Tuesday, July 27th, 2021 • Welcome to the 💯 No-Nonsense Tech Zone! • 😷 Get Vaxxed 💉!

Double NAT vs. Single NAT: How to Best Handle an (ISP-Provided) Gateway

Ideally, you should use just one router for your home network. But sometimes there’s no choice, like when you have to keep that ISP-provided gateway and yet want to expand or upgrade your system.

Other times, you might want to keep your current router for one reason or another.

Note: A gateway is a single hardware box containing a Wi-Fi router and a modem (or an Internet receiver of any type for that matter) on the inside. That said, within this article, a gateway is, first and foremost, a router.

This post helps you get the home network you want even when you can’t or do not want to replace the existing router or gateway. In the thick of it, it’s about how to use a router (or a mesh system) on top of another — a question of single NAT vs. double NAT.

See also  Cable Modem Explained: How to Swap an ISP-Provided Gateway with One

But depending on your situation, you might need to do something as simple as making the most out of your gateway or getting an access point or Wi-Fi extender.

In any case, before going further, make sure you’re comfortable with setting up a router.

Dong’s note: I first published this piece on December 30, 2018, and updated it on January 16, 2021, with additional relevant information.

Modem vs. Router vs. Gateway
A cable modem (left), a Wi-Fi router, and a residential gateway.

How to configure an ISP-provided gateway properly

If you live in a small home, chances are the router you have at hand, likely it’s the gateway your Internet provider has installed, is enough for your Wi-Fi need.

If you choose to use it instead of getting your own equipment, you should think about making the most out of it.


Extra: Why you’d want to use an ISP-provided gateway

While it’s quite clear that it’s best to use your own equipment (such as a modem and a router), there are some benefits to using a gateway provided by your Internet provider.

Here are a few examples:

  • Ease of use: You don’t need to do anything. The provider will set up the home network work for you and manage the hardware, including firmware update, troubleshooting, etc.
  • Less cluttering: You only have one hardware box instead of two.
  • Hassle-free hardware replacement: If the gateway dies, call the provider, and you’ll get a replacement pronto — all free of charge. The provider also upgrades the equipment when need be.
  • Easy management: With some providers, you can manage certain aspects of your home network, like changing the Wi-Fi password, via your online account. (That is if you’re OK with the potential privacy risks.)
  • Unlimited data cap: Some providers, such as Comcast Xfinity, give you an unlimited monthly data cap when you use their gateway.

In shorts, using ISP-proved equipment is not all bad. For some, the benefits are enough to justify the monthly “rental” fee.


But in this case, you want to configure that gateway properly. There are a few things you should do. By the way, you can work on a gateway the same way you do a regular Wi-Fi router.

Change the default access to the gateway

All ISP-provided gateway comes with default admin access. For example, a Comcast gateway’s default password is almost always highspeed. As a result, almost anyone can log into its interface. For security, you should change this.

Change Password
It’s easy to change a Comcast gateway’s admin password via the link at the interface’s top right corner.

To do that, log in to the gateway’s web interface by pointing a browser to its IP address and log in with the default password (or access code). You can generally find this information on the side or bottom of the device.

See also  IP Address Explained and How to Quickly Figure out Yours

Once you’ve logged in, navigate the interface to the area where you can change the password and create a new, more secure one.

Make a meaningful Wi-Fi network

By default, each gateway has its own default Wi-Fi network, of which both the name and password are hard to remember or type in, especially when you need to do that on a small screen or via a remote control.

You can give your Wi-Fi network a personalized name and a password that you can remember.

By the way, you can use your name as the SSID (network name), but if you want to stay anonymous, pick anything to your liking. It’s the name that will appear as an available Wi-Fi network on a mobile device.

Again, you can do this via the web interface and follow these guidelines in terms of passwords to keep your system secure.

Customize your gateway

This part is optional, but most gateways have a decent set of features and settings that you can use — the amount varies from one device to another.

Examples include port-forwarding, Dynamic DNS, separating the 2.4GHz Wi-Fi network from that of the 5GHz, etc. Again, you can use the interface to customize these.


In short, just because you don’t use a standard off-the-shelf router doesn’t mean you can’t make your network with specific advanced settings. Dig into your gateway’s web interface; you might get surprised by how much you can get out of it.

Getting an extender or access point

If you live in a big home and the existing gateway doesn’t cover your entire home with Wi-Fi, it’s time to think about getting extra hardware to improve the coverage.

In this case, you need either an access point (AP) or a Wi-Fi extender. (Not sure which is which? Check out this post on APs and Extenders.)

Netgear RAX120 Mode
Like this Netgear RAX120, many routers can work as a router, an Access Point, or a Client, and you can switch between the three using their web user interface (or mobile app.)

When to get an access point

Get an access point if you can run a long network cable (or a set of power-line adapters) from the gateway to it. Using an AP would be my first choice since it delivers much better performance than an extender.

There are many options for APs, and most of them work similarly. Make sure you get one of the same or better Wi-Fi standards than that of the gateway.

See also  Mesh Wi-Fi System Explained: How to Best Use Multiple Broadcasters

Also, note that most routers can work in AP mode. So if you have an old router, you can use it, too — more on this below.

Tip: You can make the AP’s Wi-Fi network (SSID) with the same name and password as the existing router. In most cases, that’d give you somewhat of a mesh system.

The EX7500 (left) and EX8000 from Netgear are great choice for Wi-Fi extenders.
The EX7500 (left) and EX8000 from Netgear are decent choices for Wi-Fi extenders.

When to get an extender

An extender can quickly extend your Wi-Fi without you having to run a network cable.

Not all extenders are created equal. I’d recommend a tri-band one, such as Netgear EX8000 or Netgear EX7500. A tri-band extender uses one of its bands as the dedicated link to the existing router. As a result, it will give you better Wi-Fi speed than a dual-band counterpart.

