Double NAT

One router that translates addresses is a doorman. Two in a row are two doormen who never talk to each other, and your visitor has to convince both.

The short answer

Double NAT means two devices in a chain translate network addresses, typically your own router behind the router or modem-router from your provider. NAT (network address translation) maps private addresses to a public one [1][2]. For outgoing traffic such as browsing, double NAT usually changes nothing you notice. It becomes a problem when something must reach you from outside, for example a game server or a peer-to-peer game, because the inbound connection has to get through both layers [1][5]. Our assessment: avoid it if you can, and if you cannot, forward the port on both routers or move one of them out of the way.

How it works

1. NAT is outbound by design. In traditional NAT, sessions are unidirectional and start inside the private network. Sessions in the opposite direction are possible on an exceptional basis using static address maps for chosen hosts [1].
2. Private on both sides. RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for private networks [2]. In a double NAT the WAN side of your second router has such a private address, because the first device owns the public one. Our reading: if your router's WAN address is private, another NAT sits in front of it.
3. Not the same as CGN. Providers use the shared address space 100.64.0.0/10 on the link between their carrier-grade NAT (CGN) and your device [3]. If your WAN address lies there, the second NAT is at your provider and you cannot fix it with your own router settings. That is a different problem from two routers at home.
4. What breaks. The OpenWrt documentation says double NAT does not hurt basic tasks like browsing, but it can cause problems when you host servers that should be reachable from the internet or when you play peer-to-peer games, which often use UDP hole punching [5].
5. Fix one: remove a layer. NETGEAR advises to remove the first router, to put the first router or the provider gateway into bridge mode, or to put your own router into access point (AP) mode. Some router features are disabled in AP mode [4]. OpenWrt describes bridge mode as a pass-through where the provider device stops doing NAT, firewall and DHCP [5].
6. Fix two: route instead of translate. You can disable NAT on the second router, but then both routers need non-overlapping address ranges and static routes in both directions [5].
7. Intentional cascades. AVM notes that an exposed host can make sense when you run another router with its own firewall behind the FRITZ!Box [6]. Our entry on exposed hosts explains this setting and its risk.

A practical example

Router A from your provider has the LAN 192.168.178.0/24. Your own router B has the WAN address 192.168.178.2 and the LAN 192.168.10.0/24. The WAN address of B is private, so this is double NAT. A server at 192.168.10.20 listens on TCP port 8080 (example). To reach it from outside, you forward port 8080 on A to 192.168.178.2 and on B to 192.168.10.20. Each hop needs its own rule, which follows from the static mapping in RFC 3022 [1]. We have not documented a router chain in our inventory (14 to 16 Oct 2026), so this is a generic walk-through.

Checklist

• Read the WAN address of your second router and compare it with the private ranges [2].
• Check for 100.64.0.0/10, which points to provider-side CGN [3].
• Ask the provider or read the manual about bridge mode before you add rules [4][5].
• Try AP mode on the second router if you only need Wi-Fi and switch ports [4].
• Forward the same port on every router in the chain, one hop at a time [1].
• Keep address ranges different on each side, so routes do not clash [5].