next use?? Any ideas , is this a quirk of LTE ??? Help please as I am out of ideas!
You don’t want to put the XBOX on DMZ, Paul. Also, make sure you don’t use DHCP on the Deco. Anyhow, considering you mentioned the XBOX’s IP, it’s likely that you have made some weird configuration. I’d recommend restting the Deco and set up first as a router then change it into the AP mode. And that’s it. Don’t mess with anything else.
Hi, I have been reviewing your website and i find your explanations very helpful to the non IT literate people like me! I wonder if you can help me?
I have a TP-Link Archer VR600v2 modem/router. I have just purchased the Asus CT8 AC3000 wifi mesh. I set that up using the app as a router. I have turned the wifi off on the VR600. Internet is working fine but I get the double NAT/private WAN IP address warning.
I use some hardwired LAN ports of the modem/router and would prefer to keep these connected rather than use the CT8 LAN ports due to location.
I do not think my modem/router is capable of working in bridge mode even though it has the option. When I set this and re-set up the CT8 with ISP details the end fails to function. I was wondering if it possible to turn NAT off on the Asus CT8 in order for all of the CT8 clients to have only a single NAT? I have an issue with my satellite TV supplier when trying to connect it to the mesh wifi due to the double NAT. I assume it can’t be that simple?
Many thanks in advance
You need to change your CT8 set into AP mode, Peter — you can do that via the web interface of the router unit, don’t use the app. Check that section of this post for more.
I have an Asus AX86U router and want to use it instead of the ISP, I want it to carry over all the things the ISP does, so I connected it in and all is well but I have a double Nat not even Port Forwarding or Open Nat works, once I disable the Nat from the Asus router no more inet connection and I can’t configure it from my ISP router as it’s not found anywhere in the settings (the ISP router is Huawei), I feel so frustrated as I spent days to figure it out but no use
You can’t just disable the NAT function, Ehab. All the options are in the post, read it again, and pay attention. If you want to use your router as a router, you must change your ISP box into the bridge mode if that’s available.
Dong,
Thank you for all your great posts. This one in particular has really helped. We have a Google Fiber Gigabit + TV service. So our “gateway” if not only a router but also a tv server via MoCa to tv boxes for each tv in the house with also supplies a ethernet port on each tv box, it is also the DVR storage and services the WIFI. Plus each tv box can be turned on as an AP (but 5g only and they are pretty weak.) So we were planning on adding a mesh system to make up for the poor WIFI. The post really helped me realize that the new mesh router most likely needs to be set up in AP mode, since the gateway serves the TVs and their ethernet connections as part of its wired network connections AND many of our wireless devices need to be on the same network to interact with them, plus many other home automation items — a controller, multi-channel amp, tuner, etc. — some of which are on a switch off of one the tv boxes ethernet ports via the wired network’s MoCa feed. Thanks for saving me a lot of potential frustration by installing the new mesh router as a second NAT. Single NAT with the new mesh router in AP mode it will be. With the WIFI on the gateway turned off.
You got it correct, Steve. I’d recommend, though, that you quit the cable TV and get YouTube TV instead, that way you’ll have much more freedom in terms of cord-cutting, hardware, DVRing etc.
Thanks Dong. We agree, but our early adapter stats gives us such a good price – almost cheaper the same as gig + YouTube TV. So may want to wait till they update Kansas City to 2 gig. Or maybe not.
Sorry to chip in… I have a double NAT problem? Hope you could help. My ISP is like wifi line of sight internet it always worked fine until two days ago when I noticed the error. You can surf the internet as normal but when you what to join multiplayer game lobbies it doesn’t allow you. So my setup is a dish with a lan cable to a “p.o.i” or “i.o.p” (its small matchbox size box with a power cable) from the p.o.i a lan cable to a wifi router plugs in the “waw” and fron there a lan cable to my pc and the rest of the devices connect with wifi.
The double NAT gives me a NAT type strict on my xbox and NAT type moderate on my pc this causes me not to connect to multiplayer lobby.
I hope you or someone can help….