Note, though, that using extenders means you get the convenience at the expense of performance. Sometimes, the performance gets so bad; the convenience is not even worth it. Also, be mindful of the virtual MAC address issue.

Generally, if you have fast Internet or want to use the Internet for real-time communication applications, such as Voice over IP or video conferencing, an extender won’t cut it. You’ll need to run network cables or at least get a mesh system.

Putting a router on top of another: Double NAT vs. single NAT

In this part, you get a new Wi-Fi router (or mesh system) and treat the existing gateway as though it were a modem.

The hardware setup part is easy: Connect the WAN (Internet) port of the new router — or the primary router unit of your mesh — to a LAN port of the gateway (or the existing router). Now configure your new router to your liking, and you’re all set.

But it’s easier said than done. There are a couple of things to keep in mind.

Different local IP address for each router

Your new router’s local IP address must be different from that of the existing gateway. (This address is often referred to as the “Default Gateway IP,” but that’s just a naming convention and unrelated to an actual gateway.)

It’s quite rare that you have to worry about this, though.

That’s because chances are they are already different by default. Many routers are smart enough to automatically change its IP when it connects to a router (or gateway) that already uses the same one.

Default Gateway IP
You can change the router’s IP via its web interface, shown as the Default Gateway IP in the screenshot.

If the two share the same IP address — which tends to happen if the new router and the existing one are from the same manufacturers — you’ll note that devices connected to the new router won’t have Internet. There can be other issues, too.

In any case, you can always change the router’s IP using the web interface. It’s in the LAN (or DHCP) area of the router’s interface. This IP tends to be 192.168.x.1 or 10.0.x.1 — change x to a different digit.

With this out of the way, now you’ll have one out of two options, double NAT vs. single NAT.

What is NAT?

NAT stands for network address translation, which is a significant function of a router.

Among other things, NAT allows the router to use a single WAN IP address (provided by the ISP) to deliver Internet access to many devices connected to it.

That said, each network needs just one router, and, by default, a router always has its NAT turned on. With NAT turned off, a router is now similar to a switch or an access point (if it has Wi-Fi built-in).

See also  IP Address Explained and How to Quickly Figure out Yours

Double NAT

Double NAT is when you connect one router to another and let them both function as routers.

Since a gateway is a router itself (plus a modem), you’ll get a double NAT setup when connecting another router to it. Specifically, you have one NAT-enabled router running on top of another that’s also NAT-enabled.

Double NAT Diagram
In a double NAT, devices of private IP address set 1 can’t talk to those of private IP address set 2 at the local level, and your router doesn’t connect to the Internet directly.

Issues with double NAT

The primary problem with this setup is that devices that belong to each NAT will not communicate with one another locally. That because each router has its own private set of IP addresses.

For example, if you have a computer that connects to the gateway’s network and a printer that connects to your new router’s network, the computer can’t print to the printer. The two don’t “see” each other. You’ll also have issues with other local services like data sharing, media streaming, network backup, and so on.

Another thing is advanced network settings, such as VPN, port-forwarding, etc., will not work as expected, if at all. 


Extra: Pro tips on using double NAT

  • You can still use port-forwarding, but it takes more work. Specifically, you need to program that twice, first at the gateway, and then at the router.
  • To access the top-level NAT router’s interface over the Internet, set that up as a server port-forwarding entry at the first-level NAT (the gateway) — make sure the two use different ports for remote management.
  • A device of the upper-level NAT can still access another of the lower-level NAT if you use the former’s IP address (instead of its name). The other way around is much harder, if possible at all.

When double NAT works

If all you care about is access to the Internet, then a double NAT setup will work out just fine.

Also, a double NAT setup makes the top-level NAT network — the one hosted by your new router — more secure. That’s because devices in this network are behind two layers of firewalls and NATs. They are also invisible to those connecting to the lower-level NAT, as mentioned above.

What to do in a double NAT setup

Now that you’re aware of double NAT and still want to use it, there’s just one thing you need to do: Turn off Wi-Fi on the first router/gateway (you can do this via its web interface) and use only the Wi-Fi of your top-level router.

(Alternatively, you can keep the gateway’s Wi-Fi network as a guest network. In this case, make sure it has a different Wi-Fi name (SSID) from the one you use for yourself.)

After that, connect all of your wired devices to your top-level router and not the gateway so that they can talk to one another locally. Then, mission accomplished.

Internet or Wi-Fi Speed Test: Netgear CM600 Cable Modem
A standard Single NAT setup: The Internet goes into a modem, which connects to a router.

Single NAT

As mentioned above, if you want to use advanced network features and all devices within your home to talk to one another easily, it’s best to use the single NAT configuration. In this standard setup, your router connects directly to the Internet.

In this case, you have two options. Either you make the gateway forward the WAN IP address to your new router, effectively making it work as a modem. Or you can turn your new router into an access point, which works solely as a switch and a Wi-Fi broadcaster.

Single NAT Diagram
You have just one set of private IP addresses in a single NAT setup, and your router connects to the Internet directly.

Gateway-to-router WAN IP forward

Depending on the gateway you use, the configuration for this varies. With some, like cable gateways, you need to put the gateway in the Bridge mode. With others, like DSL gateways, you need to configure the IP Pass-through and map that to the local IP address of the router.

Again, the objective is to make your router take over the WAN IP, not a local (private) IP given out by the gateway. In other words, again, the gateway now functions as a modem.

Another option is to use the gateway’s DMZ setting, if applicable, to allow the upper-level router to get unfiltered Internet access. This is not the same as passing the WAN IP but allows certain services/applications to work.

You can turn a Comcast Xfinity gateway into Bridge Mode using the web interface.
You can turn a Comcast Xfinity gateway into Bridge Mode using the web interface.

And that’s it. You now have a home network almost the same as one built with a modem and a router.

