Bridge Mode and Double NAT: Own Router With an ISP Gateway

When you plug your own router or mesh system into the gateway your internet provider supplied, you can end up with two routers doing the same job, which is called double NAT. It often goes unnoticed, but it can trigger game console warnings and make some features misbehave. The fix is to let only one device route: put the provider’s gateway in bridge mode, or, if it can’t be bridged, put your own router in access point mode.

This is a how-to based on Xfinity, eero, Netgear and TP-Link support documentation. We have not tested these setups ourselves, and menu names vary between models.

What is double NAT?

NAT stands for Network Address Translation. Your internet provider gives your home one public address. Your router hands each device a private address, and NAT translates between the two so all your devices can share the connection. Eero describes it as a way for several devices to share one public IP address.

A provider gateway is a single box that combines a modem and a router. If you connect your own router behind it, and both keep routing, traffic is translated twice: that is double NAT. Eero describes it as two routers performing NAT, which creates two separate networks.

Does double NAT cause problems?

Sometimes. Web browsing, streaming and video calls usually work, because those connections start from your device. Problems show up with things that need devices to reach each other or accept connections from outside:

• Game consoles. Xbox support lists “Double NAT detected” as one of the errors that can stop party chat and multiplayer from working.
• Two networks with the same name. Eero warns that running two networks with the same Wi-Fi name at once “will lead to technical complications.” Devices can join the gateway’s Wi-Fi and lose sight of devices on yours.
• General reliability. TP-Link says double NAT can cause “connectivity and performance issues.”
• Port forwarding. With two routers, a port has to be opened on both, which is easy to get wrong.

Eero also points out that double NAT has one upside: it lets you set up a new system quickly without changing the provider’s equipment. Some setups start that way and fix it afterward.

How do I check whether I have double NAT?

Open your own router’s app or admin page and find its internet (WAN) address. If it begins with 192.168., 10. or anything from 172.16. to 172.31., your router is getting a private address from the device in front of it, which usually means double NAT. Those three ranges are reserved for private networks by RFC 1918, the internet standard that defines them. Treat this as a strong hint rather than proof: some providers run their own network-level NAT, which can also leave your router without a public address.

On an Xbox, Xbox support says the NAT type and any “Double NAT detected” message appear under Profile & system, Settings, General, Network settings.

How do I fix it: bridge mode or access point mode?

Pick one device to do the routing.

The router makers’ own guidance leans toward bridging the gateway:

• Eero recommends putting the modem-router combo in bridge mode for the best performance and access to all eero features.
• TP-Link recommends bridge mode on a combined modem-router to avoid double NAT when adding Deco.
• Netgear prefers bridge mode on the provider gateway. If that isn’t possible, it says “you must turn its WiFi off and put your Orbi or Nighthawk router in AP mode,” and notes that “some router features are disabled in AP mode.”

How do I put an Xfinity gateway in bridge mode?

Xfinity documents these steps for its gateways:

1. On a device connected to your home network, go to the Admin Tool at http://10.0.0.1. You may need to allow Admin Tool access in the Xfinity app first.
2. Sign in with the username admin and the password on the sticker on the gateway, unless you changed it.
3. Go to Gateway, then At a Glance.
4. Next to Bridge Mode, click Enable, then OK at the warning. The gateway may restart.
5. Connect your own router to any Ethernet port on the gateway.

Things Xfinity says to know first:

• Only one device can be connected to the gateway while it is in bridge mode.
• You can still use the Xfinity app to manage your account, but not to manage and personalize your network or use WiFi Extenders.
• Xfinity CyberSecure isn’t available in bridge mode, and you can’t enable bridge mode if you have already activated WiFi Extenders.
• Bridge mode doesn’t turn off the Xfinity WiFi Home Hotspot feature on gateways that have it.
• To turn bridge mode off later, the device you use must be connected to the gateway by Ethernet.

Other providers’ gateways may work differently. Check your provider’s help pages.

When would I bridge my own router instead?

Usually, you wouldn’t; it’s the provider’s gateway you bridge. But eero lists cases where its own system may need to be bridged and the provider’s equipment kept as the router: if your provider is AT&T U-verse and its equipment provides Wi-Fi and addressing, if your provider requires PPPoE (a login-based connection type), or if your provider requires a specific MAC address that matches its own equipment. Eero notes that eero Pro 6 and eero 6 now support PPPoE.

Eero says that in bridge mode you “won’t be able to manage your network’s advanced features through the eero App,” and that eero Plus features including Advanced Security, Ad Blocking and Content Filters don’t work properly. To set it, eero’s path is Settings, Advanced networking, DHCP & NAT, then switch from Automatic to Bridge.

A setup checklist

1. Decide which device routes. Usually your own router, with the gateway bridged.
2. Bridge the gateway or, if it can’t be bridged, set your router to AP mode. Not both.
3. If you can’t bridge, turn off the gateway’s Wi-Fi. TP-Link advises against giving the gateway and your system the same network name.
4. Wire correctly. TP-Link says not to connect more than one Deco directly to the existing router in Router mode, because it can create a network loop.
5. Check the result. Your router’s WAN address should now be a public address, not one starting with 192.168., 10. or 172.16 to 31. Run the network test on any game console.

If you are still deciding whether to keep renting the gateway at all, see buying your own router vs. using your provider’s. For console NAT types, see our WPS and UPnP guide and gaming router guide. For choosing the system you’ll plug in, see router vs. mesh.

Fact-check notes

Bottom line

Two routers in a row works, but it isn’t tidy. Bridge the provider’s gateway so your own router does the routing, and accept that the gateway’s extra features go away. If the gateway can’t be bridged, turn off its Wi-Fi and put your router in AP mode. Then check your router’s WAN address and your console’s NAT type to confirm the fix.