Two routers in a row: how to spot double NAT

What the message looks like

Hinter dem zweiten Router klappen Portfreigaben, Spiele oder Fernzugriff nicht / Port forwarding fails behind a second router / Con due router il port forwarding non funziona

Common causes

• The provider's router and your own second router are chained, and both act as routers with their own network.
• The second router gets a private address on its WAN port (for example 192.168.x.x) rather than a public one.
• A port forward was set up only in the second router, not in the first.
• Both routers use the same address range, for example both 192.168.178.x, which confuses connections.

Check

1. Show the default gateway and your PC's address (Windows)
   ipconfig /allCopy
2. Trace the path to the internet. Two private hops at the start suggest double NAT
   tracert example.comCopy
3. Test the first router (address may differ)
   ping 192.168.178.1Copy
4. Test the second router (address from its manual)
   ping 192.168.0.1Copy

Fix

• Check in the second router what address its WAN port has. If it starts with 192.168, 10. or 172.16 to 172.31, you have double NAT.
• Best fix: switch the second router to access point mode (or bridge mode) so the first one does the routing.
• Connect a LAN port of the first router to a LAN port of the second, not its WAN port. The second router's DHCP server is turned off.
• Alternative: set up the port forward in both routers, first to the second router's address, then on to the target device. This is more awkward.
• If both stay in router mode, use different address ranges. Menu names vary with firmware.

FAQ

How do I recognise double NAT?

The WAN address of your second router is a private address. A traceroute also shows two private hops in a row at the start.

Does double NAT hurt normal browsing?

Usually not. Mostly affected are port forwarding, online games, VPN and remote access.