Turning your new router into an Access Point

Most router and Wi-Fi systems can work as an access point (AP) — you can switch the mode via the web interface.

By the way, this AP mode is called “Bridge” in many routers and mesh systems, which makes things a bit confusing. (More on a router’s role in this post.)

Router In AP Mode
When in AP mode, your router (or mesh system) extends the existing gateway/router and allows you to have a single NAT setup.

But generally, if you see a router with three roles, router, bridge, and AP, then pick the AP mode. If you see only the first two, the bridge mode is now likely meant to be the AP mode.

If your router does not have an AP mode, you can manually turn it into an AP mode by connecting it to the gateway using one of its LAN ports (and not its WAN port — leave this port alone.)

Note: You want to configure the router’s Wi-Fi network before turning it into an access point. That’s because it’s a bit hard to access its web interface afterward.

The router — or a mesh system — will work only to extend the network and nothing else in the AP mode. You will not be able to take advantage of its other settings and features. In other words, your network only has the features and settings of the existing gateway (or router).

The takeaway

No matter your Internet situation, chances are you can still customize your home network to your liking. It just takes a bit of work.

In my experience, having to keep the ISP-provided gateway is the most popular situation, so the Gateway-to-router WAN IP forward section above is likely the most applicable to yours. It’s also relevant to most, if not all, Internet plans for a small business.

☕ Appreciate the content? Buy Dong a Ko-fi!

91 thoughts on “Double NAT vs. Single NAT: How to Best Handle an (ISP-Provided) Gateway”

  1. Your explanation and thoroughness of these topics are amazing.

    I’ve got a Wavlink AC3000 wifi mesh system.
    I’m attempting to make it work like AP mode but cannot seem to find success. My end goal is to send video from the internet to a port forwarded port on a computer plugged into any of the mesh devices. Do you know if it’s possible with those devices? The wifi mesh will be plugged into my modem/router from Frontier, but I need to be able to take it to any router and either have the entire mesh be on the same network as the router, or allow traffic to that specific port.
    Thanks!

    Reply
      • Haha, that’s really what I need to know, if it’s even possible. If the real answer is to use different devices, then I’m all for it. Do you recommend any specific wifi meshes? I’ll be connecting cameras to the wifi stations and sending the feed to a computer on the main station. But I also need to send feeds from phones on 4G to that same machine (typically done through a forwarded port). If you’ve got recommendations on wifi meshes that can accomplish this, I’m all ears.

        Reply
  2. Hi,

    Thank you for all the good work.
    So I just bought Asus Xt8 2 pack and after I´ve set everything up I sa that I could not reach my Plex server from outside my network and that I’m running in double nat.

    Is there no way to fix this without putting the node in AP mode?
    Thanks

    Reply
        • If Router A connects to Router B then Router A (and all of its connected devices) are on top of Router B, etc. If you don’t understand “that” then I think you need to call a professional, or spend more time on this site and read about IP addresses, routers, switches, etc.

          Reply
          • Ok it’s like I thought then, just needed to get that verified. So basically if I connect my server to router B then it should work properly?
            Thank you.

  3. Hi Dong,
    After reading your article I am fairly sure I am set up correctly but am still having issues with double Nat on Xbox one?
    My set up is an Archer MR600 on LTE with a Deco m4 mesh run in ap mode ( main deco connected by cable to the modem router , other two decos wireless. I have added the IP address of the Xbox to the routers dmz and restarted all devices. The Xbox shows as open nat but then reverts to double Nat / moderate on next use?? Any ideas , is this a quirk of LTE ??? Help please as I am out of ideas!

    Reply
    • You don’t want to put the XBOX on DMZ, Paul. Also, make sure you don’t use DHCP on the Deco. Anyhow, considering you mentioned the XBOX’s IP, it’s likely that you have made some weird configuration. I’d recommend restting the Deco and set up first as a router then change it into the AP mode. And that’s it. Don’t mess with anything else.

      Reply
  4. Hi, I have been reviewing your website and i find your explanations very helpful to the non IT literate people like me! I wonder if you can help me?
    I have a TP-Link Archer VR600v2 modem/router. I have just purchased the Asus CT8 AC3000 wifi mesh. I set that up using the app as a router. I have turned the wifi off on the VR600. Internet is working fine but I get the double NAT/private WAN IP address warning.
    I use some hardwired LAN ports of the modem/router and would prefer to keep these connected rather than use the CT8 LAN ports due to location.
    I do not think my modem/router is capable of working in bridge mode even though it has the option. When I set this and re-set up the CT8 with ISP details the end fails to function. I was wondering if it possible to turn NAT off on the Asus CT8 in order for all of the CT8 clients to have only a single NAT? I have an issue with my satellite TV supplier when trying to connect it to the mesh wifi due to the double NAT. I assume it can’t be that simple?
    Many thanks in advance

    Reply
    • You need to change your CT8 set into AP mode, Peter — you can do that via the web interface of the router unit, don’t use the app. Check that section of this post for more.

      Reply
  5. I have an Asus AX86U router and want to use it instead of the ISP, I want it to carry over all the things the ISP does, so I connected it in and all is well but I have a double Nat not even Port Forwarding or Open Nat works, once I disable the Nat from the Asus router no more inet connection and I can’t configure it from my ISP router as it’s not found anywhere in the settings (the ISP router is Huawei), I feel so frustrated as I spent days to figure it out but no use

    Reply
    • You can’t just disable the NAT function, Ehab. All the options are in the post, read it again, and pay attention. If you want to use your router as a router, you must change your ISP box into the bridge mode if that’s available.