You likely have a latency problem, V. Do a test and see how hight your Ping is. More here: https://dongknows.com/how-to-do-an-internet-or-wi-fi-speed-test/
Hi. I have found your website a refreshing source of information that I have not been able to find elsewhere. So thanks for the quality info.
I recently set up a Deco X60 mesh system and I am in the process of fixing dead RJ45’s so that I can have a wired back haul. It is attached to an Arris SBG 8300 modem/WiFi/router. As I have learned on your site, I am running in a double NAT environment which is ok for the most part. (I am reluctant to put the mesh in AP mode because the Arris has a horrible management interface…ie. everything is “unknown device.”)
The problem with double NAT comes in when you want to add smart devices. There is a baby monitor that only runs on 2.4 GHz. It is my understanding that the X60 combines the 2.4/5 GHz bands so the monitor could not see the Mesh to connect. So, I connected to the 2.4 GHz from the Arris. I disabled the 5 GHz. I can view the monitor from the web interface but it uses my cell phone bandwidth. When I want to add a smart doorbell and other things, I will be digging a large 2.4 GHz rabbit hole.
Am I wrong that smart devices have trouble with mesh? What do you suggest for setting up this network
Arris SBG 8300
Deco X60
Net gear Switch PoE
I have two Luxul XAP-1510 access points which I suppose could be used if the Mesh were put in AP mode. (Not sure these can be used if in any other mode)
You should put the ARRIS in the bridge mode, Vicki. All clients (including the baby monitor) should be able to connect to the Deco’s 2.4GHz band, even when you use Smartconnect. If you have trouble connecting, check out this post for more on how to fix that.
Thank you for the response. So I will put Arris is bridge mode which will make it a single NAT and make the Arris a modem only from what I understand.
Am I correct that I should not use the XAP-1510’s with the Deco?
Yes, just read the posts and pay a bit attention, Vicki. As for the XAP, it’s an access point, so it never works “with” anything. APs always work as independent broadcasters. More here. Your question is irrelevant. You can choose to use them or not, depending on your situation.
I’m new to setting up a mesh system I’ve been reading as much as possible. Any help would be appreciated. I recently purchased the Nighthawk Mesh Wifi 6 System to help with some wifi issues in my old house, no wired capabilities. My Comcast/Xfinity is my gateway, which I will be keeping.
You mentioned that the lights on a gateway will have a steady light.
On my gateway, the 2.4 and the 5 GHz lights are usually blinking; never a steady light. I have reset it so is there something wrong with my gateway. I can’t seem to get an answer from them.
After I set up the new router and their satellites and do the updates, am I correct in selecting Bridge Mode on my gateway so the gateway’s router is no longer the router? Is this the same as some people are referring as “turning off” its router function?
Also, if a Wifi device says it supports dynamic IP (DHCP) addresses only and that I need to ensure the DHCP server option of a router is enabled, do I have to use Nighthawk’s web interface to make these changes because these are settings I have to make after I install this mesh system?
The only light that needs to be steady is the signal light, Laura. (More here.) What you saw there was normal. And yes, if you set your gateway into the bridge mode, its Wi-Fi network will be off, too. It’ll work just like a modem. So for your station here’s what you should do (and might have done already):
1. Setup your mesh in its default role (the main router unit working as a router that is.)
2. Bridge your gateway.
3. Connect all devices (wired and wireless) directly to your mesh, and not the gateway
You’re all set.
Thanks very much for your advice. I now feel more confident that I will be able to get this up and going. In setting up the SSID name and password, is it advisable to use the same name and password for the new wifi router as what I used before for the gateway? I think I read that by doing this I won’t have to redo all of the devices that I had set up for the gateway.
That’s up to you, Laura. And yes, you won’t need to re-enter the information on existing devices if you keep the SSID and password the same.
Hi Dong,
Found your site this evening, now safely tucked away in my LTE folder!
We have a 3500 sq ft French stone farmhouse, external and internal walls are 2 ft thick. The adsl internet into the house is dreadful (12mb down /<1mb up), however we have several 4G towers relatively close to the house giving us 35mb down/20mb up.
