Double NAT is two devices in a row each performing address translation, which happens when a provider’s box routes and your own router routes behind it. For ordinary browsing it changes nothing; for anything that has to be reachable from outside it changes a great deal.
It is one of those arrangements that is invisible until the day something has to reach in from outside, and then it is the whole explanation.
What is happening
Address translation lets many devices inside a network share one address on the outside. A router does it as a matter of course.
Double NAT is simply that happening twice. The provider’s box translates between the line and its own internal network; your router, plugged into that box, translates again between it and your network. Traffic going out passes through both, which works perfectly. Traffic trying to come in has two doors and only ever gets told about one.
When double NAT does not matter
Browsing, streaming, messaging, updates, backups to a remote service — anything the inside starts. These are all outbound connections, and the return path is set up by the translation on the way out. A household that only does these things can live behind two layers indefinitely and never notice.
When double NAT does matter
Port forwarding. A rule on your router sends an incoming connection to a machine inside. But nothing outside can reach your router in the first place unless the provider’s box has a matching rule sending traffic on to it. One rule without the other does nothing, silently.
Remote access to a network enclosure. Most makers offer a relay service that sidesteps the problem; direct access needs both layers configured.
Automatic port opening. The protocols that let an application request a port only speak to the nearest router. The outer one never hears about it.
Some games and voice applications, which are the loudest reporters of the condition because they announce it by name.
The three ways out
Bridge or modem mode on the provider’s box. It terminates the line and stops routing, your router does everything, and there is one layer. Where the provider offers it, this is the clean answer, and the provider’s own support documentation is where to find out whether it is offered.
Your router as an access point. Turn off routing and address handing on your own unit and let the provider’s box be the single router. The provider’s box now governs the network, which may or may not be acceptable.
Send everything through. Some provider boxes can direct all unsolicited incoming traffic to one internal address — put your router there and rules on it become effective. This is the workaround rather than the fix, and it behaves differently between makers.
Deciding whether to bother
If nothing needs to be reachable from outside, the arrangement is harmless and unpicking it is work for nothing.
If something does — a remote share, a service you run, an application that keeps complaining — then dealing with it once is far better than maintaining matching rules in two places for years. Whichever way it is resolved, write down what was changed, because the next person to look at that network will be you, and it will be a long time from now.
The questions that come up before an order
How can I tell whether I have it?
Look at the address your router shows on its outside interface. If it is an address from one of the private ranges rather than a public one, something in front of it is already translating. Your router’s status page shows it, and so does the provider box’s own list of connected devices.
Is it a security problem?
Not in itself, and it is sometimes described as though it were an advantage. It is a configuration problem rather than a safety one: two layers means two places where a rule has to exist, and rules that exist in only one of them silently do nothing.
Last reviewed 10 September 2026