      Reply
  6. Dong,
    Thank you for all your great posts. This one in particular has really helped. We have a Google Fiber Gigabit + TV service. So our “gateway” if not only a router but also a tv server via MoCa to tv boxes for each tv in the house with also supplies a ethernet port on each tv box, it is also the DVR storage and services the WIFI. Plus each tv box can be turned on as an AP (but 5g only and they are pretty weak.) So we were planning on adding a mesh system to make up for the poor WIFI. The post really helped me realize that the new mesh router most likely needs to be set up in AP mode, since the gateway serves the TVs and their ethernet connections as part of its wired network connections AND many of our wireless devices need to be on the same network to interact with them, plus many other home automation items — a controller, multi-channel amp, tuner, etc. — some of which are on a switch off of one the tv boxes ethernet ports via the wired network’s MoCa feed. Thanks for saving me a lot of potential frustration by installing the new mesh router as a second NAT. Single NAT with the new mesh router in AP mode it will be. With the WIFI on the gateway turned off.

    Reply
    • You got it correct, Steve. I’d recommend, though, that you quit the cable TV and get YouTube TV instead, that way you’ll have much more freedom in terms of cord-cutting, hardware, DVRing etc.

      Reply
      • Thanks Dong. We agree, but our early adapter stats gives us such a good price – almost cheaper the same as gig + YouTube TV. So may want to wait till they update Kansas City to 2 gig. Or maybe not.

        Reply
      • Sorry to chip in… I have a double NAT problem? Hope you could help. My ISP is like wifi line of sight internet it always worked fine until two days ago when I noticed the error. You can surf the internet as normal but when you what to join multiplayer game lobbies it doesn’t allow you. So my setup is a dish with a lan cable to a “p.o.i” or “i.o.p” (its small matchbox size box with a power cable) from the p.o.i a lan cable to a wifi router plugs in the “waw” and fron there a lan cable to my pc and the rest of the devices connect with wifi.
        The double NAT gives me a NAT type strict on my xbox and NAT type moderate on my pc this causes me not to connect to multiplayer lobby.

        I hope you or someone can help….

        Reply
  7. Hi. I have found your website a refreshing source of information that I have not been able to find elsewhere. So thanks for the quality info.

    I recently set up a Deco X60 mesh system and I am in the process of fixing dead RJ45’s so that I can have a wired back haul. It is attached to an Arris SBG 8300 modem/WiFi/router. As I have learned on your site, I am running in a double NAT environment which is ok for the most part. (I am reluctant to put the mesh in AP mode because the Arris has a horrible management interface…ie. everything is “unknown device.”)

    The problem with double NAT comes in when you want to add smart devices. There is a baby monitor that only runs on 2.4 GHz. It is my understanding that the X60 combines the 2.4/5 GHz bands so the monitor could not see the Mesh to connect. So, I connected to the 2.4 GHz from the Arris. I disabled the 5 GHz. I can view the monitor from the web interface but it uses my cell phone bandwidth. When I want to add a smart doorbell and other things, I will be digging a large 2.4 GHz rabbit hole.

    Am I wrong that smart devices have trouble with mesh? What do you suggest for setting up this network
    Arris SBG 8300
    Deco X60
    Net gear Switch PoE
    I have two Luxul XAP-1510 access points which I suppose could be used if the Mesh were put in AP mode. (Not sure these can be used if in any other mode)

    Reply
  8. I’m new to setting up a mesh system I’ve been reading as much as possible. Any help would be appreciated. I recently purchased the Nighthawk Mesh Wifi 6 System to help with some wifi issues in my old house, no wired capabilities. My Comcast/Xfinity is my gateway, which I will be keeping.

    You mentioned that the lights on a gateway will have a steady light.
    On my gateway, the 2.4 and the 5 GHz lights are usually blinking; never a steady light. I have reset it so is there something wrong with my gateway. I can’t seem to get an answer from them.

    After I set up the new router and their satellites and do the updates, am I correct in selecting Bridge Mode on my gateway so the gateway’s router is no longer the router? Is this the same as some people are referring as “turning off” its router function?

    Also, if a Wifi device says it supports dynamic IP (DHCP) addresses only and that I need to ensure the DHCP server option of a router is enabled, do I have to use Nighthawk’s web interface to make these changes because these are settings I have to make after I install this mesh system?

    Reply
    • The only light that needs to be steady is the signal light, Laura. (More here.) What you saw there was normal. And yes, if you set your gateway into the bridge mode, its Wi-Fi network will be off, too. It’ll work just like a modem. So for your station here’s what you should do (and might have done already):

      1. Setup your mesh in its default role (the main router unit working as a router that is.)
      2. Bridge your gateway.
      3. Connect all devices (wired and wireless) directly to your mesh, and not the gateway

      You’re all set.

      Reply
      • Thanks very much for your advice. I now feel more confident that I will be able to get this up and going. In setting up the SSID name and password, is it advisable to use the same name and password for the new wifi router as what I used before for the gateway? I think I read that by doing this I won’t have to redo all of the devices that I had set up for the gateway.

        Reply
        • That’s up to you, Laura. And yes, you won’t need to re-enter the information on existing devices if you keep the SSID and password the same.

          Reply
          • Hi Dong,
            Found your site this evening, now safely tucked away in my LTE folder!

            We have a 3500 sq ft French stone farmhouse, external and internal walls are 2 ft thick. The adsl internet into the house is dreadful (12mb down /<1mb up), however we have several 4G towers relatively close to the house giving us 35mb down/20mb up.

            We have a Netgear Nighthawk LAX20 4G and a Netgear Nighthawk MK63 (MK60 Router + 2/3 MS60 Sat), I would like to have the MK60 use the LAX20 as a modem/router. Which would be the best way with everything using the same Name/SSID (for TADO/Alarm/Hue Lights etc)? LAN/LAN with (Wireless) AP set on MK60 in advanced tab of Netgear Page?

            Also could I use 2 power lines to have the furthest MS60 talk to the MK60? I also intend to have an additional MS60 (total 3). The LAX20 modem/router is positioned 3/4 (60ft) down house at a Roof Velux to get the best signal, we have 2 x NAS + UPS there.