We have a Netgear Nighthawk LAX20 4G and a Netgear Nighthawk MK63 (MK60 Router + 2/3 MS60 Sat), I would like to have the MK60 use the LAX20 as a modem/router. Which would be the best way with everything using the same Name/SSID (for TADO/Alarm/Hue Lights etc)? LAN/LAN with (Wireless) AP set on MK60 in advanced tab of Netgear Page?
Also could I use 2 power lines to have the furthest MS60 talk to the MK60? I also intend to have an additional MS60 (total 3). The LAX20 modem/router is positioned 3/4 (60ft) down house at a Roof Velux to get the best signal, we have 2 x NAS + UPS there.
Thank you, Vern
This post will answer the questions about using the two hardware together, Vern. As for powerline, the quick answer is yes, just be aware of the fact Powerline can be slow and unreliable.
Dear Dong,
Blimey that was quick! I’ll have a proper butchers tomorrow morning. Thank you very much. Vern.
Sure, Vern. 🙂
Hi Dong, I just found your website yesterday. You supply so much great info it gets dizzying at times. If you’ve covered my question in one of your links I apologize.
Based upon all of my reading I need a mesh network. I was planning to purchase the NETGEAR Orbi (RBK13) you recommend however noticed that it only comes with a trial subscription to Netgear Armor Powered by Bitdefender. I plan to use my existing AT&T modem and follow your Gateway-to-router WAN IP forward instructions.
So my question is this. Do I have satisfactory security through my AT&T modem that allowing the subscription to Netgear Armor lapse is not an issue?
Happy to have you, Michael. I don’t know what your AT&T gateway can do. Generally, though, such a gateway tends to have no similar protection feature as Netgear’s Armor. But it’s OK to have more than one layer of protection, and the Armor gives you software for use when you’re out and about, too. But Armor itself is optional. You don’t really need it.
I appreciate the quick response Dong.
Sure, Mike. 🙂
Hello!
I am very frustrated and do not understand pretty much of what is going on. I’m sorry I’m advance for my ignorance.
I have fiber 1Gb from centurylink. In my home I have a GPON fiber terminal (and two Ethernet cables) just coming out of the side. (Apartment has two Ethernet ports in the bedrooms). The two Ethernet cables are plugged into this “gateway” fiber modem. There is one fiber optic cable that runs and connects inside the gateway (not visible). I’ve had so many issues with lag and network drop outs. I’ve had this gateway from centurylink replaced 6x in 3 years.
I bought a TPlink ax6000 wifi 6 mesh router, thinking I could just enable “transparent bridge mode” on the century link gateway. I set the new router up (no WLAN port on gateway) in a lan port, WiFi networks set by the new TPLINK had internet access, all is good. Turned on transparent bridge and boom. TP lost internet connection and I could no longer access either routers web GUI. Had to reset both.
After reading your post, it sounds like they were probably using the same IP (192.168.01).
Found basically nothing on the internet that actually worked. Someone said enable pppoe on the centurylink gateway (default profile is ipoe, and set the VLAN tagging to 201. Enabled PPPoe on TPLINK and added my credentials. Enabled VLAN on tpLink and added the tagging to 201. Nothing. No connection. IP/DNS/dhcp were all valued at zero.
I am just at a loss. I’ve spent over 20 hours trying to figure out what the right thing to do — centurylink won’t help, and nothing I’ve read about this centurylink fiber modem/gateway using with a different router has worked. For gaming I cannot use a double NAT. Need a single NAT.
Again, I don’t know much, and I’ve done as much research that I could find but I don’t see any clear instructions. I’ve read on Reddit some people have done it, but they never explained how, and of course those posts are archived.
If you could offer up any advice or provide any insight as what may be happening or what I’m probably doing wrong, that would be great. Thank you so much in advance.
I just need to know if this is a lost cause.
Two things, Dianna. This is an EITHER OR.
1. Leave the gateway alone and use the TP-Link in the Access Point (not bridge) mode. Log in to the router’s web interface, set up its Wi-Fi to your liking then: Advanced -> Operating mode -> Access point mode -> Save.
