NAT and Double NAT Explained for Home Networks

NAT is not the same as a firewall

Consumer routers often provide NAT and stateful firewalling together, so the two are casually treated as one feature. Conceptually they are different: NAT rewrites addressing, while a firewall applies traffic policy.

What is double NAT?

Double NAT happens when one NAT router sits behind another. A common example is an ISP gateway routing 192.168.1.x while a personal router behind it routes 192.168.0.x.

Why it can matter?

Normal web browsing often works fine. Problems are more likely with inbound port forwarding, peer-to-peer applications, some games/consoles, VPNs, and remote-access services because two translation layers must be considered.

Common fixes

If you want your own router to be the main router, see whether the ISP gateway supports bridge/passthrough mode. If you only need better Wi-Fi or extra Ethernet ports, putting the second device in access-point mode may be simpler. Do not change modes without knowing which device will provide DHCP and firewalling afterward.

NAT is translation; firewall is policy

They often coexist but are not the same. IPv4 NAT rewrites address/port mappings; firewall rules decide what traffic is allowed.

Detect double NAT

If the personal router WAN receives a private IPv4 and clients sit behind another private subnet, an upstream router is likely. This can complicate inbound services, gaming and some VPNs.

Fix based on your goal

Use ISP bridge/passthrough if the personal router should own routing, or access-point mode if the second box only needs to provide Wi-Fi/Ethernet. Avoid DMZ/forward-all hacks without understanding exposure.