            Thank you, Vern

          • Dear Dong,
            Blimey that was quick! I’ll have a proper butchers tomorrow morning. Thank you very much. Vern.

  9. Hi Dong, I just found your website yesterday. You supply so much great info it gets dizzying at times. If you’ve covered my question in one of your links I apologize.

    Based upon all of my reading I need a mesh network. I was planning to purchase the NETGEAR Orbi (RBK13) you recommend however noticed that it only comes with a trial subscription to Netgear Armor Powered by Bitdefender. I plan to use my existing AT&T modem and follow your Gateway-to-router WAN IP forward instructions.

    So my question is this. Do I have satisfactory security through my AT&T modem that allowing the subscription to Netgear Armor lapse is not an issue?

    Reply
    • Happy to have you, Michael. I don’t know what your AT&T gateway can do. Generally, though, such a gateway tends to have no similar protection feature as Netgear’s Armor. But it’s OK to have more than one layer of protection, and the Armor gives you software for use when you’re out and about, too. But Armor itself is optional. You don’t really need it.

      Reply
  10. Hello!

    I am very frustrated and do not understand pretty much of what is going on. I’m sorry I’m advance for my ignorance.

    I have fiber 1Gb from centurylink. In my home I have a GPON fiber terminal (and two Ethernet cables) just coming out of the side. (Apartment has two Ethernet ports in the bedrooms). The two Ethernet cables are plugged into this “gateway” fiber modem. There is one fiber optic cable that runs and connects inside the gateway (not visible). I’ve had so many issues with lag and network drop outs. I’ve had this gateway from centurylink replaced 6x in 3 years.

    I bought a TPlink ax6000 wifi 6 mesh router, thinking I could just enable “transparent bridge mode” on the century link gateway. I set the new router up (no WLAN port on gateway) in a lan port, WiFi networks set by the new TPLINK had internet access, all is good. Turned on transparent bridge and boom. TP lost internet connection and I could no longer access either routers web GUI. Had to reset both.
    After reading your post, it sounds like they were probably using the same IP (192.168.01).

    Found basically nothing on the internet that actually worked. Someone said enable pppoe on the centurylink gateway (default profile is ipoe, and set the VLAN tagging to 201. Enabled PPPoe on TPLINK and added my credentials. Enabled VLAN on tpLink and added the tagging to 201. Nothing. No connection. IP/DNS/dhcp were all valued at zero.

    I am just at a loss. I’ve spent over 20 hours trying to figure out what the right thing to do — centurylink won’t help, and nothing I’ve read about this centurylink fiber modem/gateway using with a different router has worked. For gaming I cannot use a double NAT. Need a single NAT.

    Again, I don’t know much, and I’ve done as much research that I could find but I don’t see any clear instructions. I’ve read on Reddit some people have done it, but they never explained how, and of course those posts are archived.

    If you could offer up any advice or provide any insight as what may be happening or what I’m probably doing wrong, that would be great. Thank you so much in advance.

    I just need to know if this is a lost cause.

    Reply
    • Two things, Dianna. This is an EITHER OR.

      1. Leave the gateway alone and use the TP-Link in the Access Point (not bridge) mode. Log in to the router’s web interface, set up its Wi-Fi to your liking then: Advanced -> Operating mode -> Access point mode -> Save.

      OR

      2. Change the default IP of the TP-Link router. Advanced -> Network -> LAN. Change the IP to 192.168.x.1 where x can be anything but 0, try 99, so 192.168.99.1 -> Save. Now change the Fios gateway into the bridge mode. Restart them both.

      Reply
  11. Hi, i have a question.
    Me and my bro are neighbors so he has the main ISP internet contract in his house which came with a wireless (wifi) repeater i have in my house.

    That repeater has no configuration options for changing to AP Mode, Bridge Mode, Port Forwards, or whatever. Not a single one.
    It just lets me chose the wireless network SSID and pasword to connect to, and then broadcasts another signal with a different SSID and password of my liking, with a different set of IP adresses just like the post says.

    No matter what i do, port forward, set on DMZ the repeater (on the main router, the repeater as i said has no options), i can’t just play some games online.

    Any thoughts?

    If he sets his (the main) router to bridge mode, would the devices on HIS house which connect to THAT router no longer be able to get the right IP’s thus he would lose access to the internet?

    Thanks in advance

    Reply
    • No. You need to get your own Internet plan to get all what you want, Garcia. In your situation, things can improve if you use a network cable to connect to your brother’s network, but even then you cannot expect to change HIS network to fit your own needs. Right now, you’re lucky to get connected at all. 🙂

      Reply
      • We both pay for it, its just installed in the house he is in, if that’s where you’re coming from.

        Anyway, thanks i guess?
        That was not even a solution.
        I am pretty surprised at you saying that as it’s so obvious i am wondering why you are even mentioning it.

        I am always at a loss of words at you advisors who like telling people to just buy and buy.

        Reply
        • I’m not an “advisor,” and I answered your question out of kindness. So maybe next time, work on your question first. Or don’t ask if you can’t deal with the answer. For your situation, you’re in a pickle. Unless you can run a cable, there’s no way you can get the Internet AND expect to play games, etc., the way you want. In fact, even when you can run a cable, things can still be pretty hard to set up, especially considering your attitude.

          Reply
          • Thank you very much for your kind answer.

            And sorry for how i reacted but disrespect (the “lucky” part) should never be acceptable or tollerated.

            A cable would work, if it were possible (i cant have a cable that goes outside and crosses my neighbor’s house, as my bro is in two houses away).

            All i wanted to know was if a router modem alone can work in bridge mode. (That was the main question that should have been addressed).
            Apparently from what i’ve read it can’t however, so yes i’m guessing there’s not much i can do except get a separate plan or get another repeater that actually lets me enter its configuration, because this one is creating a NAT and the firmware is kind of blocked so i can’t change that (i can’t change pretty much anything actually).

