Thursday, July 7, 2022 • Welcome to the 💯 No-Nonsense Zone!
Check out Today's Deals! 🛍️Amazon logo🔥

Double NAT vs Single NAT: How to Best Handle an (ISP-Provided) Gateway

Ideally, you should use just one router for your home network. But sometimes there’s no choice, like when you have to keep that ISP-provided gateway and yet want to expand or upgrade your system.

A gateway is a single hardware box containing a Wi-Fi router and a modem (or an Internet receiver of any type for that matter) on the inside. That said, within this article, a gateway is, first and foremost, a router.

Other times, you might want to keep your current router, or flat-out use a mix of a few routers, for one reason or another.

This post helps you get the home network you want in such situations. In the thick of it, this piece deals with putting a router (or a mesh system) on top of another. It’s a question of single NAT vs double NAT.

But depending on your situation, you might need to do something as simple as making the most out of your gateway or getting an access point or Wi-Fi extender.

In any case, before going further, make sure you’re comfortable with setting up a router.

Dong’s note: I first published this piece on December 30, 2018, and updated it on January 16, 2021, with additional relevant information.

Modem vs. Router vs. Gateway
Double NAT vs Single NAT: Here’s a cable modem (left), a Wi-Fi router, and a residential gateway.

How to configure an ISP-provided gateway properly

If you live in a small home, chances are the router you have at hand, likely it’s the gateway your Internet provider has installed, is enough for your Wi-Fi need.

If you choose to use it instead of getting your own equipment, you should think about making the most out of it.

Extra: Why you’d want to use an ISP-supplied gateway

While it’s clear that it’s best to use your equipment, there are some benefits to using a gateway provided by your Internet provider.

Here are a few examples:

  • Ease of use: You don’t need to do anything. The provider will set up the home network work for you and manage the hardware, including firmware update, troubleshooting, etc.
  • Less cluttering: You only have one hardware box instead of two. (A retail gateway applies, too.)
  • Hassle-free hardware replacement: If the gateway dies, call the provider, and you’ll get a replacement pronto — all free of charge. The provider also upgrades the equipment when need be.
  • Easy management: With some providers, you can manage certain aspects of your home network, like changing the Wi-Fi password, via your online account. (That is if you’re OK with the potential privacy risks.)
  • Unlimited data cap: Some providers, such as Comcast Xfinity, give you half the cost ($25 vs $50) of unlimited monthly data cap when you use their gateway.

In short, using ISP-proved equipment is not all bad. The benefits are enough to justify the monthly “rental” fee for some.

But in this case, you want to configure that gateway properly. There are a few things you should do. By the way, you can work on a gateway the same way you do a regular Wi-Fi router.

Change the default access to the gateway

All ISP-provided gateway comes with default admin access.

For example, a Comcast gateway’s default password is almost always highspeed — anyone with that knowledge can log into its interface when being part of the network. For security, you should change the password to something else.

Change Password
It’s easy to change a Comcast gateway’s admin password via the link at the interface’s top right corner.

To do that, log in to the gateway’s web interface by pointing a browser to its IP address and log in with the default password (or access code). You can generally find this information on the side or bottom of the device.

Once you’ve logged in, navigate the interface to the area where you can change the password and create a new, more secure one.

Make a meaningful Wi-Fi network

By default, each gateway has a default Wi-Fi network, of which both the name and password are hard to remember or type in, especially when you need to do that on a small screen or via a remote control.

You can give your Wi-Fi network a personalized name and a password that you can remember.

By the way, you can use your name as the SSID (network name), but if you want to stay anonymous, pick anything to your liking. It’s the name that will appear as an available Wi-Fi network on a mobile device.

Again, you can do this via the web interface and follow these guidelines in terms of passwords to keep your system secure.

Customize your gateway

This part is optional, but most gateways have a decent set of features and settings that you can use — the amount varies from one device to another.

Examples include port-forwarding, Dynamic DNS, separating the 2.4GHz Wi-Fi network from the 5GHz, etc. Again, you can use the interface to customize these.

In short, just because you don’t use a standard off-the-shelf router doesn’t mean you can’t make your network with specific advanced settings. Dig into your gateway’s web interface; you might get surprised by how much you can get out of it.

Getting an extender or access point

If you live in a big home and the existing gateway doesn’t cover your entire home with Wi-Fi, it’s time to think about getting extra hardware to improve the coverage.

In this case, you need either an access point (AP) or a Wi-Fi extender. (Not sure which is which? Check out this post on APs and Extenders.)

Extra: Different roles of a home Wi-Fi router

By the way, if you happen to have an old Wi-Fi router lying around, it might come in handy.

That’s because a standard home router generally supports multiple roles. Click the button below to find out more if you’re not aware of that.

The many roles of a home Wi-Fi router

Here’s something you might not know. Your home Wi-Fi router can function more than just a router, which is its default role.

Below is the breakdown of four typical roles of a router. Not all hardware supports all of these, but most will have at least the first one plus another.

Some routers have even more roles — those from Asus, for example, also feature the proprietary AiMesh node role.

Asus Router Operation Roles
Here are the operation roles available in an Asus router. Note the Access Point and Media Bridge, of which the name might be something else in routers of different vendors.

1. Wireless Router

This role is the default — the hardware will work as such unless you actively change that.

The hardware works as a Wi-Fi router that gets the Internet connection then distributes that to the rest of the network via wired and Wi-Fi connections.

In this role, you must use the router’s WAN port for the Internet source. It’s also the only role in which the router’s routing and networking features (QoS, Parental Control, Dynamic DNS, VPN server, port-forwarding, etc.) are available.

Essentially, the hardware is now a standard routing box with a built-in managed switch and Wi-Fi access point(s).

Netgear WAX204 Roles
Here are the traditional roles of a Netgear router.

2. Access Point (AP)

Important note: Certain vendors call this role “Bridge.”

In this mode, the hardware now works as an access point. It connects to an existing router via a network cable and extends the network farther, both wired and wireless.

In this role, none of the routing and features are available. All of the device’s network ports function as LAN ports. Essentially, the router is now a network switch with built-in Wi-Fi broadcaster(s).

By the way, if you have a Wi-Fi 6 router with a Multi-Gig WAN port, using it as an AP is the only way you can take advantage of this port’s high speed locally — without a Gig+ Internet connection, that is — assuming you have a Multi-Gig switch.

TP Link Router Operation Roles
A TP-Link router generally can also work as an access point. It won’t work as a Media Bridge.

3. Repeater

The router now works as a Wi-Fi extender.

Specially, you use one of its bands (2.4GHz, 5GHz, or 6GHz) to connect to an existing Wi-Fi network — this is the backhaul band. After that, you can configure one or all of its bands (including the backhaul band) with separate SSID(s) to serve clients.

In this mode, all of the router’s network ports will work as LAN ports of the existing network.

Linksys Router Operation Roles
Here are the operation roles of a Linksys router. Note that the “Bridge Mode” and “Wireless Bridge” are called “Access Point” and “Media Bridge,” respectively, by other vendors.

4. Bridge or Media Bridge

Important note: Certain vendors — those that use “Bridge” to call the “Access Point” role as mentioned above — name this mode “Wireless Bridge.” There might be other arbitrary names for this role.

In this mode, the router works essentially as a Wi-Fi-to-Ethernet adapter.

Specifically, you use one of its bands to connect to an existing Wi-Fi network. Now, you can connect wired devices to the router’s LAN ports to make them part of the network. (In most cases, you should leave the WAN port alone, but some routers turn this port into another LAN.)

In the Media Bridge mode, the rest of the router’s Wi-Fi bands are unavailable.

Extra: Bridge mode in a gateway unit

In a gateway unit, which is a router + modem combo box, the Bridge mode is a bit different.

That’s when the gateway will work solely as a modem and no longer has any router-related function.

You can read more on this in the post about how to get the most out of ISP-supplied equipment.

With that, let’s find when you should use an access point.

When to get an access point

Get an access point if you can run a long network cable (or a set of power-line adapters) from the gateway to it. Using an AP would be my first choice since it delivers much better performance than an extender.

There are many options for APs, and most of them work similarly. It’s best to use one of the same or better Wi-Fi standards than that of the existing router, but any will work.

You can make the AP’s Wi-Fi network (SSID) with the same name and password as the existing router. In most cases, that’d give you somewhat of a mesh system.

Netgear Tri band Extenders
The EX7500 (left) and EX8000 from Netgear are decent choices for Wi-Fi extenders.

When to get an extender

An extender can quickly extend your Wi-Fi without you having to run a network cable.

Not all extenders are created equal. I’d recommend a tri-band one, such as Netgear EX8000 or Netgear EX7500. A tri-band extender uses one of its bands as the dedicated link to the existing router. As a result, it will give you better Wi-Fi speed than a dual-band counterpart.

