Double NAT and Game Servers: How to Spot It and Fix It

Double NAT happens when two routers sit in a row, usually an ISP modem router with your own router or mesh plugged into it. Your port forward on the inner router never sees outside traffic, because the outer router drops it first. You can confirm it by checking your router's WAN IP: if it is a private address like 192.168.0.x or 10.0.0.x, you have double NAT. Fix it by putting the ISP device in bridge or passthrough mode, putting your own router in access point mode, or forwarding the port on both routers.

Why double NAT breaks game servers

Each router that does NAT keeps its own list of which inside device should get which incoming port. With two routers:

1. A friend's packet arrives at the ISP router on your public IP.
2. The ISP router has no forward for that port, so it drops the packet.
3. Your own router, where you carefully set up the forward, never sees anything.

Outgoing traffic works through both layers, which is why everything else in the house seems fine. Consoles may show a "Strict" or "Type 3" NAT, and game servers become unreachable from outside.

Step 1: confirm it

Sign in to the router your PC connects to (the one you set the forward on) and find its WAN, Internet or Uplink IP.

You can also run tracert 8.8.8.8 on the server PC. If the first two hops are both private addresses (for example 192.168.68.1 then 192.168.1.254), you have two routers.

Step 2: pick a fix

Fix A: bridge or passthrough mode on the ISP device (best)

The ISP box stops routing and hands the public IP straight to your router. One NAT layer, one place to forward ports, and your router's features keep working.

What it is called per ISP:

Step by step guides: Xfinity, Cox, AT&T BGW320, Verizon Fios.

After switching, restart your own router and check that its WAN IP now matches your public IP. Then turn off Wi-Fi on the ISP box if it still broadcasts.

Fix B: access point mode on your own router

If you cannot or do not want to change the ISP box, turn your own router into a Wi-Fi access point. It stops doing NAT and the ISP router hands out addresses for the whole house. You then forward ports only on the ISP router.

• TP-Link Deco: More, Advanced, Operation Mode, Access Point.
• eero: Settings, Network settings, DHCP & NAT, Bridge.
• Google Nest Wifi: bridge mode in the Google Home app network settings.
• ASUS: Administration, Operation Mode, Access Point (AP) mode.

You lose router features like parental controls, QoS and the mesh app's device controls, because the ISP router is now in charge.

Fix C: forward on both routers

Leave everything as it is and add two rules:

1. On the ISP router, forward the game's port to your router's WAN IP (the private address from Step 1).
2. On your router, forward the same port to the server PC's local IP.

It works, but every new game means changing two routers, and if the ISP router gives your router a new address the first rule breaks. Reserve your router's address on the ISP router to avoid that.

Fix D: DMZ on the ISP router (acceptable here)

DMZ is normally a bad idea for a PC, but pointing the ISP router's DMZ at your own router's WAN IP is a common and reasonable fix. All unsolicited traffic goes to your router, which still has its own firewall and only passes the ports you forward. It is a shortcut for Fix C when bridge mode is not available.

Step 3: test

1. Start the server.
2. From a phone on mobile data, connect to your public IP and port, or ask a friend to join.
3. For TCP games a port checker works while the server runs. For UDP games, use the methods in how to test if a UDP port is open.

If it still fails, the next suspects are the PC firewall and the protocol on the rule. Our port forwarding guide lists the right protocol for every game we host.

Triple NAT and other surprises

• Mesh satellites set to router mode. Some people end up with three layers: ISP box, main mesh, and a satellite accidentally set as a router. Only one device should route.
• Travel routers and powerline kits with routing turned on do the same thing.
• Apartment buildings often provide internet through a building router you cannot access. Your router behind it has a private WAN and there is no bridge mode to ask for. Treat it like CGNAT and use a tunnel or an outside host.
• UPnP does not help with double NAT. It only talks to the router directly above the PC. See UPnP not working for a game server.

Or skip both routers

Every fix above is about getting traffic through your house. A hosted server has a public address with the game's ports already open, so there is no NAT on your side at all. On GamezServers the server is live about a minute after checkout for most games, you manage it in a web panel, and nobody who joins sees your home IP. Look at instant game server hosting.

FAQ

Is double NAT bad for gaming?

For playing online, usually only mildly: you may see a strict NAT type and have trouble with voice chat or hosting lobbies. For hosting a server it is a hard block until you fix it.

How do I know if my modem is also a router?

If it has Wi-Fi or more than one Ethernet port for devices, it is almost certainly a router. Pure modems have one Ethernet port and no Wi-Fi.

Will bridge mode slow down my internet?

No. It removes a layer of processing. The only thing you lose is the ISP box's Wi-Fi and features.

Can I fix double NAT without access to the first router?

Not for port forwarding. If you cannot change the outer router, use a tunnel like playit.gg or host the server elsewhere.