OR
2. Change the default IP of the TP-Link router. Advanced -> Network -> LAN. Change the IP to 192.168.x.1 where x can be anything but 0, try 99, so 192.168.99.1 -> Save. Now change the Fios gateway into the bridge mode. Restart them both.
Hi, i have a question.
Me and my bro are neighbors so he has the main ISP internet contract in his house which came with a wireless (wifi) repeater i have in my house.
That repeater has no configuration options for changing to AP Mode, Bridge Mode, Port Forwards, or whatever. Not a single one.
It just lets me chose the wireless network SSID and pasword to connect to, and then broadcasts another signal with a different SSID and password of my liking, with a different set of IP adresses just like the post says.
No matter what i do, port forward, set on DMZ the repeater (on the main router, the repeater as i said has no options), i can’t just play some games online.
Any thoughts?
If he sets his (the main) router to bridge mode, would the devices on HIS house which connect to THAT router no longer be able to get the right IP’s thus he would lose access to the internet?
Thanks in advance
No. You need to get your own Internet plan to get all what you want, Garcia. In your situation, things can improve if you use a network cable to connect to your brother’s network, but even then you cannot expect to change HIS network to fit your own needs. Right now, you’re lucky to get connected at all. 🙂
We both pay for it, its just installed in the house he is in, if that’s where you’re coming from.
Anyway, thanks i guess?
That was not even a solution.
I am pretty surprised at you saying that as it’s so obvious i am wondering why you are even mentioning it.
I am always at a loss of words at you advisors who like telling people to just buy and buy.
I’m not an “advisor,” and I answered your question out of kindness. So maybe next time, work on your question first. Or don’t ask if you can’t deal with the answer. For your situation, you’re in a pickle. Unless you can run a cable, there’s no way you can get the Internet AND expect to play games, etc., the way you want. In fact, even when you can run a cable, things can still be pretty hard to set up, especially considering your attitude.
Thank you very much for your kind answer.
And sorry for how i reacted but disrespect (the “lucky” part) should never be acceptable or tollerated.
A cable would work, if it were possible (i cant have a cable that goes outside and crosses my neighbor’s house, as my bro is in two houses away).
All i wanted to know was if a router modem alone can work in bridge mode. (That was the main question that should have been addressed).
Apparently from what i’ve read it can’t however, so yes i’m guessing there’s not much i can do except get a separate plan or get another repeater that actually lets me enter its configuration, because this one is creating a NAT and the firmware is kind of blocked so i can’t change that (i can’t change pretty much anything actually).
Again, thank you very much for your help and have a good day.
The gateway can likely work in the bridge mode. But in that case, your brother will have no Wi-Fi or a network at all. Your best chance is to do a double NAT where your part is the top-level NAT.
Need some advice, not a networking expert but here is my setup
Have a modem/TV/WiFi box gateway/router combo (HH 3000) from my ISP that provides TV/Internet/WiFi service. DHCP is enabled on the HH3000. There are also 4 LAN ports on it 2 of which are used to connect to my TV receivers and the other 2 are free. The WiFi is not terribly good on the HH3000 so want to set up a mesh router on it.
I want to use to use the ASUS ZenWiFi AX (XT8) mesh router and connect it to one of the HH3000 Lan ports but don’t want the double NAT scenario if possible but still need to maintain TV service on the HH3000
while forwarding Internet service to the ZenWiFi
Have a couple of questions (assuming the HH3000 gateway IP is 192.168.2.1 and Zenwifi gateway IP is 192.168.1.1)
1) Since the HH3000 doesn’t have a bridge mode, I need to connect the ZenWiFi through pppoe mode on the WAN port to the LAN port of the HH3000 since my ISP supports pppoe. I am assuming the HH3000 now acts as a modem at this point and will just pass a public IP address to the ZenWifi? The HH3000 should still send TV service on the other 2 LAN ports?
2) Will I have double NAT in this scenario since I have DHCP enabled on the HH3000 and ZenWiFi?