Note, though, that using extenders means you get the convenience at the expense of performance. Sometimes, the performance gets so bad the convenience is not even worth it. Also, be mindful of the virtual MAC address issue.

Generally, if you have fast Internet or want to use the Internet for real-time communication applications, such as Voice over IP or video conferencing, an extender won’t cut it. You’ll need to run network cables or at least get a mesh system.

Putting a router on top of another: Double NAT vs single NAT

In this part, you get a new Wi-Fi router (or mesh system) and use it on top of an existing one. That’s when you connect the new hardware to your existing gateway or router.

The hardware setup part is easy: Connect the WAN (Internet) port of the new router — or the primary router unit of your mesh — to a LAN port of the gateway (or the existing router). Now configure your new router to your liking, and you’re all set.

But it’s easier said than done. There are a couple of things to keep in mind.

A different local IP address for each router is required

The first thing is you need to make sure your new router’s local IP address must be different from that of the existing gateway.

This address often appears as the “Default Gateway IP,” but that’s just a naming convention and unrelated to an actual gateway.

Default Gateway IP
You can change the router’s IP via its web interface, shown here as the Default Gateway IP.

It’s relatively rare that you have to worry about them having the same IP. That’s because chances are they are already different by default. More importantly, many routers are smart enough to automatically change their IP (from the default one) when connected to a router (or gateway) that already uses the same one.

If the two share the same IP address — which tends to happen if the new router and the existing one are from the same manufacturers — you’ll note that devices connected to the new router won’t have Internet. There can be other issues, too.

In any case, you can always change a router’s IP using the web interface. It’s in the LAN (or DHCP) area of the router’s interface. This IP is often in the form of 192.168.x.1 or 10.0.x.1 — you just need to change x to a different digit.

With this out of the way, now you’ll end up with one out of two options, double NAT vs single NAT.

What is NAT?

NAT stands for network address translation, which is a significant function of a router.

In a nutshell, NAT allows the router to use a single WAN IP address (provided by the ISP) to deliver Internet access to many connected devices by creating a separate set of local IP addresses for them.

NAT functions like the mailroom of a big office building.

It handles packages between the building and the outside world, allowing everyone inside to share the same shipping address, yet be able to send/receive personal mail and packages.

In this case, the building’s mailing address is the WAN IP and each person’s room number within the building is their local IP address.

That said, each network needs just one router, and, by default, a router always has its NAT turned on. With NAT turned off, a router is now similar to a switch or an access point (if it has Wi-Fi built-in).

Double NAT

Double NAT is when you connect one router to another and let them both function as routers.

Since a gateway is a router itself (plus a modem), you’ll get a double NAT setup when connecting another router to it. Specifically, you have one NAT-enabled router running on top of another that’s also NAT-enabled.

Double NAT Diagram
In a double NAT, devices of private IP address set 1 can’t talk to those of private IP address set 2 at the local level, and your router doesn’t connect to the Internet directly — it does so via the gateway (or the first router.)

Issues with double NAT

The primary problem with double NAT is that devices belonging to each NAT will not communicate locally. That is because each router has its own private set of IP addresses.

For example, if you have a computer that connects to the gateway’s network and a printer that connects to your new router’s network, the computer can’t print to the printer. The two don’t “see” each other. You’ll also have issues with other local services like data sharing, media streaming, network backup, and so on.

All devices can still see one another via the Internet so if you use Internet-based printing, that still works.

Another thing is advanced network settings, such as VPN, port-forwarding, etc., of your new router, will not work as expected, if at all. 

Tips on using double NAT
  • You can still use port-forwarding, but it takes more work. Specifically, you need to program that twice, first open the port in question at the gateway (lower NAT) to the router’s IP address, and then at the router (upper NAT) to the IP address of the destination device.
  • To access the top-level NAT router’s interface over the Internet, set that up as a server port-forwarding entry at the first-level NAT (the gateway) — make sure the two use different ports for remote management.
  • A device of the upper-level NAT can still access another of the lower-level NAT if you use the former’s IP address (instead of its name). The other way around is much harder, if possible at all.

When double NAT works

If all you care about is access to the Internet, then a double NAT setup will work out just fine.

Also, a double NAT setup makes the top-level NAT network — the one hosted by your new router — more secure.

That’s because devices in this network are behind two layers of firewalls and NATs. They are also invisible to those connecting to the lower-level NAT, as mentioned above.

That said, if you want a certain group of devices to be isolated from another group, double NAT is an excellent setup. It’s better than using Guest Wi-Fi networks.

What to do in a double NAT setup

Now that you’re aware of double NAT and still want to use it, there’s just one thing you need to do: make sure you are aware of which network (which NAT, that is) you’re using and connect devices accordingly.

If you just want to use the new router (the top-level NAT) then:

  • Turn off Wi-Fi on the first router/gateway (you can do this via its web interface) and use only the Wi-Fi of your top-level router.
  • Connect all wired devices to the top-level router (and not the gateway) for them to see one another locally.

Mission accomplished.

Of course, you can also use both networks for security or isolation purposes as mentioned above. For example, you can keep the gateway’s Wi-Fi network as a guest network. In this case, make sure it has a different Wi-Fi name (SSID) from the one you use for yourself.

If using a double NAT proves too much work, as it can be for many homes, you should opt for the traditional single NAT route.

Internet or Wi-Fi Speed Test: Netgear CM600 Cable Modem
A standard Single NAT setup: The Internet goes into a modem, which connects to a router.

Single NAT

As mentioned above, if you want to use advanced network features and all devices within your home to talk to one another easily, it’s best to use the single NAT configuration. In this standard setup, your router connects directly to the Internet.

In this case, you have two options. Either you make the gateway forward the WAN IP address to your new router, effectively making it work as a modem. Or you can turn your new router into an access point, which works solely as a switch and a Wi-Fi broadcaster.

Single NAT Diagram
You have just one set of private IP addresses in a single NAT setup, and your router connects to the Internet directly.

Gateway-to-router WAN IP forward

Depending on the gateway you use, the configuration for this varies.

With some, like cable gateways, you need to put the gateway in the Bridge mode. In this mode, a gateway is, in effect, a modem — you’ll get no other features or network settings from it, including Wi-Fi.

With others, like DSL gateways, you need to configure the IP Pass-through and map that to the local IP address of the router.

Again, the objective is to make your router take over the WAN IP, not the gateway’s local (private) IP. In other words, again, the gateway now functions as a modem.

Another option is to use the gateway’s DMZ setting, if applicable, to allow the upper-level router to get unfiltered Internet access. This method is not the same as passing the WAN IP, but it does enable specific services/applications to work.

You can turn a Comcast Xfinity gateway into Bridge Mode using the web interface.
You can turn a Comcast Xfinity gateway into Bridge Mode using the web interface.

And that’s it. You now have a home network almost the same as one built with a modem and a router.

Turning your new router into an Access Point

Most router and Wi-Fi systems can work as an access point (AP) — you can switch the mode via the web interface.

By the way, this AP mode is called “Bridge” in many routers and mesh systems, which makes things a bit confusing as mentioned above.

Router In AP Mode
When in AP mode, your router (or mesh system) extends the existing gateway/router and allows you to have a single NAT setup.

But generally, if you see a router with three roles, router, bridge, and AP, pick the AP mode. If you see only the first two, the bridge mode is likely to be the AP mode.

If your router does not have an AP mode, you can manually turn it into an AP mode by connecting it to the gateway using one of its LAN ports (and not its WAN port — leave this port alone.)


You might want to configure the router’s Wi-Fi network before turning it into an access point. It’s a bit hard, though not impossible, to access its web interface afterward — you’ll need to figure out its IP address via the router unit.

The router — or a mesh system — will work only to extend the network and nothing else in the AP mode. You will not be able to take advantage of its other settings and features. In other words, your network only has the features and settings of the existing gateway (or router).

The takeaway

No matter your Internet situation, chances are you can still customize your home network to your liking. It just takes a bit of work.

In my experience, having to keep the ISP-provided gateway is the most popular situation, so the Gateway-to-router WAN IP forward section above is likely the most applicable to yours. It’s also relevant to most, if not all, Internet plans for a small business.

Comments are subject to approval.

It's generally faster to get answers via site/page search -- your question/comment is one of many that Dong Knows Tech receives daily.  

  1. Strictly no bigotry, profanity, trolling, violence, or spamming -- including unsolicited bashing/praising/plugging a product/brand (•).
  2. You're presumed to have read this page in its entirety, including related linked posts and previous comments -- questions already addressed will likely be ignored.
  3. Be reasonable, attentive, and respectful! (No typo-laden comment, please!)