            Again, thank you very much for your help and have a good day.

          • The gateway can likely work in the bridge mode. But in that case, your brother will have no Wi-Fi or a network at all. Your best chance is to do a double NAT where your part is the top-level NAT.

  12. Need some advice, not a networking expert but here is my setup

    Have a modem/TV/WiFi box gateway/router combo (HH 3000) from my ISP that provides TV/Internet/WiFi service. DHCP is enabled on the HH3000. There are also 4 LAN ports on it 2 of which are used to connect to my TV receivers and the other 2 are free. The WiFi is not terribly good on the HH3000 so want to set up a mesh router on it.

    I want to use to use the ASUS ZenWiFi AX (XT8) mesh router and connect it to one of the HH3000 Lan ports but don’t want the double NAT scenario if possible but still need to maintain TV service on the HH3000
    while forwarding Internet service to the ZenWiFi

    Have a couple of questions (assuming the HH3000 gateway IP is 192.168.2.1 and Zenwifi gateway IP is 192.168.1.1)

    1) Since the HH3000 doesn’t have a bridge mode, I need to connect the ZenWiFi through pppoe mode on the WAN port to the LAN port of the HH3000 since my ISP supports pppoe. I am assuming the HH3000 now acts as a modem at this point and will just pass a public IP address to the ZenWifi? The HH3000 should still send TV service on the other 2 LAN ports?

    2) Will I have double NAT in this scenario since I have DHCP enabled on the HH3000 and ZenWiFi?

    3) Will the ZenWiFi still work in mesh mode in this scenario

    Reply
    • Read the post again, Tony, and also related (linked) posts. You can’t figure things out in networking by assuming stuff. You have to know how things work. So pay attention to that and not trying to find a shortcut to where you want.

      1. No. PPPOE is on the HH3000. Just use Automatic IP on the ZenWiFi, or use it in the AP mode.
      2. Yes. But don’t mess around too much. Read #1 again.
      3. Yes. It’ll also work as a mesh if you use it in the AP mode.

      You should use double NAT in your case. It’ll work fine.

      Reply
  13. Dong,

    Thank you. Your articles have been invaluable to me, a networking novice if ever there was one, as I try to setup a network in my home now that we have cable internet after years with DSL.

    With my home pretty much up and running my attention is now on a structure about 250 feet away. I’ve buried a cat6 cable between my home and this structure.

    There is a Spectrum-supplied gateway in my home. All I want is internet in this second structure and I’m moments away from purchasing an an RT-AX88U (off the strength of your review) to make that happen.

    If I understand this article correctly, for my stated goal of simply bringing the internet into the structure I need to (a) activate bridge mode on my gateway, (b) activate AP mode on the AX88 and (c) plug my freshly-buried cable into a LAN port on my gateway and the WAN port on the AX88. Is that correct?

    Thank you again for sharing your knowledge.

    Reply
    • C is a must, but you do EITHER a or b, Jordan. Doing both will cause issues. (Take another read at the post!) I’d recommend a, but you can also do a third option: Leave the gateway as is and use the RT-AX88U as a standalone router (default). Now what you have is a double NAT, which is fine if you just care about Internet access. By the way, 250 feet is a bit too long. Depending on the type of cable you use, it might not be able to carry more than 1Gpbs (though it might).

      Reply
      • Dong,

        Thank you for that.

        I ordered the AX88 but, while I wait for it to arrive, it occurred to me that perhaps I could order a single ASUS XT8 node (this is the mesh system I recently setup in my home) and plug it in at the separate structure using that buried cable I mentioned.

        Potential cable length issues aside, is this feasible?

        Reply
  14. Centurylink is installing Gigabit Fiber at my home and will provide a Greenwave C4000XG modem/router gateway. I’m also picking up the Asus XD4. Should I use the C4000XG as my primary router and XD4 as satellites, or am I better off setting up my own LAN (double NAT)?

    Reply
  15. Hi Dong,

    I’m looking to set up NAS (Synology) onto my FIOS Gateway network. Currently looking into one of the Asus Wifi 6 routers to do so. This router is also meant to manage all my devices including gaming. Is Gateway-to-router WAN IP forwarding still the way to go?

    Thx.

    Reply
  16. Hi Dong, I have been reading all of your wonderful advice to so many. I have a pretty simple situation I think that I was wondering if you could comment on? I have a TP Link C7-AC1750 along with a TP Link RE450 (AC1750) extender to strengthen reach to one end/2nd floor of my home. For the most part everything works very well. The one issue, My son’s room is in the weaker signal area of my home and he’s at home not finishing college. A month ago I ran a Cat 6 Cable directly to his room from the router so he could get a solid/fast signal when he wants to play his games, etc. The Extender signal is just not enough. So I was thinking, the C7 Router works so well and is so cheep, why not buy a 2nd one, set it up on the 2nd floor of our home (as an access Point which is supports) near his room, and get rid of the extender so there is no degrading of the signal strength any more in that part of the house. 2 Questions; 1) does that sound like a good idea to you? and 2) Can I still run a cat 6 cable out of the access point router (on one of the 3 open gig ports) directly to his Gaming PC so there is absolutely no degradation of signal for him? Thanks so much in advance for the kind attention you pay to everyone

    Reply
    • Stephen,

      1. To me, going “cheap” is never a good idea when it comes to networking, but your choice will work.
      2. Yes. Use the WAN port to connect it to the main router unit and the rest of the LAN ports will work as they are intended to. Wired is almost the best for gaming.