3) Will the ZenWiFi still work in mesh mode in this scenario
Read the post again, Tony, and also related (linked) posts. You can’t figure things out in networking by assuming stuff. You have to know how things work. So pay attention to that and not trying to find a shortcut to where you want.
1. No. PPPOE is on the HH3000. Just use Automatic IP on the ZenWiFi, or use it in the AP mode.
2. Yes. But don’t mess around too much. Read #1 again.
3. Yes. It’ll also work as a mesh if you use it in the AP mode.
You should use double NAT in your case. It’ll work fine.
Dong,
Thank you. Your articles have been invaluable to me, a networking novice if ever there was one, as I try to setup a network in my home now that we have cable internet after years with DSL.
With my home pretty much up and running my attention is now on a structure about 250 feet away. I’ve buried a cat6 cable between my home and this structure.
There is a Spectrum-supplied gateway in my home. All I want is internet in this second structure and I’m moments away from purchasing an an RT-AX88U (off the strength of your review) to make that happen.
If I understand this article correctly, for my stated goal of simply bringing the internet into the structure I need to (a) activate bridge mode on my gateway, (b) activate AP mode on the AX88 and (c) plug my freshly-buried cable into a LAN port on my gateway and the WAN port on the AX88. Is that correct?
Thank you again for sharing your knowledge.
C is a must, but you do EITHER a or b, Jordan. Doing both will cause issues. (Take another read at the post!) I’d recommend a, but you can also do a third option: Leave the gateway as is and use the RT-AX88U as a standalone router (default). Now what you have is a double NAT, which is fine if you just care about Internet access. By the way, 250 feet is a bit too long. Depending on the type of cable you use, it might not be able to carry more than 1Gpbs (though it might).
Dong,
Thank you for that.
I ordered the AX88 but, while I wait for it to arrive, it occurred to me that perhaps I could order a single ASUS XT8 node (this is the mesh system I recently setup in my home) and plug it in at the separate structure using that buried cable I mentioned.
Potential cable length issues aside, is this feasible?
Centurylink is installing Gigabit Fiber at my home and will provide a Greenwave C4000XG modem/router gateway. I’m also picking up the Asus XD4. Should I use the C4000XG as my primary router and XD4 as satellites, or am I better off setting up my own LAN (double NAT)?
If you read the post in its entirety, you know the answer, Jon. I can’t decide your taste for you. 🙂
Hi Dong,
I’m looking to set up NAS (Synology) onto my FIOS Gateway network. Currently looking into one of the Asus Wifi 6 routers to do so. This router is also meant to manage all my devices including gaming. Is Gateway-to-router WAN IP forwarding still the way to go?
Thx.
Yes, Ron.
Hi Dong, I have been reading all of your wonderful advice to so many. I have a pretty simple situation I think that I was wondering if you could comment on? I have a TP-Link C7-AC1750 along with a TP-Link RE450 (AC1750) extender to strengthen reach to one end/2nd floor of my home. For the most part everything works very well. The one issue, My son’s room is in the weaker signal area of my home and he’s at home not finishing college. A month ago I ran a Cat 6 Cable directly to his room from the router so he could get a solid/fast signal when he wants to play his games, etc. The Extender signal is just not enough. So I was thinking, the C7 Router works so well and is so cheep, why not buy a 2nd one, set it up on the 2nd floor of our home (as an access Point which is supports) near his room, and get rid of the extender so there is no degrading of the signal strength any more in that part of the house. 2 Questions; 1) does that sound like a good idea to you? and 2) Can I still run a cat 6 cable out of the access point router (on one of the 3 open gig ports) directly to his Gaming PC so there is absolutely no degradation of signal for him? Thanks so much in advance for the kind attention you pay to everyone
Stephen,
1. To me, going “cheap” is never a good idea when it comes to networking, but your choice will work.
2. Yes. Use the WAN port to connect it to the main router unit and the rest of the LAN ports will work as they are intended to. Wired is almost the best for gaming.