(•) Per the 💯no-nonsense policy, all comments with an external link are scrutinized, and most links are redacted. Do not leave a comment if you're, in any capacity, representing a company/product mentioned here! Instead, send Dong Knows Tech a private message or use a PR channel.

Thank you!

152 thoughts on “Double NAT vs Single NAT: How to Best Handle an (ISP-Provided) Gateway”

  1. I just switched from Charter to Frontier fiber and I have been hosting my own web server since 2005 and was always able to access my websites until now. Since the switch to fiber, all of my websites time out. But if I check isitdown or pingdom, they say my sites are up. So a friend was also able to load my sites. It’s just me that can no longer see them. This makes it impossible for me to test changes and updates to my sites.
    I tried connecting my router directly to Frontier’s ONT, but I still can’t see my server’s sites. IIS on my server can’t even do Localhost to view the sites. There is simply no way to work with this. I love the 100X faster upstream, but this problem makes it a pyrrolic victory.
    There must be a simple way to make it so I can view my websites so I can maintain them without having to maintain two separate internet services just for that purpose.

  2. Great article Dong,
    You said
    “You want to configure the router’s Wi-Fi network before turning it into an access point. It’s a bit hard, though not impossible, to access its web interface afterward.”

    I cannot find a way to access my Netgear C6300BD after putting into Bridge Mode (by turning off NAT). It works as expected, but I would really like to know how I could talk to its web pages without doing a hardware reset.

  3. So I have a ont, isp modem + wifi (nokia with wifi disabled) and then an asus mesh in a double nat setup.

    The ont is connected to the isp modem with a T1550 cable (fiber optic ). Then isp modem connected to asus mesh via ethernet.

    Is there a adapter or a cable that would allow T1550 to connect to an ethernet port. Then I could get rid of isp modem.

  4. Hi Dong
    I have VZ FIOs and did the double NAT for a few months. We had only two practical issues which caused me to rethink my setup. It was very simple, the VZ FIOs router was set normally. Then I attached a Netgear R8500 normally (not AP mode) with the VZ ethernet port connecting to the R8500 WAN port.
    When surfing the net (all browsers) 25% of the time the page would not load and I would have to refresh. Annoying but once loaded it worked fine.
    The second one was that certain secure pages (login/PW) just would not work at all.
    So being unable to troubleshoot these, I hardwired a FIOs extender and turned on the guest network and went back to single NAT.
    To be sure the double NAT was a much better setup since VZ FIOs does not do the guest network on 5G but only on 2.4g which is much slower. If there is a way to troubleshoot those connect issues I would try again.

    • That seems to be something wrong with the R85000’s settings, Daniel. Maybe its time and date were wrong. Fix that and try testing it, updating its firmware etc.

    • Supposedly yes, but very minor, Moe. Using a separate modem or the gateway in bridge mode is generally better for latency. Note that a modem is DIFFERENT from a gateway. Make sure you read.

  5. Dear Dong

    So if I put the isp gateway in bridge mode, in which device do I need to add the pppoe information – isp gateway or mesh system?

  6. Nice article, thanks for all the useful information. I have a mesh router on top/behind my ISP’s router. I do have some devices hard wired to the ISP’s router, using that address space (“set 1”). Other devices are using the wireless mesh router’s address space (“set 2”). I understood your article to say that devices in one address space would not be able to talk to devices in the other address spaces. I am not finding that to be the case. Ex. a PC in set 1 is able to print to a printer in set 2. I expected this to work, and it does, as that is the job of a router. I may have misunderstood your description in this article? Thanks again.

    • Generally, Rob, no they can’t see each other LOCALLY, but they can via the Internet — just like you and I are communicating right now. So if you do internet-based printing, that’s possible. Also, the top-level NAT can access the lower one when you use the local IP addresses, instead of device names. Also, your mesh router might be working in AP mode. Nothing is black and white. Give the post another series read.

  7. Really informative article!

    1. When you set up an ISP router/gateway in “Bridge mode”, does that mean your new Router (which could be a Mesh router) – connected by ethernet – manages the whole home network even if devices are connected to the original gateway?

    2. Is the following setup possible?

    Internet > ISP gateway (Bridge mode) with Wifi turned off > Mesh system (Brand A) in Bridge mode with Wifi turned on > Router (Brand B) in router mode with Wifi turned on

    As in does the “main Router” have to be the device either plugged in to your ONT, or ISP gateway, or can it be later on in the chain?

    3. Do Mesh systems in general work better in Access Point mode rather than in Router mode in terms of stability and speed?

    Thanks in advance!

    • 1. That’s correct, Brill. The gateway is now just a modem.
      2. In the bridge mode, Wi-Fi is turned off by default, you can’t use anything else of the hardware. For a gateway, it’s now a modem. For a router, it’s now a wireless-to-wired adapter. So your question is a moot point. But you can use either Brand A or Brand B router in the access point mode as mentioned in this post. Make sure you read this section well and pay attention — open the button — since the use of “bridge” and “access point” can be arbitrary. You need to know what it entails in a particular case.
      3. Router mode is always the best. Again, read the link above.

      • Hi Dong, yes I read that section. Sorry I made a typo earlier. Let me try the question again:

        Is this setup possible? (With the “>” representing an ethernet connection)

        Internet (ONT) > Gateway (Bridge mode) > Mesh System Node 1 (Brand A) in Access Point mode, Wifi On > Node 2 of Mesh system (Brand A) > Router/Mesh system (Brand B) in Router mode

        I get that you can have the Gateway in router mode, or something connected to the Gateway (single router, or mesh system) in router mode and place the gateway in bridge mode. I’m just wondering if it’s possible to put a Mesh system (in Access point mode) in BETWEEN the two if that makes sense.

        • No, you can’t, Brill, since an access point must be on top of a router — it can’t work by itself. A router must be at the bottom of a network, if you know what I mean. More in this post. So swap the positions of A and B.

  8. We just changed ISP from 200 Mbps cable to 1 Gbps fiber. Our new ISP provides a free modem/wired router (a DZS ZNID-GPON-2424) which we have to use, that is in bridge mode. Our Netgear r6400 wi-fi router connects to this. The tech that installed everything pointed out that we are getting 956 Mbps down and 948 Mbps up through their router/modem but only 621 Mbps down (936 Mbps up) connected to a LAN port on the r6400. He said we need a newer router. Any thoughts on what we should get? He said something with faster NAT IP to IP routing speed, but I don’t see that spec anywhere.

      • Many thanks for the advice. I now have a Netgear RAX200 and everything is working perfectly. Actually I tried the RAX120 first but ran into a weird problem. The RAX120 worked great for every device we have except for the 2019 16″ MacBook Pro, which is my main computer. It worked fine in Mac OS but I do quite a bit of work in Windows 10 (using Boot Camp) and I was only getting around 90 Mbps download (upload was fine). I tried all the various settings in the RAX120 configuration (fortunately not many) without any improvement. I think there may be some sort of incompatibility between the Boot Camp Windows 10 Broadcom wi-fi driver and the RAX120’s Qualcomm chip set. I got exactly the same problem connecting to our daughter’s Eero 6 Pro, which also uses a Qualcomm chip set.
        Anyway, I exchanged the RAX120 for the RAX200, which has a Broadcom chip set, and now everything is working great.

  9. Hi,

    Great article. I feel like the answer is in this article but I am missing it. I am not that tech savvy. I had a USB memory stick connected into USB port in ISP provided modem/router. I was using as a NAS to share files and record. It has worked great for last 2 years. I recently upgraded to Netgear Mesh RBK13 (no usb ports). I am not able to access my files or recordings as I disabled ISP modem/router IP to allow for true mesh. How can I access my USB on my ISP modem/router?

  10. Wow, what a resource this website is! Thank you all for this great guide! I had one question as it related to a double NAT system: In the following section you state: “Now that you’re aware of double NAT and still want to use it, there’s just one thing you need to do: Turn off Wi-Fi on the first router/gateway (you can do this via its web interface) and use only the Wi-Fi of your top-level router.”

    I am attempting to set up two isolated networks for the security benefits you mention of two firewalls. I was planning on putting the smart tv, playstation etc on the gateway network (router #1), and my personal phone, desktop NAT etc on the downstream router #2. I understand that my trusted phone on router network #2 will not be able to cast or communicate with the tv on router network #1. However, if I had an old phone that I isolated to network #1, theoretically I could use this device to cast and communicate with the smart tv, without giving it access to network/router #2. However, I believe to do this I would need wifi enabled on network #1 in addition to my trusted network #2 (I would still like to use wifi for trusted devices on network/router#2). If these were named differently and had different passwords would this be possible?

    Essentially, I see you state to only have 1 trusted (non-guest) wifi access on a single router in a two router setup. I’m curious if this is for ease of use and avoid accidentally connecting to both, or if there is a fundamental issue with having two wifi signals from two different routers in the house. Thank you!