      Reply
      • Thanks Dong, I probably should have said “inexpensive vs. Cheap!” The AC1750 for $60US works so well for our needs I’m not sure it’s worth spending the additional $100-$200 dollars just yet. I was very surprised that such an inexpensive router would work as well as it does. If I were to spend more, I would probably move up to the TPLink AX50 or the Asus RT-AX3000, or even the ASUS RT-AX86U AX5700 as my main router and use the TPLink AC1750 as the AP. I know those are pretty big steps up, I do have gig-speed wifi service though. I just don’t have any devices beyond AC so I think I’d be future-proofing my network. Do you think I would see much of a performance difference (since my son’s computer that he games with is going to hardwired anyway)? Again, thanks so much. You’re a gem

        Reply
        • Those are very cheap devices, Stephen. So, yes you will see improvement if you move to higher tier of Wi-Fi. But your son’s (or any wired device) will be the same.

          Reply
  17. ok. All this makes sense, but I’m Not sure my specific situation will work, so I will try to explain it, and hopefully get your opinion.

    I have an XFi box (Xfinity modem/router). I also have 2 wifi cable boxes, and everything I’ve read says I can’t put the XFi box into bridge mode, otherwise the wifi boxes won’t work.

    With Covid, my wife and I both work from home, and our kids are about to start school virtually. So, there’s going to be a lot of traffic during the day.

    My office is downstairs in the garden basement, with the computer hard wired to the XFi box. So, I’m not too concerned about my situation. The rest of the family will be on wifi, upstairs.

    Our house is a combination of 1940’s and 1990’s, so the wifi signal in the front of the house on the main floor is unreliable.

    So, I was thinking of renaming the XFi network and only having it communicate with the wifi cable boxes. I even think there’s a way to not broadcast the SSID, but still communicate with the wifi boxes (I’ll need to confirm that).

    Now here’s where I am a little unsure. I want to set up a mesh system for all my other devices on a completely separate SSID (preferably my current SSID and pwd so I don’t have to re-establish connection to my 20-30 devices, including light switches, garage, doors, and of course all our wifi devices). I would plug one of the new mesh devices into the XFi box, put one in the middle of the main floor, and a third next to my wife’s computer so she can hard wire into that, thus reducing one extra wifi connection for her. At this point, I’m not sure if I would need to set any router or mesh devices in any particular mode. I don’t really do port forwarding, but sometimes do remote desktop (however, right now that’s not an issue because I work from home right now).

    Everything I’ve been reading, each system has positives and negatives. I’m ok losing the ability to manage devices through the XFi app, as long as I would still have that ability through the mesh devices app. I was thinking of the TpLink Deco Powerline P9. But, if there’s a better option for my situation, I’m all for that.

    Any help would be greatly appreciated, and thanks for all your very informative posts.

    Cheers

    Reply
    • Your situation is fairly easy, Joel.

      1. Keep the XFi the way it is. If you have TV plan attached to it, it needs to work as a gateway. (Alternatively, though, I’d recommend ditching your Comcast TV and just keep the Internet. Get YouTubeTV instead. In this case, you can get your own modem, and life will be much easier. But that’s another story entirely.)
      2. Get a mesh system. It’s best to hardware it to the gateway via network cables, but if you can’t it’s better to use MoCA than Powerline.
      3. First set up the mesh on top of the gateway (in the double nat setup), make sure you use it with the same SSID (network name) and passwords as those of the XFI.
      4. Now change the mesh into AP mode.

      Now you’re all set.

      Reply
  18. Hi Dong! I’ve learned a lot by your posts, thanks for sharing your knowledge and in a very structural way.
    A couple of thing I still don’t have clear. It’s about the section “Turning your router into an Access Point”. 1) The image doesn’t indicate if the ISP gateway and my router there can be either ethernet or wireless, can an AP be wireless? [So far I’m planning to use a short ethernet cable for that connection] 2) If I have them side by side, and ISP gateway has it’s own WiFi active, would that impact the seamlessness of the Mesh I’m setting up in AP? I want to know how critical is it to ask ISP to turn the gateway to bridge mode and have the Mesh function as a router / how much do I lose of my product if they can’t do that for me.

    Reply
    • You made a few assumptions there, Roberto.

      1. By default, AP is always wired, that’s what an AP is. More on that here.
      2. As I mentioned in the post, you want to turn off the Wi-Fi of the gateway unit or use a different SSID.

      Reply
      • Hey Dong,
        Regarding item 2: I have an ac86u as my gateway, a tplink a6 as an AP, and a tplink AX1500 as another AP. Both APs share SSID with the gateway and both APs have DHCP enabled with different address ranges. It all works fine. Why would turn off the radios in the gateway?
        Larry

        Reply
        • That only works fine if all you care about is Internet access, Larry. You’re using a double-NAT setup. Local services might not work if your devices connect to different NATs. Check the double NAT part of the post for more.

          Reply
          • Nope, I think we just speak two different languages. It looks like you have a single router and two APs, the router is NOT your gateway. And there’s no gateway for you to turn its Wi-Fi off. I’d recommend you read this post so we can be on the same page in terms of terminologies.

          • Thanks, Dong, I should have called my ac86u: The router portion of my modem-router “gateway”. Pardon my confusion. Keep up the excellent work. Your reviews and lessons are enlightening.

  19. Hi Dong, please correct me, but I should care about double NAT problem only if the gateway have PUBLIC IP, right? My ISP doesn’t give me public IP, the ONT modem (first router) only has private IP on 10.xx.xx.xx segment. But anyway, I set second router private IP as DMZ on the modem, any benefit for this DMZ?

    Reply
  20. Dong,
    Here’s what I did:
    I configured a TPLink A6 as an AP and inserted between the ethternet drop and the Google mesh. Now they can connect to the A6 when they want to print. The signal does not reach all of the mesh area, but enough for them to use.
    Thanks,
    Larry

    Reply
  21. I think we have to differntiate here. If the router is in WAN mode, its firewall is turned on and one cannot access (at least I cant, I cant even access the login interface of the router, since access from WAN is disabled), if it only NAT you can access… Agree?

    Reply
    • You can only use a router as a router when it’s working as a router, D. A router can have different roles, some of which will turn it into something else that doesn’t have all the functions it can offer when working as a router.