Thanks Dong, I probably should have said “inexpensive vs. Cheap!” The AC1750 for $60US works so well for our needs I’m not sure it’s worth spending the additional $100-$200 dollars just yet. I was very surprised that such an inexpensive router would work as well as it does. If I were to spend more, I would probably move up to the TPLink AX50 or the Asus RT-AX3000, or even the ASUS RT-AX86U AX5700 as my main router and use the TPLink AC1750 as the AP. I know those are pretty big steps up, I do have gig-speed wifi service though. I just don’t have any devices beyond AC so I think I’d be future-proofing my network. Do you think I would see much of a performance difference (since my son’s computer that he games with is going to hardwired anyway)? Again, thanks so much. You’re a gem
Those are very cheap devices, Stephen. So, yes you will see improvement if you move to higher tier of Wi-Fi. But your son’s (or any wired device) will be the same.
ok. All this makes sense, but I’m Not sure my specific situation will work, so I will try to explain it, and hopefully get your opinion.
I have an XFi box (Xfinity modem/router). I also have 2 wifi cable boxes, and everything I’ve read says I can’t put the XFi box into bridge mode, otherwise the wifi boxes won’t work.
With Covid, my wife and I both work from home, and our kids are about to start school virtually. So, there’s going to be a lot of traffic during the day.
My office is downstairs in the garden basement, with the computer hard wired to the XFi box. So, I’m not too concerned about my situation. The rest of the family will be on wifi, upstairs.
Our house is a combination of 1940’s and 1990’s, so the wifi signal in the front of the house on the main floor is unreliable.
So, I was thinking of renaming the XFi network and only having it communicate with the wifi cable boxes. I even think there’s a way to not broadcast the SSID, but still communicate with the wifi boxes (I’ll need to confirm that).
Now here’s where I am a little unsure. I want to set up a mesh system for all my other devices on a completely separate SSID (preferably my current SSID and pwd so I don’t have to re-establish connection to my 20-30 devices, including light switches, garage, doors, and of course all our wifi devices). I would plug one of the new mesh devices into the XFi box, put one in the middle of the main floor, and a third next to my wife’s computer so she can hard wire into that, thus reducing one extra wifi connection for her. At this point, I’m not sure if I would need to set any router or mesh devices in any particular mode. I don’t really do port forwarding, but sometimes do remote desktop (however, right now that’s not an issue because I work from home right now).
Everything I’ve been reading, each system has positives and negatives. I’m ok losing the ability to manage devices through the XFi app, as long as I would still have that ability through the mesh devices app. I was thinking of the TpLink Deco Powerline P9. But, if there’s a better option for my situation, I’m all for that.
Any help would be greatly appreciated, and thanks for all your very informative posts.
Cheers
Your situation is fairly easy, Joel.
1. Keep the XFi the way it is. If you have TV plan attached to it, it needs to work as a gateway. (Alternatively, though, I’d recommend ditching your Comcast TV and just keep the Internet. Get YouTubeTV instead. In this case, you can get your own modem, and life will be much easier. But that’s another story entirely.)
2. Get a mesh system. It’s best to hardware it to the gateway via network cables, but if you can’t it’s better to use MoCA than Powerline.
3. First set up the mesh on top of the gateway (in the double nat setup), make sure you use it with the same SSID (network name) and passwords as those of the XFI.
4. Now change the mesh into AP mode.
Now you’re all set.
Hi Dong! I’ve learned a lot by your posts, thanks for sharing your knowledge and in a very structural way.
A couple of thing I still don’t have clear. It’s about the section “Turning your router into an Access Point”. 1) The image doesn’t indicate if the ISP gateway and my router there can be either ethernet or wireless, can an AP be wireless? [So far I’m planning to use a short ethernet cable for that connection] 2) If I have them side by side, and ISP gateway has it’s own WiFi active, would that impact the seamlessness of the Mesh I’m setting up in AP? I want to know how critical is it to ask ISP to turn the gateway to bridge mode and have the Mesh function as a router / how much do I lose of my product if they can’t do that for me.
You made a few assumptions there, Roberto.