    • That’s correct, Kyle. It basically means you use the lower NAT as your guest network. More in this post. My recommendation in turning off the lower NAT’s Wi-Fi so that folks don’t accidentally use both and run into trouble. If you’re aware of which is which, you’re in a good spot.

      • Thank you for the Reply Dong,

        The shared link was helpful in understanding that security measures for low value targets like IOT devices mentioned can be more trouble than it’s worth. My limited understanding of how security risks manifest in the network however was that IOT devices on your local network are more easily breached, and if they are within a “trusted intranet” allows the intruder easier access to your more valuable targets like laptops and phones.

        This was the rationale explained to me anyway on why you would want to isolate IOT devices in a guest network to make their exposure less harmful to other devices.

        I am going to be spending more time on your fabulous website. Thank you again for all of the time and thought put into this site!

  11. Hi Dong,

    Thanks for all the rich info.

    I would like to know which setup is a better performance for the single NAT?

    NAT gateway with AP router
    Bridge gateway with NAT router

    I own “Huawei 5G CPE Pro 2” as my 5G gateway and “NETGEAR Orbi RBK50” as WiFi Mesh System.

    I’ve tried both setups. The result was as follows:

    The first setup provided better ping and acceptable downloading speed (12 – 18 ms and around 200 Mbps).

    The second setup provided higher downloading speed but more latency (28 – 33 ms and 300 – 400 Mbps).

    My personal results might be affected by other factors unknown to me.

    That’s why I wanted to know if there are scientific or technical explanation for those results.

    Thanks again,

    • Generally, a bridged gateway + a router is the best since it’s similar to having a modem and a router, Ahmed.

      • But with very fast internet connections, it could be better to keep the NAT on the original gateway because when in bridge mode, it’s generally a software bridge that could not handled the full potential of the connection.

        In my case (8gbits connection) I cannot put my gateway in bridge mode because of that.

        • That’s a very special case, Thieryal. It might need a particular gateway/harware. But the principle remains, you want only the function of a modem there.

  12. This is a continuation of the question I submitted earlier today. About not being able to access devices on my internal network.
    Example: Router A is gateway.
    Router B has static local IP of on Router A.
    Router B internal IP is and is gateway for it’s devices.

    Forwarding inside router A: external start port:55556 external end port:55556 send to IP:

    Forwarding inside router B: external start port:55556 external end port:55556 send to IP:

    What must I do to gain access to the device on router B from the internet? When router B was the only router, access was no problem.

    • Assuming you use the same port for the external and internal sides of the forwarding (on both routers), that should work. If not, make sure you got the correct port. More in this post on Dynamic DNS. You can also put router B in the DMZ of router A. Again, pay close attention. This kind of setting requires exact configuration and is not something you can do loosely and expect it to work.

      • Hi and thank you for the reply.
        In my effort to keep my post short, I omitted many things.
        I have had DDNS for many years. Just as I have had access to all the devices on my network from anywhere in the world for many years. Once I put the new network ahead of the old, I lost all inward contact with the old network from the outside world.

        That is why I asked the question, because nothing I can see should be keeping it from working. I have about thirty devices on the old network. They all still work, still send information out to the internet, as long as I am on that network locally, all is well. One of the main reasons I put the new router in place, is to take advantage of the additional firewall security for the old network. So, putting it in the DMZ would defeat that purpose.

        There is something I’m missing in the setup of the new router. I was hoping you could point me in the right direction.

    • I just found the problem. Still at a loss to solve it. All of the ports that are forwarded in router A are closed in router A. I have always forwarded the desired port in order to open that port. They all show in the router as forwarded and active, yet when tested, they show as closed. I have power cycled the router after deleting and re-forwarding the ports. Still they are closed. Any idea’s?

  13. Hi Doug,
    I have read your article and all the questions. Unless I missed something, I could not find an answer to my question.

    My situation is; I have two networks that I want to keep separate except that they share the same internet. Router A host Router B. All devices on each network work and communicate fine on their respective network. All devices on each network have access to the internet.

    History: Router B has existed for many years as a normal single network. Current network/router A was added lately. Creating a double NAT.

    My problem is that I can’t find a way to access devices on Router B FROM the internet. To accomplish this, I port forwarded all ports needed on router B inside router A. The network port forwarding tables in router B remain the same has they always have. When I try, I get the error message ” Remote device refuses connection”. What have I missed?

    • You missed a couple of things, Jay.

      1. The name.
      2. The Tips of the double-nat section in this post.

      Pay a bit of attention, and you’ll figure it out.

  14. Hi Dong,

    Thanks for a great article. I have FIOS internet and TV (have the latest G3100 router). I have an ASUS router connected to it (FIOS LAN to ASUS WAN via ethernet). I am running into a double nat situation. I read through the article a few times and am not quite sure how to forward the WAN IP from the FIOS router to the ASUS router. I need to keep the FIOS router or else I will lose tv functionality (ie guide DVR etc..). Any ideas on this?



    • You probably can’t if you use the FiOS box also for TV. If not, you can turn it into the bridge mode. Also, get YouTube TV and use FIOS for internet only. You’ll have much better flexibility and likely save some money, too.

      For now, you have to used the Asus router in the AP mode or use double NAT.

      • Thanks – would I be able to use the FIOS router’s DMZ settings to make this work? If I add the ASUS’s WAN IP to DMZ (the ASUS has it’s own firewall, so not terribly concerned about exposing it directly to the internet), would that make this a single NAT network?

          • In the article you mentioned:
            ‘Another option is to use the gateway’s DMZ setting, if applicable, to allow the upper-level router to get unfiltered Internet access. This method is not the same as passing the WAN IP, but it does enable specific services/applications to work.’
            Is that different from what I did? Sorry for all the questions, just trying to wrap my head around all of this.

          • Read that sentence again, Chris. It’s a hack to make certain things work — not a way to fix double NAT. Check out the section about Double NAT in this post again. Take your time and you’ll understand.

  15. Dong,

    Thank you for the great info. I recently switched to Google Fiber/Wi-Fi and so have a gateway that I’ve got set up for port forwarding and that has a few devices connected to it via Ethernet. However, the Google Wi-Fi hub does not have a USB port and I want to continue to access my USB HDD connected to my other router (an ASUS AC-68). Right now, it’s in a double-NAT situation but everything seems to work ok, at least if I only want to access my HDD via LAN (using the ASUS wi-fi connection). Two questions – should I make my ASUS router an AP to avoid the double NAT situation, and if so, will the USB connection still work? I assume if it would still work, I would have to change the IP address to connect.

    Thank you for your help!

    • Yes, K. The Asus’s USB port should still work in the AP mode. And yes, you’ll need to keep tabs on its IP. The Google Wi-Fi has minimal customization via the Google Home app. I haven’t tried the setup you’re imagining, but I think it’ll work.

  16. Hi Dong,
    Excellent article(s), I appreciated the time you take to put the details in.
    For many over 10 years I’ve had unusual setup that is no longer unusual. However things are getting away from me now and I am struggling to figure out a solution. The setup is:
    FIOs G3100 router (now with firmware with several enet connections including a Netgear R8500 (in AP mode) along with a Netgear EX1700 as an extender into a Wi-Fi desert (my office). Additionally, I have the G3100 using only the 2.4g band (5g band turned off since I use the R8500) for my guest network. The guest network, and this is key, using your analogy, is for my in-laws. My in-laws have a few devices and one computer plus a network printer
    All was well until the FIOs G3100 went from firmware 2.x to 3.x this week. Now the guest network does not allow (I can find no way to adjust this) devices on its subnet to see each other. So the printer does not work along with a media sharing device. It is critical to keep the guest network off my intranet because of work.
    So options I am considering based on my limited knowledge is:
    1) Put some type of extender or AP in the apartment with a separate wifi network (double NAT). Any guidance on the best way, if it is possible, to do this?
    2) Double NAT my intranet and allow in-laws to use the regular FIOs wifi. As best I can tell from your article, the problem with this solution is that they, being at the 1st NAT (FIOs), will have access to my intranet but not vise-versa. So this is not an option.
    3) If I could get a contractor (and take on some damage) there is a slight chance I can run a RJ45 (this is a last resort). If I take the RJ45 from the FIOs router and connect it to a new wifi router setup as a double NAT, then I assume that new network will not be able to see my intranet.

    I know I may have misunderstood some of what you wrote and I am sorry to be a burden with such a long note. I do hope you can take a few minutes to guide me (or even correct me).

    Best Regards,

  17. Dong,

    Thanks so much for your quality content. I’ve been reading for hours and have learned so much! I apologize if you’ve covered this question before, but would appreciate your insight.

