Double NAT: a mesh system behind your provider’s router

When a mesh system runs as a router behind your provider’s router, both devices translate addresses. This is double NAT. Most browsing still works, but port forwarding, some games and some remote access can fail.

Fix this with your agentCopies a prompt for Claude Code, Codex or any agent that can use Terminal.

My Mac has this problem: Double NAT: a mesh system behind your provider’s router. Read https://kilobat.app/guides/double-nat-mesh.md and work through it with me. Install the Kilobat CLI if it’s missing: brew install seifip/kilobat/kilobat. Run the guide’s Terminal and kilobat checks yourself and tell me what you find. List the steps only I can do. Ask before you change any setting.

Applies to: All current macOS versions. Router menus are from the vendors’ own help pages and differ by model and firmware.Checked: 7 November 2026

Symptoms

The mesh app or a game console warns about double NAT, or shows a strict or moderate NAT type.
Port forwarding on the mesh router has no effect from the internet.
UPnP opens ports on the mesh, but other people still cannot connect to your game or server.
Remote access to a Mac, NAS or camera at home stopped after you added the mesh.
A VPN server at home does not accept connections.
Devices on the provider’s Wi-Fi cannot see the printer or TV on the mesh Wi-Fi.

Likely causes

Two routers do NAT. The provider’s router gives the mesh a private address. The mesh then gives your devices private addresses from a second range.
Port forwards stop at the first router. Incoming connections reach the provider’s router first. A port forward or UPnP mapping on the mesh alone does not get past it.
Two separate local networks. Devices on the provider’s Wi-Fi and devices on the mesh Wi-Fi are on different subnets. Bonjour discovery does not cross between them.
Two DHCP servers. Apple recommends one DHCP server and NAT on one router only. Apple says double NAT can stop devices reaching some resources.

How to check

Find the router that the Mac uses. Note the address after gateway:.
```
route -n get default | grep gateway
```
Trace the first hops to the internet.
```
traceroute -n -m 4 1.1.1.1
```
Output Hop 1 is your mesh router. If hop 2 is also a private address, such as 192.168.1.254 or 10.0.0.1, there is probably a second router at home.
Open the mesh app. Find the WAN or internet address of the main mesh unit.
Compare it with the private ranges 10.x.x.x, 172.16–31.x.x and 192.168.x.x. A private WAN address means double NAT.
An address from 100.64.0.0 to 100.127.255.255 is carrier-grade NAT at the provider. Bridge mode at home does not remove it.

How to fix it

Choose one router to do NAT and DHCP. The other device must only pass traffic or give Wi-Fi.
Option 1: Put the provider’s router in bridge mode. The mesh then gets the public address and stays the router.
On an Xfinity gateway, open the Admin Tool at 10.0.0.1. Choose Gateway > At a Glance, then Enable next to Bridge Mode.
Xfinity says that bridge mode turns off the gateway’s own Wi-Fi, xFi Pods and Xfinity CyberSecure.
On an AT&T gateway, use IP Passthrough. AT&T says that bridged mode is not possible on its gateways.
AT&T documents Firewall > IP Passthrough. Set Allocation Mode to Passthrough and choose DHCPS-fixed.
Enter the mesh router’s MAC address as the Passthrough Fixed MAC Address. Restart the mesh router.
AT&T says that only one device can use passthrough. The gateway’s firewall no longer protects it.
Option 2: Put the mesh in access point or bridge mode. The provider’s router then stays the only router.
On TP-Link Deco, switch the Deco to Access Point mode. TP-Link says that several Decos can then connect by cable.
On eero, open Settings > Advanced networking > DHCP & NAT. Change Automatic to Bridge.
eero says that bridge mode turns off eero Plus features such as Advanced security, ad blocking and content filters.
Google says that Nest Wifi bridge mode works only with a single Wifi device, not a mesh.
For Nest Wifi, Google recommends bridge mode on the provider’s router, or removing that router if the modem is separate.
After either change, restart the Mac’s Wi-Fi. Check that only one private hop remains in traceroute.
If you keep double NAT, set port forwards on both routers. Forward the port to the mesh first, then to the device.

The exact menus for your router, from FRITZ!Box and Xfinity to eero and Livebox: router guides.

With Kilobat

Trace the route with Kilobat. Two private hops at the start mean two routers at home.
```
kilobat trace 1.1.1.1
```
Show where traffic leaves the Mac, and the public address that Cloudflare sees.
```
kilobat ip --public
```
Kilobat reads routes and addresses. It cannot change modes on your router.

Questions

Does double NAT make my internet slower?

Google says that for most people double NAT does not affect Wi-Fi performance. It matters for online games, port forwarding and UPnP.

Which is better, bridge mode on the provider’s router or on the mesh?

Bridge mode on the provider’s router keeps the mesh features, such as security, filters and port forwarding. Bridge mode on the mesh keeps the provider’s features instead.

Why does my mesh still show a private WAN address after IP Passthrough?

Restart the mesh router after the change so that it asks for a new address. Check that the MAC address in the gateway is the mesh router’s WAN port.

Can I fix carrier-grade NAT with bridge mode?

No. Carrier-grade NAT is in the provider’s network. Ask the provider for a public IPv4 address, or use IPv6 where it works.

Sources

Apple Support: Recommended settings for Wi-Fi routers and access points
Google Nest Help: Fix Double NAT when two routers run at the same time
TP-Link: Deco with Existing Router: Router Mode and Access Point Mode
eero Support: What is bridge mode?
Xfinity: Use Bridge Mode on your wireless gateway
AT&T Business Support: Configuring IP Passthrough and DMZplus
traceroute(8) and route(8), man pages installed with macOS 27.2

Checked on 7 November 2026.