1. By default, AP is always wired, that’s what an AP is. More on that here.
2. As I mentioned in the post, you want to turn off the Wi-Fi of the gateway unit or use a different SSID.
Hey Dong,
Regarding item 2: I have an ac86u as my gateway, a tplink a6 as an AP, and a tplink AX1500 as another AP. Both APs share SSID with the gateway and both APs have DHCP enabled with different address ranges. It all works fine. Why would turn off the radios in the gateway?
Larry
That only works fine if all you care about is Internet access, Larry. You’re using a double-NAT setup. Local services might not work if your devices connect to different NATs. Check the double NAT part of the post for more.
All of the router/aps are on the same subnet. Only one NAT. Unless, I’m missing something?
Nope, I think we just speak two different languages. It looks like you have a single router and two APs, the router is NOT your gateway. And there’s no gateway for you to turn its Wi-Fi off. I’d recommend you read this post so we can be on the same page in terms of terminologies.
Thanks, Dong, I should have called my ac86u: The router portion of my modem-router “gateway”. Pardon my confusion. Keep up the excellent work. Your reviews and lessons are enlightening.
Glad you figured that out, Larry. And you’re welcome! 🙂
Hi Dong, please correct me, but I should care about double NAT problem only if the gateway have PUBLIC IP, right? My ISP doesn’t give me public IP, the ONT modem (first router) only has private IP on 10.xx.xx.xx segment. But anyway, I set second router private IP as DMZ on the modem, any benefit for this DMZ?
You gateway (the first router) ALWAYS have your public IP address whether or not you’re aware of it. It can be a IPv6 one or IPv4 one, or both. It can be a static one (not common) or a dynamic one. Read more about IP address and how to find out what your is here.
In a double NAT setup, is there any benefit to connecting them through a DMZ on the isp provided router?
That depends on if “they” need the benefits of DMZ or not, Dean.
Dong,
Here’s what I did:
I configured a TPLink A6 as an AP and inserted between the ethternet drop and the Google mesh. Now they can connect to the A6 when they want to print. The signal does not reach all of the mesh area, but enough for them to use.
Thanks,
Larry
I think we have to differntiate here. If the router is in WAN mode, its firewall is turned on and one cannot access (at least I cant, I cant even access the login interface of the router, since access from WAN is disabled), if it only NAT you can access… Agree?
You can only use a router as a router when it’s working as a router, D. A router can have different roles, some of which will turn it into something else that doesn’t have all the functions it can offer when working as a router.
“A device of the upper-level NAT can still access one of the lower-level NAT if you use its IP address.”
I am not sure – if this 100 % true? You have to use port forwarding though, typically the second router will block incoming traffic? I cant even ping my 2nd router from the first network…
Well, now you can be sure 100%, Nix. Try some Windows-based file sharing from a lower-level NAT device, you’ll be able to access the share via \\The-ip-address\ShareName from an upper-level NAT device. Fort forwarding has nothing to do with this.
Or you can access the lower-NAT router’s web interface via its IP, from a upper-NAT device. That works.
Dong,
I live in a grandparents house next to the main house (about 40 yds apart). I have connect the houses with ethernet. Currently I run an asus rt86u in my house with wifi and ethernet connected devices including a printer. At the main house I have a 3 onhub google mesh. Everything works fine, but I would like to enable print to my printer from the mesh system. I thought I could enable ap mode on the onhub, but google says that it would not function as a mesh system. I have never used port-forwarding, but I am willing to try if that will work in my case. Do you have more details on port-forwarding?
Larry
It’s impossible with the current setup, Larry. That’s because the Google system doesn’t support the AP mode as a mesh system. What you can do is break up the Google system, and set up each of its hardware units as an AP (you can daisy-chain them) with the same Wi-Fi network (name and password) as that your RT-AC86U. That’s a bit of work, and you need to run cables to connect the units, but it will make both houses belong to a single NAT setup. More on that here. Everything will work as expected then.