    We recently completed an addition to our house for my in-laws. We hard wired a coax cable from our ISP panel to their addition, thinking they would create their own network and be independent. Now, they’re thinking they want to create a mesh network so that if they come over to our side of the house they can switch to our network for a stronger signal.

    In reading this article, it seems to me that we would be prohibited from running two routers as a single NAT because having two modems would prevent us from running either router as a bridge. Is that correct? Or is there a way to configure the IP addresses and the SSID of the two routers so that they can create a single NAT?

    If that’s not possible, would I be correct in assuming my options at this point are to run a tri-band wireless mesh, or run a network cable from my router to their addition?

      • Thanks for the reply, Dong. I tried reading it closely, this in particular (regarding APs) is what has me hung up:

        “Get an access point if you can run a long network cable (or a set of power-line adapters) from the gateway to it.”

        Since the network cable running to the addition isn’t connected to the original modem, will the second modem/router combo be able to function as an AP? Said differently, I thought that since there were two separate lines coming into the house that both routers would have to function as routers (and not as a router/AP combo). Is that not the case?

        Thanks again for your help!

        • Looks like you’re confused between modem, router, and gateway, Michael, and I can’t answer your questions if we’re not on the same page in terminologies. That said, start with this post, if you still have questions, I might be able to address them then.

          • Thanks for the link, Dong, that article was helpful. Now I can better articulate my question:

            Is it possible to setup a single NAT when we have two service lines coming in from our ISP?

          • Yes, Michael. But it’s not conventional. You either have to do a special VPN setup or use a dual-wan router.

          • Got it, thanks so much for your help (and your patience while I was figuring out how to ask my question)!


  18. Your explanation and thoroughness of these topics are amazing.

    I’ve got a Wavlink AC3000 wifi mesh system.
    I’m attempting to make it work like AP mode but cannot seem to find success. My end goal is to send video from the internet to a port forwarded port on a computer plugged into any of the mesh devices. Do you know if it’s possible with those devices? The wifi mesh will be plugged into my modem/router from Frontier, but I need to be able to take it to any router and either have the entire mesh be on the same network as the router, or allow traffic to that specific port.

      • Haha, that’s really what I need to know, if it’s even possible. If the real answer is to use different devices, then I’m all for it. Do you recommend any specific wifi meshes? I’ll be connecting cameras to the wifi stations and sending the feed to a computer on the main station. But I also need to send feeds from phones on 4G to that same machine (typically done through a forwarded port). If you’ve got recommendations on wifi meshes that can accomplish this, I’m all ears.

  19. Hi,

    Thank you for all the good work.
    So I just bought Asus Xt8 2 pack and after I´ve set everything up I sa that I could not reach my Plex server from outside my network and that I’m running in double nat.

    Is there no way to fix this without putting the node in AP mode?

        • If Router A connects to Router B then Router A (and all of its connected devices) are on top of Router B, etc. If you don’t understand “that” then I think you need to call a professional, or spend more time on this site and read about IP addresses, routers, switches, etc.

          • Ok it’s like I thought then, just needed to get that verified. So basically if I connect my server to router B then it should work properly?
            Thank you.

  20. Hi Dong,
    After reading your article I am fairly sure I am set up correctly but am still having issues with double Nat on Xbox one?
    My set up is an Archer MR600 on LTE with a Deco m4 mesh run in ap mode ( main deco connected by cable to the modem router , other two decos wireless. I have added the IP address of the Xbox to the routers dmz and restarted all devices. The Xbox shows as open nat but then reverts to double Nat / moderate on next use?? Any ideas , is this a quirk of LTE ??? Help please as I am out of ideas!

    • You don’t want to put the XBOX on DMZ, Paul. Also, make sure you don’t use DHCP on the Deco. Anyhow, considering you mentioned the XBOX’s IP, it’s likely that you have made some weird configuration. I’d recommend restting the Deco and set up first as a router then change it into the AP mode. And that’s it. Don’t mess with anything else.

  21. Hi, I have been reviewing your website and i find your explanations very helpful to the non IT literate people like me! I wonder if you can help me?
    I have a TP-Link Archer VR600v2 modem/router. I have just purchased the Asus CT8 AC3000 wifi mesh. I set that up using the app as a router. I have turned the wifi off on the VR600. Internet is working fine but I get the double NAT/private WAN IP address warning.
    I use some hardwired LAN ports of the modem/router and would prefer to keep these connected rather than use the CT8 LAN ports due to location.
    I do not think my modem/router is capable of working in bridge mode even though it has the option. When I set this and re-set up the CT8 with ISP details the end fails to function. I was wondering if it possible to turn NAT off on the Asus CT8 in order for all of the CT8 clients to have only a single NAT? I have an issue with my satellite TV supplier when trying to connect it to the mesh wifi due to the double NAT. I assume it can’t be that simple?
    Many thanks in advance

    • You need to change your CT8 set into AP mode, Peter — you can do that via the web interface of the router unit, don’t use the app. Check that section of this post for more.

  22. I have an Asus AX86U router and want to use it instead of the ISP, I want it to carry over all the things the ISP does, so I connected it in and all is well but I have a double Nat not even Port Forwarding or Open Nat works, once I disable the Nat from the Asus router no more inet connection and I can’t configure it from my ISP router as it’s not found anywhere in the settings (the ISP router is Huawei), I feel so frustrated as I spent days to figure it out but no use

    • You can’t just disable the NAT function, Ehab. All the options are in the post, read it again, and pay attention. If you want to use your router as a router, you must change your ISP box into the bridge mode if that’s available.

  23. Dong,
    Thank you for all your great posts. This one in particular has really helped. We have a Google Fiber Gigabit + TV service. So our “gateway” if not only a router but also a tv server via MoCa to tv boxes for each tv in the house with also supplies a ethernet port on each tv box, it is also the DVR storage and services the WIFI. Plus each tv box can be turned on as an AP (but 5g only and they are pretty weak.) So we were planning on adding a mesh system to make up for the poor WIFI. The post really helped me realize that the new mesh router most likely needs to be set up in AP mode, since the gateway serves the TVs and their ethernet connections as part of its wired network connections AND many of our wireless devices need to be on the same network to interact with them, plus many other home automation items — a controller, multi-channel amp, tuner, etc. — some of which are on a switch off of one the tv boxes ethernet ports via the wired network’s MoCa feed. Thanks for saving me a lot of potential frustration by installing the new mesh router as a second NAT. Single NAT with the new mesh router in AP mode it will be. With the WIFI on the gateway turned off.

    • You got it correct, Steve. I’d recommend, though, that you quit the cable TV and get YouTube TV instead, that way you’ll have much more freedom in terms of cord-cutting, hardware, DVRing etc.

      • Thanks Dong. We agree, but our early adapter stats gives us such a good price – almost cheaper the same as gig + YouTube TV. So may want to wait till they update Kansas City to 2 gig. Or maybe not.

      • Sorry to chip in… I have a double NAT problem? Hope you could help. My ISP is like wifi line of sight internet it always worked fine until two days ago when I noticed the error. You can surf the internet as normal but when you what to join multiplayer game lobbies it doesn’t allow you. So my setup is a dish with a lan cable to a “p.o.i” or “i.o.p” (its small matchbox size box with a power cable) from the p.o.i a lan cable to a wifi router plugs in the “waw” and fron there a lan cable to my pc and the rest of the devices connect with wifi.
        The double NAT gives me a NAT type strict on my xbox and NAT type moderate on my pc this causes me not to connect to multiplayer lobby.

        I hope you or someone can help….

  24. Hi. I have found your website a refreshing source of information that I have not been able to find elsewhere. So thanks for the quality info.

    I recently set up a Deco X60 mesh system and I am in the process of fixing dead RJ45’s so that I can have a wired back haul. It is attached to an Arris SBG 8300 modem/WiFi/router. As I have learned on your site, I am running in a double NAT environment which is ok for the most part. (I am reluctant to put the mesh in AP mode because the Arris has a horrible management interface…ie. everything is “unknown device.”)

    The problem with double NAT comes in when you want to add smart devices. There is a baby monitor that only runs on 2.4 GHz. It is my understanding that the X60 combines the 2.4/5 GHz bands so the monitor could not see the Mesh to connect. So, I connected to the 2.4 GHz from the Arris. I disabled the 5 GHz. I can view the monitor from the web interface but it uses my cell phone bandwidth. When I want to add a smart doorbell and other things, I will be digging a large 2.4 GHz rabbit hole.

    Am I wrong that smart devices have trouble with mesh? What do you suggest for setting up this network
    Arris SBG 8300
    Deco X60
    Net gear Switch PoE
    I have two Luxul XAP-1510 access points which I suppose could be used if the Mesh were put in AP mode. (Not sure these can be used if in any other mode)

      • Thank you for the response. So I will put Arris is bridge mode which will make it a single NAT and make the Arris a modem only from what I understand.