      Reply
  22. “A device of the upper-level NAT can still access one of the lower-level NAT if you use its IP address.”

    I am not sure – if this 100 % true? You have to use port forwarding though, typically the second router will block incoming traffic? I cant even ping my 2nd router from the first network…

    Reply
    • Well, now you can be sure 100%, Nix. Try some Windows-based file sharing from a lower-level NAT device, you’ll be able to access the share via \\The-ip-address\ShareName from an upper-level NAT device. Fort forwarding has nothing to do with this.

      Or you can access the lower-NAT router’s web interface via its IP, from a upper-NAT device. That works.

      Reply
  23. Dong,
    I live in a grandparents house next to the main house (about 40 yds apart). I have connect the houses with ethernet. Currently I run an asus rt86u in my house with wifi and ethernet connected devices including a printer. At the main house I have a 3 onhub google mesh. Everything works fine, but I would like to enable print to my printer from the mesh system. I thought I could enable ap mode on the onhub, but google says that it would not function as a mesh system. I have never used port-forwarding, but I am willing to try if that will work in my case. Do you have more details on port-forwarding?
    Larry

    Reply
    • It’s impossible with the current setup, Larry. That’s because the Google system doesn’t support the AP mode as a mesh system. What you can do is break up the Google system, and set up each of its hardware units as an AP (you can daisy-chain them) with the same Wi-Fi network (name and password) as that your RT-AC86U. That’s a bit of work, and you need to run cables to connect the units, but it will make both houses belong to a single NAT setup. More on that here. Everything will work as expected then.

      Reply
  24. Great article Dong and very relevant for me. Question on double NAT. You say the local devices won’t be able to detect each other (since some may connect to modem/gateway and some may connect to another router), but your solution seems to solve that issue (disable gateway WiFi, connect only to the router). It’s not clear in the article that your solution solves some of the issues you mentioned with NAT.

    Would gaming features still work with this setup, or for gaming do you recommend setting the gateway to be strictly in “gateway” mode and pass that WAN IP to your own router? My current setup is AT&T gateway (default config) with several routers in AP mode connected to it. Wondering if this will hamper connections on PC and Xbox services/games. Thanks!

    Reply
    • Cool, Ryan. Glad it applies. The gaming features of the router should work if you don’t have clients using the gateway. Otherwise, those might hog the Internet bandwidth before the outer. Basically, if you don’t use the gateway to serve clients, you’re fine. If you have multiple APs, make sure they connect to the router’s LAN ports, and not those of the gateway.

      Reply
  25. Any insights on using single NAT on AT&T Fiber? I looked around gateway but could not locate AP or Bridge Mode at first glance.

    Reply
    • Try to look for something like “IP Passthrough” or “Pinhole”, Luis. I’m not sure about the specifics which change depending on the particular modem but the idea is to pass the WAN IP to the router and believe you can do it with any AT&T modems (both DSL and Fiber). I’ve done this many times before.

      Reply
  26. Thanks for responding so quickly Dong. Do you have any guides that are for setting up a moca? I tried searching on your site but didn’t find much. BTW i just found your website and i think its great! . I remember you from the CNET days. Sorry if this is too much of a request, i’m doing all the research I can and any advice is much appreciated.

    3 story town home; slim and tall 2k sq feet (probably 18 unit condo association surrounding me.
    Asus RT-86U
    It doesn’t seem to reach my 3rd floor as consistently as I’d like. Unfortunately I don’t think I can set up a wired Ethernet back haul. So i’m considering using moca: Hardware list below
    goCoax MoCA 2.5 adapters. qty 2 (1 for the modem and 1 for the AP) and splitters where needed
    $6 POE filter where coax comes into the house,
    Do you recommend what Asus AP to use in conjunction with the router for AI mesh.? alot of people on Reddit suggest TPlink EAP models, but i want to stay with Asus for AI MESH. As I tend to favor the asus brand.

    I’m also open scrapping what I have, upgrade to wifi 6 mesh products and use my old hardware for my parents house.
    I’m considering the ubiquiti alien +mesh and asus zenwifi systems. but they aren’t in stock due to covid19. Regardless for the mesh to work effectively I’d want MOCA installed anyways and want to make sure i’m setting it up correctly and just looking for any guides you know of.

    Reply
    • MoCa is very straight forward for a single pair. You have two adapters at two ends of the cable and they will turn the cable into a network cable. Note though, in a home, you might not know where a cable begins and where it ends. Just because you see a cable outlet, doesn’t mean that outlet and the other one where you plug the OTHER MoCA adapter into are connected. If you want to do a MoCA network with multiple nodes, that can get complicated and it’s hard to troubleshoot since we tend to not know how the wires are run. Sometimes, they are even fragmented.

      I’d recommend running network cables instead. In the end, it might be easier than figuring MoCA out in your particular situation. 🙂

      Reply
  27. Hi Dong, I noticed you don’t mention Moca as an alternative to wired Ethernet and power line when setting up an access point . Any particular reason ?

    Reply
    • Good catch, Andrew! The reason is MoCA is only available in homes wired with coaxial cables. So it’s not something everyone can relate to. Powerline, on the other hand, is available in virtually all homes.

      Reply
  28. Typically in Europe, replacing your ROUTER or ISP supplied device is either impossible or impractical without inside knowledge from an ISP worker. For example, at home in Switzerland, Swisscom supplies fibre routers with dumbed down resttriceted logon access and there are sophisticated Public/Private Key encryption keys which you have no access to preventing you simply replacing equipment even if you reverse Engineer the Fibre setting somehow. For Wingo NO logon access at all. What you can of course do, and is to be encouraged is to build an Infrastructure downstream of the ISP device, including an Independent chain of Firewalls, networks and Wifi Access points. And of course if you want to get serious, try Microtik.

    Reply

Leave a Comment