Great article Dong and very relevant for me. Question on double NAT. You say the local devices won’t be able to detect each other (since some may connect to modem/gateway and some may connect to another router), but your solution seems to solve that issue (disable gateway WiFi, connect only to the router). It’s not clear in the article that your solution solves some of the issues you mentioned with NAT.
Would gaming features still work with this setup, or for gaming do you recommend setting the gateway to be strictly in “gateway” mode and pass that WAN IP to your own router? My current setup is AT&T gateway (default config) with several routers in AP mode connected to it. Wondering if this will hamper connections on PC and Xbox services/games. Thanks!
Cool, Ryan. Glad it applies. The gaming features of the router should work if you don’t have clients using the gateway. Otherwise, those might hog the Internet bandwidth before the outer. Basically, if you don’t use the gateway to serve clients, you’re fine. If you have multiple APs, make sure they connect to the router’s LAN ports, and not those of the gateway.
Any insights on using single NAT on AT&T Fiber? I looked around gateway but could not locate AP or Bridge Mode at first glance.
Try to look for something like “IP Passthrough” or “Pinhole”, Luis. I’m not sure about the specifics which change depending on the particular modem but the idea is to pass the WAN IP to the router and believe you can do it with any AT&T modems (both DSL and Fiber). I’ve done this many times before.
Thanks for responding so quickly Dong. Do you have any guides that are for setting up a moca? I tried searching on your site but didn’t find much. BTW i just found your website and i think its great! . I remember you from the CNET days. Sorry if this is too much of a request, i’m doing all the research I can and any advice is much appreciated.
3 story town home; slim and tall 2k sq feet (probably 18 unit condo association surrounding me.
Asus RT-86U
It doesn’t seem to reach my 3rd floor as consistently as I’d like. Unfortunately I don’t think I can set up a wired Ethernet back haul. So i’m considering using moca: Hardware list below
goCoax MoCA 2.5 adapters. qty 2 (1 for the modem and 1 for the AP) and splitters where needed
$6 POE filter where coax comes into the house,
Do you recommend what Asus AP to use in conjunction with the router for AI mesh.? alot of people on Reddit suggest TPlink EAP models, but i want to stay with Asus for AI MESH. As I tend to favor the asus brand.
I’m also open scrapping what I have, upgrade to wifi 6 mesh products and use my old hardware for my parents house.
I’m considering the ubiquiti alien +mesh and asus zenwifi systems. but they aren’t in stock due to covid19. Regardless for the mesh to work effectively I’d want MOCA installed anyways and want to make sure i’m setting it up correctly and just looking for any guides you know of.
MoCa is very straight forward for a single pair. You have two adapters at two ends of the cable and they will turn the cable into a network cable. Note though, in a home, you might not know where a cable begins and where it ends. Just because you see a cable outlet, doesn’t mean that outlet and the other one where you plug the OTHER MoCA adapter into are connected. If you want to do a MoCA network with multiple nodes, that can get complicated and it’s hard to troubleshoot since we tend to not know how the wires are run. Sometimes, they are even fragmented.
I’d recommend running network cables instead. In the end, it might be easier than figuring MoCA out in your particular situation. 🙂
Hi Dong, I noticed you don’t mention Moca as an alternative to wired Ethernet and power line when setting up an access point . Any particular reason ?
Good catch, Andrew! The reason is MoCA is only available in homes wired with coaxial cables. So it’s not something everyone can relate to. Powerline, on the other hand, is available in virtually all homes.
Thanks for sharing, Marcus! That’s very interesting.
Typically in Europe, replacing your ROUTER or ISP supplied device is either impossible or impractical without inside knowledge from an ISP worker. For example, at home in Switzerland, Swisscom supplies fibre routers with dumbed down resttriceted logon access and there are sophisticated Public/Private Key encryption keys which you have no access to preventing you simply replacing equipment even if you reverse Engineer the Fibre setting somehow. For Wingo NO logon access at all. What you can of course do, and is to be encouraged is to build an Infrastructure downstream of the ISP device, including an Independent chain of Firewalls, networks and Wifi Access points. And of course if you want to get serious, try Microtik.