        Am I correct that I should not use the XAP-1510’s with the Deco?

        • Yes, just read the posts and pay a bit attention, Vicki. As for the XAP, it’s an access point, so it never works “with” anything. APs always work as independent broadcasters. More here. Your question is irrelevant. You can choose to use them or not, depending on your situation.

  25. I’m new to setting up a mesh system I’ve been reading as much as possible. Any help would be appreciated. I recently purchased the Nighthawk Mesh Wifi 6 System to help with some wifi issues in my old house, no wired capabilities. My Comcast/Xfinity is my gateway, which I will be keeping.

    You mentioned that the lights on a gateway will have a steady light.
    On my gateway, the 2.4 and the 5 GHz lights are usually blinking; never a steady light. I have reset it so is there something wrong with my gateway. I can’t seem to get an answer from them.

    After I set up the new router and their satellites and do the updates, am I correct in selecting Bridge Mode on my gateway so the gateway’s router is no longer the router? Is this the same as some people are referring as “turning off” its router function?

    Also, if a Wifi device says it supports dynamic IP (DHCP) addresses only and that I need to ensure the DHCP server option of a router is enabled, do I have to use Nighthawk’s web interface to make these changes because these are settings I have to make after I install this mesh system?

    • The only light that needs to be steady is the signal light, Laura. (More here.) What you saw there was normal. And yes, if you set your gateway into the bridge mode, its Wi-Fi network will be off, too. It’ll work just like a modem. So for your station here’s what you should do (and might have done already):

      1. Setup your mesh in its default role (the main router unit working as a router that is.)
      2. Bridge your gateway.
      3. Connect all devices (wired and wireless) directly to your mesh, and not the gateway

      You’re all set.

      • Thanks very much for your advice. I now feel more confident that I will be able to get this up and going. In setting up the SSID name and password, is it advisable to use the same name and password for the new wifi router as what I used before for the gateway? I think I read that by doing this I won’t have to redo all of the devices that I had set up for the gateway.

        • That’s up to you, Laura. And yes, you won’t need to re-enter the information on existing devices if you keep the SSID and password the same.

          • Hi Dong,
            Found your site this evening, now safely tucked away in my LTE folder!

            We have a 3500 sq ft French stone farmhouse, external and internal walls are 2 ft thick. The adsl internet into the house is dreadful (12mb down /<1mb up), however we have several 4G towers relatively close to the house giving us 35mb down/20mb up.

            We have a Netgear Nighthawk LAX20 4G and a Netgear Nighthawk MK63 (MK60 Router + 2/3 MS60 Sat), I would like to have the MK60 use the LAX20 as a modem/router. Which would be the best way with everything using the same Name/SSID (for TADO/Alarm/Hue Lights etc)? LAN/LAN with (Wireless) AP set on MK60 in advanced tab of Netgear Page?

            Also could I use 2 power lines to have the furthest MS60 talk to the MK60? I also intend to have an additional MS60 (total 3). The LAX20 modem/router is positioned 3/4 (60ft) down house at a Roof Velux to get the best signal, we have 2 x NAS + UPS there.

            Thank you, Vern

          • Dear Dong,
            Blimey that was quick! I’ll have a proper butchers tomorrow morning. Thank you very much. Vern.

  26. Hi Dong, I just found your website yesterday. You supply so much great info it gets dizzying at times. If you’ve covered my question in one of your links I apologize.

    Based upon all of my reading I need a mesh network. I was planning to purchase the NETGEAR Orbi (RBK13) you recommend however noticed that it only comes with a trial subscription to Netgear Armor Powered by Bitdefender. I plan to use my existing AT&T modem and follow your Gateway-to-router WAN IP forward instructions.

    So my question is this. Do I have satisfactory security through my AT&T modem that allowing the subscription to Netgear Armor lapse is not an issue?

    • Happy to have you, Michael. I don’t know what your AT&T gateway can do. Generally, though, such a gateway tends to have no similar protection feature as Netgear’s Armor. But it’s OK to have more than one layer of protection, and the Armor gives you software for use when you’re out and about, too. But Armor itself is optional. You don’t really need it.

  27. Hello!

    I am very frustrated and do not understand pretty much of what is going on. I’m sorry I’m advance for my ignorance.

    I have fiber 1Gb from centurylink. In my home I have a GPON fiber terminal (and two Ethernet cables) just coming out of the side. (Apartment has two Ethernet ports in the bedrooms). The two Ethernet cables are plugged into this “gateway” fiber modem. There is one fiber optic cable that runs and connects inside the gateway (not visible). I’ve had so many issues with lag and network drop outs. I’ve had this gateway from centurylink replaced 6x in 3 years.

    I bought a TPlink ax6000 wifi 6 mesh router, thinking I could just enable “transparent bridge mode” on the century link gateway. I set the new router up (no WLAN port on gateway) in a lan port, WiFi networks set by the new TPLINK had internet access, all is good. Turned on transparent bridge and boom. TP lost internet connection and I could no longer access either routers web GUI. Had to reset both.
    After reading your post, it sounds like they were probably using the same IP (192.168.01).

    Found basically nothing on the internet that actually worked. Someone said enable pppoe on the centurylink gateway (default profile is ipoe, and set the VLAN tagging to 201. Enabled PPPoe on TPLINK and added my credentials. Enabled VLAN on tpLink and added the tagging to 201. Nothing. No connection. IP/DNS/dhcp were all valued at zero.

    I am just at a loss. I’ve spent over 20 hours trying to figure out what the right thing to do — centurylink won’t help, and nothing I’ve read about this centurylink fiber modem/gateway using with a different router has worked. For gaming I cannot use a double NAT. Need a single NAT.

    Again, I don’t know much, and I’ve done as much research that I could find but I don’t see any clear instructions. I’ve read on Reddit some people have done it, but they never explained how, and of course those posts are archived.

    If you could offer up any advice or provide any insight as what may be happening or what I’m probably doing wrong, that would be great. Thank you so much in advance.

    I just need to know if this is a lost cause.

    • Two things, Dianna. This is an EITHER OR.

      1. Leave the gateway alone and use the TP-Link in the Access Point (not bridge) mode. Log in to the router’s web interface, set up its Wi-Fi to your liking then: Advanced -> Operating mode -> Access point mode -> Save.


      2. Change the default IP of the TP-Link router. Advanced -> Network -> LAN. Change the IP to 192.168.x.1 where x can be anything but 0, try 99, so -> Save. Now change the Fios gateway into the bridge mode. Restart them both.

  28. Hi, i have a question.
    Me and my bro are neighbors so he has the main ISP internet contract in his house which came with a wireless (wifi) repeater i have in my house.

    That repeater has no configuration options for changing to AP Mode, Bridge Mode, Port Forwards, or whatever. Not a single one.
    It just lets me chose the wireless network SSID and pasword to connect to, and then broadcasts another signal with a different SSID and password of my liking, with a different set of IP adresses just like the post says.

    No matter what i do, port forward, set on DMZ the repeater (on the main router, the repeater as i said has no options), i can’t just play some games online.

    Any thoughts?

    If he sets his (the main) router to bridge mode, would the devices on HIS house which connect to THAT router no longer be able to get the right IP’s thus he would lose access to the internet?

    Thanks in advance

    • No. You need to get your own Internet plan to get all what you want, Garcia. In your situation, things can improve if you use a network cable to connect to your brother’s network, but even then you cannot expect to change HIS network to fit your own needs. Right now, you’re lucky to get connected at all. 🙂

      • We both pay for it, its just installed in the house he is in, if that’s where you’re coming from.

        Anyway, thanks i guess?
        That was not even a solution.
        I am pretty surprised at you saying that as it’s so obvious i am wondering why you are even mentioning it.

        I am always at a loss of words at you advisors who like telling people to just buy and buy.

        • I’m not an “advisor,” and I answered your question out of kindness. So maybe next time, work on your question first. Or don’t ask if you can’t deal with the answer. For your situation, you’re in a pickle. Unless you can run a cable, there’s no way you can get the Internet AND expect to play games, etc., the way you want. In fact, even when you can run a cable, things can still be pretty hard to set up, especially considering your attitude.

          • Thank you very much for your kind answer.

            And sorry for how i reacted but disrespect (the “lucky” part) should never be acceptable or tollerated.

            A cable would work, if it were possible (i cant have a cable that goes outside and crosses my neighbor’s house, as my bro is in two houses away).

            All i wanted to know was if a router modem alone can work in bridge mode. (That was the main question that should have been addressed).
            Apparently from what i’ve read it can’t however, so yes i’m guessing there’s not much i can do except get a separate plan or get another repeater that actually lets me enter its configuration, because this one is creating a NAT and the firmware is kind of blocked so i can’t change that (i can’t change pretty much anything actually).

            Again, thank you very much for your help and have a good day.

          • The gateway can likely work in the bridge mode. But in that case, your brother will have no Wi-Fi or a network at all. Your best chance is to do a double NAT where your part is the top-level NAT.

  29. Need some advice, not a networking expert but here is my setup

    Have a modem/TV/WiFi box gateway/router combo (HH 3000) from my ISP that provides TV/Internet/WiFi service. DHCP is enabled on the HH3000. There are also 4 LAN ports on it 2 of which are used to connect to my TV receivers and the other 2 are free. The WiFi is not terribly good on the HH3000 so want to set up a mesh router on it.

    I want to use to use the ASUS ZenWiFi AX (XT8) mesh router and connect it to one of the HH3000 Lan ports but don’t want the double NAT scenario if possible but still need to maintain TV service on the HH3000
    while forwarding Internet service to the ZenWiFi

    Have a couple of questions (assuming the HH3000 gateway IP is and Zenwifi gateway IP is

    1) Since the HH3000 doesn’t have a bridge mode, I need to connect the ZenWiFi through pppoe mode on the WAN port to the LAN port of the HH3000 since my ISP supports pppoe. I am assuming the HH3000 now acts as a modem at this point and will just pass a public IP address to the ZenWifi? The HH3000 should still send TV service on the other 2 LAN ports?

    2) Will I have double NAT in this scenario since I have DHCP enabled on the HH3000 and ZenWiFi?

    3) Will the ZenWiFi still work in mesh mode in this scenario

    • Read the post again, Tony, and also related (linked) posts. You can’t figure things out in networking by assuming stuff. You have to know how things work. So pay attention to that and not trying to find a shortcut to where you want.

      1. No. PPPOE is on the HH3000. Just use Automatic IP on the ZenWiFi, or use it in the AP mode.
      2. Yes. But don’t mess around too much. Read #1 again.
      3. Yes. It’ll also work as a mesh if you use it in the AP mode.

      You should use double NAT in your case. It’ll work fine.

  30. Dong,

    Thank you. Your articles have been invaluable to me, a networking novice if ever there was one, as I try to setup a network in my home now that we have cable internet after years with DSL.

    With my home pretty much up and running my attention is now on a structure about 250 feet away. I’ve buried a cat6 cable between my home and this structure.

    There is a Spectrum-supplied gateway in my home. All I want is internet in this second structure and I’m moments away from purchasing an an RT-AX88U (off the strength of your review) to make that happen.

    If I understand this article correctly, for my stated goal of simply bringing the internet into the structure I need to (a) activate bridge mode on my gateway, (b) activate AP mode on the AX88 and (c) plug my freshly-buried cable into a LAN port on my gateway and the WAN port on the AX88. Is that correct?

    Thank you again for sharing your knowledge.

    • C is a must, but you do EITHER a or b, Jordan. Doing both will cause issues. (Take another read at the post!) I’d recommend a, but you can also do a third option: Leave the gateway as is and use the RT-AX88U as a standalone router (default). Now what you have is a double NAT, which is fine if you just care about Internet access. By the way, 250 feet is a bit too long. Depending on the type of cable you use, it might not be able to carry more than 1Gpbs (though it might).

      • Dong,

        Thank you for that.

        I ordered the AX88 but, while I wait for it to arrive, it occurred to me that perhaps I could order a single ASUS XT8 node (this is the mesh system I recently setup in my home) and plug it in at the separate structure using that buried cable I mentioned.

        Potential cable length issues aside, is this feasible?

  31. Centurylink is installing Gigabit Fiber at my home and will provide a Greenwave C4000XG modem/router gateway. I’m also picking up the Asus XD4. Should I use the C4000XG as my primary router and XD4 as satellites, or am I better off setting up my own LAN (double NAT)?

  32. Hi Dong,

    I’m looking to set up NAS (Synology) onto my FIOS Gateway network. Currently looking into one of the Asus Wifi 6 routers to do so. This router is also meant to manage all my devices including gaming. Is Gateway-to-router WAN IP forwarding still the way to go?


  33. Hi Dong, I have been reading all of your wonderful advice to so many. I have a pretty simple situation I think that I was wondering if you could comment on? I have a TP Link C7-AC1750 along with a TP Link RE450 (AC1750) extender to strengthen reach to one end/2nd floor of my home. For the most part everything works very well. The one issue, My son’s room is in the weaker signal area of my home and he’s at home not finishing college. A month ago I ran a Cat 6 Cable directly to his room from the router so he could get a solid/fast signal when he wants to play his games, etc. The Extender signal is just not enough. So I was thinking, the C7 Router works so well and is so cheep, why not buy a 2nd one, set it up on the 2nd floor of our home (as an access Point which is supports) near his room, and get rid of the extender so there is no degrading of the signal strength any more in that part of the house. 2 Questions; 1) does that sound like a good idea to you? and 2) Can I still run a cat 6 cable out of the access point router (on one of the 3 open gig ports) directly to his Gaming PC so there is absolutely no degradation of signal for him? Thanks so much in advance for the kind attention you pay to everyone

    • Stephen,

      1. To me, going “cheap” is never a good idea when it comes to networking, but your choice will work.
      2. Yes. Use the WAN port to connect it to the main router unit and the rest of the LAN ports will work as they are intended to. Wired is almost the best for gaming.

      • Thanks Dong, I probably should have said “inexpensive vs. Cheap!” The AC1750 for $60US works so well for our needs I’m not sure it’s worth spending the additional $100-$200 dollars just yet. I was very surprised that such an inexpensive router would work as well as it does. If I were to spend more, I would probably move up to the TPLink AX50 or the Asus RT-AX3000, or even the ASUS RT-AX86U AX5700 as my main router and use the TPLink AC1750 as the AP. I know those are pretty big steps up, I do have gig-speed wifi service though. I just don’t have any devices beyond AC so I think I’d be future-proofing my network. Do you think I would see much of a performance difference (since my son’s computer that he games with is going to hardwired anyway)? Again, thanks so much. You’re a gem

        • Those are very cheap devices, Stephen. So, yes you will see improvement if you move to higher tier of Wi-Fi. But your son’s (or any wired device) will be the same.

  34. ok. All this makes sense, but I’m Not sure my specific situation will work, so I will try to explain it, and hopefully get your opinion.

    I have an XFi box (Xfinity modem/router). I also have 2 wifi cable boxes, and everything I’ve read says I can’t put the XFi box into bridge mode, otherwise the wifi boxes won’t work.

    With Covid, my wife and I both work from home, and our kids are about to start school virtually. So, there’s going to be a lot of traffic during the day.

    My office is downstairs in the garden basement, with the computer hard wired to the XFi box. So, I’m not too concerned about my situation. The rest of the family will be on wifi, upstairs.

    Our house is a combination of 1940’s and 1990’s, so the wifi signal in the front of the house on the main floor is unreliable.

    So, I was thinking of renaming the XFi network and only having it communicate with the wifi cable boxes. I even think there’s a way to not broadcast the SSID, but still communicate with the wifi boxes (I’ll need to confirm that).

    Now here’s where I am a little unsure. I want to set up a mesh system for all my other devices on a completely separate SSID (preferably my current SSID and pwd so I don’t have to re-establish connection to my 20-30 devices, including light switches, garage, doors, and of course all our wifi devices). I would plug one of the new mesh devices into the XFi box, put one in the middle of the main floor, and a third next to my wife’s computer so she can hard wire into that, thus reducing one extra wifi connection for her. At this point, I’m not sure if I would need to set any router or mesh devices in any particular mode. I don’t really do port forwarding, but sometimes do remote desktop (however, right now that’s not an issue because I work from home right now).

    Everything I’ve been reading, each system has positives and negatives. I’m ok losing the ability to manage devices through the XFi app, as long as I would still have that ability through the mesh devices app. I was thinking of the TpLink Deco Powerline P9. But, if there’s a better option for my situation, I’m all for that.

    Any help would be greatly appreciated, and thanks for all your very informative posts.


    • Your situation is fairly easy, Joel.

      1. Keep the XFi the way it is. If you have TV plan attached to it, it needs to work as a gateway. (Alternatively, though, I’d recommend ditching your Comcast TV and just keep the Internet. Get YouTubeTV instead. In this case, you can get your own modem, and life will be much easier. But that’s another story entirely.)
      2. Get a mesh system. It’s best to hardware it to the gateway via network cables, but if you can’t it’s better to use MoCA than Powerline.
      3. First set up the mesh on top of the gateway (in the double nat setup), make sure you use it with the same SSID (network name) and passwords as those of the XFI.
      4. Now change the mesh into AP mode.

      Now you’re all set.

  35. Hi Dong! I’ve learned a lot by your posts, thanks for sharing your knowledge and in a very structural way.
    A couple of thing I still don’t have clear. It’s about the section “Turning your router into an Access Point”. 1) The image doesn’t indicate if the ISP gateway and my router there can be either ethernet or wireless, can an AP be wireless? [So far I’m planning to use a short ethernet cable for that connection] 2) If I have them side by side, and ISP gateway has it’s own WiFi active, would that impact the seamlessness of the Mesh I’m setting up in AP? I want to know how critical is it to ask ISP to turn the gateway to bridge mode and have the Mesh function as a router / how much do I lose of my product if they can’t do that for me.

    • You made a few assumptions there, Roberto.

      1. By default, AP is always wired, that’s what an AP is. More on that here.
      2. As I mentioned in the post, you want to turn off the Wi-Fi of the gateway unit or use a different SSID.

      • Hey Dong,
        Regarding item 2: I have an ac86u as my gateway, a tplink a6 as an AP, and a tplink AX1500 as another AP. Both APs share SSID with the gateway and both APs have DHCP enabled with different address ranges. It all works fine. Why would turn off the radios in the gateway?

        • That only works fine if all you care about is Internet access, Larry. You’re using a double-NAT setup. Local services might not work if your devices connect to different NATs. Check the double NAT part of the post for more.

          • All of the router/aps are on the same subnet. Only one NAT. Unless, I’m missing something?

          • Nope, I think we just speak two different languages. It looks like you have a single router and two APs, the router is NOT your gateway. And there’s no gateway for you to turn its Wi-Fi off. I’d recommend you read this post so we can be on the same page in terms of terminologies.

          • Thanks, Dong, I should have called my ac86u: The router portion of my modem-router “gateway”. Pardon my confusion. Keep up the excellent work. Your reviews and lessons are enlightening.

  36. Hi Dong, please correct me, but I should care about double NAT problem only if the gateway have PUBLIC IP, right? My ISP doesn’t give me public IP, the ONT modem (first router) only has private IP on 10.xx.xx.xx segment. But anyway, I set second router private IP as DMZ on the modem, any benefit for this DMZ?

  37. Dong,
    Here’s what I did:
    I configured a TPLink A6 as an AP and inserted between the ethternet drop and the Google mesh. Now they can connect to the A6 when they want to print. The signal does not reach all of the mesh area, but enough for them to use.

  38. I think we have to differntiate here. If the router is in WAN mode, its firewall is turned on and one cannot access (at least I cant, I cant even access the login interface of the router, since access from WAN is disabled), if it only NAT you can access… Agree?

    • You can only use a router as a router when it’s working as a router, D. A router can have different roles, some of which will turn it into something else that doesn’t have all the functions it can offer when working as a router.

  39. “A device of the upper-level NAT can still access one of the lower-level NAT if you use its IP address.”

    I am not sure – if this 100 % true? You have to use port forwarding though, typically the second router will block incoming traffic? I cant even ping my 2nd router from the first network…

    • Well, now you can be sure 100%, Nix. Try some Windows-based file sharing from a lower-level NAT device, you’ll be able to access the share via \\The-ip-address\ShareName from an upper-level NAT device. Fort forwarding has nothing to do with this.

      Or you can access the lower-NAT router’s web interface via its IP, from a upper-NAT device. That works.

  40. Dong,
    I live in a grandparents house next to the main house (about 40 yds apart). I have connect the houses with ethernet. Currently I run an asus rt86u in my house with wifi and ethernet connected devices including a printer. At the main house I have a 3 onhub google mesh. Everything works fine, but I would like to enable print to my printer from the mesh system. I thought I could enable ap mode on the onhub, but google says that it would not function as a mesh system. I have never used port-forwarding, but I am willing to try if that will work in my case. Do you have more details on port-forwarding?

    • It’s impossible with the current setup, Larry. That’s because the Google system doesn’t support the AP mode as a mesh system. What you can do is break up the Google system, and set up each of its hardware units as an AP (you can daisy-chain them) with the same Wi-Fi network (name and password) as that your RT-AC86U. That’s a bit of work, and you need to run cables to connect the units, but it will make both houses belong to a single NAT setup. More on that here. Everything will work as expected then.

  41. Great article Dong and very relevant for me. Question on double NAT. You say the local devices won’t be able to detect each other (since some may connect to modem/gateway and some may connect to another router), but your solution seems to solve that issue (disable gateway WiFi, connect only to the router). It’s not clear in the article that your solution solves some of the issues you mentioned with NAT.

    Would gaming features still work with this setup, or for gaming do you recommend setting the gateway to be strictly in “gateway” mode and pass that WAN IP to your own router? My current setup is AT&T gateway (default config) with several routers in AP mode connected to it. Wondering if this will hamper connections on PC and Xbox services/games. Thanks!

    • Cool, Ryan. Glad it applies. The gaming features of the router should work if you don’t have clients using the gateway. Otherwise, those might hog the Internet bandwidth before the outer. Basically, if you don’t use the gateway to serve clients, you’re fine. If you have multiple APs, make sure they connect to the router’s LAN ports, and not those of the gateway.

  42. Any insights on using single NAT on AT&T Fiber? I looked around gateway but could not locate AP or Bridge Mode at first glance.

    • Try to look for something like “IP Passthrough” or “Pinhole”, Luis. I’m not sure about the specifics which change depending on the particular modem but the idea is to pass the WAN IP to the router and believe you can do it with any AT&T modems (both DSL and Fiber). I’ve done this many times before.

  43. Thanks for responding so quickly Dong. Do you have any guides that are for setting up a moca? I tried searching on your site but didn’t find much. BTW i just found your website and i think its great! . I remember you from the CNET days. Sorry if this is too much of a request, i’m doing all the research I can and any advice is much appreciated.

    3 story town home; slim and tall 2k sq feet (probably 18 unit condo association surrounding me.
    Asus RT-86U
    It doesn’t seem to reach my 3rd floor as consistently as I’d like. Unfortunately I don’t think I can set up a wired Ethernet back haul. So i’m considering using moca: Hardware list below
    goCoax MoCA 2.5 adapters. qty 2 (1 for the modem and 1 for the AP) and splitters where needed
    $6 POE filter where coax comes into the house,
    Do you recommend what Asus AP to use in conjunction with the router for AI mesh.? alot of people on Reddit suggest TPlink EAP models, but i want to stay with Asus for AI MESH. As I tend to favor the asus brand.

    I’m also open scrapping what I have, upgrade to wifi 6 mesh products and use my old hardware for my parents house.
    I’m considering the ubiquiti alien +mesh and asus zenwifi systems. but they aren’t in stock due to covid19. Regardless for the mesh to work effectively I’d want MOCA installed anyways and want to make sure i’m setting it up correctly and just looking for any guides you know of.

    • MoCa is very straight forward for a single pair. You have two adapters at two ends of the cable and they will turn the cable into a network cable. Note though, in a home, you might not know where a cable begins and where it ends. Just because you see a cable outlet, doesn’t mean that outlet and the other one where you plug the OTHER MoCA adapter into are connected. If you want to do a MoCA network with multiple nodes, that can get complicated and it’s hard to troubleshoot since we tend to not know how the wires are run. Sometimes, they are even fragmented.

      I’d recommend running network cables instead. In the end, it might be easier than figuring MoCA out in your particular situation. 🙂

  44. Hi Dong, I noticed you don’t mention Moca as an alternative to wired Ethernet and power line when setting up an access point . Any particular reason ?

    • Good catch, Andrew! The reason is MoCA is only available in homes wired with coaxial cables. So it’s not something everyone can relate to. Powerline, on the other hand, is available in virtually all homes.

  45. Typically in Europe, replacing your ROUTER or ISP supplied device is either impossible or impractical without inside knowledge from an ISP worker. For example, at home in Switzerland, Swisscom supplies fibre routers with dumbed down resttriceted logon access and there are sophisticated Public/Private Key encryption keys which you have no access to preventing you simply replacing equipment even if you reverse Engineer the Fibre setting somehow. For Wingo NO logon access at all. What you can of course do, and is to be encouraged is to build an Infrastructure downstream of the ISP device, including an Independent chain of Firewalls, networks and Wifi Access points. And of course if you want to get serious, try Microtik.


Leave a Comment

Ads Block Detector Powered by

😿 Adblocker Detected! (•)

Please allow ads when visiting Dong Knows Tech!
Ads pay for the site's free and 💯 No-Nonsense content.
Thank You!
Wanna go ad-free? Subscribe! Already a member? Log in!
Need help or got "false positives"? Learn more!