---
title: "Double NAT with a mesh behind the ISP router: how to tell and fix it · Kilobat Guides"
url: "https://kilobat.app/guides/double-nat-mesh"
description: "A mesh system behind your provider's router can create double NAT. See what it breaks, how to spot it from a Mac, and when to use bridge or passthrough mode."
---

# Double NAT: a mesh system behind your provider’s router

When a mesh system runs as a router behind your provider’s router, both devices translate addresses. This is double NAT. Most browsing still works, but port forwarding, some games and some remote access can fail.

**Fix this with your agent**Copies a prompt for Claude Code, Codex or any agent that can use Terminal.

My Mac has this problem: Double NAT: a mesh system behind your provider’s router. Read https://kilobat.app/guides/double-nat-mesh.md and work through it with me. Install the Kilobat CLI if it’s missing: brew install seifip/kilobat/kilobat. Run the guide’s Terminal and kilobat checks yourself and tell me what you find. List the steps only I can do. Ask before you change any setting.

Applies to: All current macOS versions. Router menus are from the vendors’ own help pages and differ by model and firmware. · Checked: 7 November 2026

## Symptoms

- The mesh app or a game console warns about double NAT, or shows a strict or moderate NAT type.
- Port forwarding on the mesh router has no effect from the internet.
- UPnP opens ports on the mesh, but other people still cannot connect to your game or server.
- Remote access to a Mac, NAS or camera at home stopped after you added the mesh.
- A VPN server at home does not accept connections.
- Devices on the provider’s Wi-Fi cannot see the printer or TV on the mesh Wi-Fi.

## Likely causes

- **Two routers do NAT.** The provider’s router gives the mesh a private address. The mesh then gives your devices private addresses from a second range.
- **Port forwards stop at the first router.** Incoming connections reach the provider’s router first. A port forward or UPnP mapping on the mesh alone does not get past it.
- **Two separate local networks.** Devices on the provider’s Wi-Fi and devices on the mesh Wi-Fi are on different subnets. Bonjour discovery does not cross between them.
- **Two DHCP servers.** Apple recommends one DHCP server and NAT on one router only. Apple says double NAT can stop devices reaching some resources.

## How to check

1. Find the router that the Mac uses. Note the address after `gateway:`.

   ```
   route -n get default | grep gateway
   ```
2. Trace the first hops to the internet.

   ```
   traceroute -n -m 4 1.1.1.1
   ```

   Output Hop 1 is your mesh router. If hop 2 is also a private address, such as 192.168.1.254 or 10.0.0.1, there is probably a second router at home.
3. Open the mesh app. Find the WAN or internet address of the main mesh unit.
4. Compare it with the private ranges 10.x.x.x, 172.16–31.x.x and 192.168.x.x. A private WAN address means double NAT.
5. An address from 100.64.0.0 to 100.127.255.255 is carrier-grade NAT at the provider. Bridge mode at home does not remove it.

## How to fix it

1. Choose one router to do NAT and DHCP. The other device must only pass traffic or give Wi-Fi.
2. Option 1: Put the provider’s router in bridge mode. The mesh then gets the public address and stays the router.
3. On an Xfinity gateway, open the Admin Tool at 10.0.0.1. Choose Gateway > At a Glance, then Enable next to Bridge Mode.
4. Xfinity says that bridge mode turns off the gateway’s own Wi-Fi, xFi Pods and Xfinity CyberSecure.
5. On an AT&T gateway, use IP Passthrough. AT&T says that bridged mode is not possible on its gateways.
6. AT&T documents Firewall > IP Passthrough. Set Allocation Mode to Passthrough and choose DHCPS-fixed.
7. Enter the mesh router’s MAC address as the Passthrough Fixed MAC Address. Restart the mesh router.
8. AT&T says that only one device can use passthrough. The gateway’s firewall no longer protects it.
9. Option 2: Put the mesh in access point or bridge mode. The provider’s router then stays the only router.
10. On TP-Link Deco, switch the Deco to Access Point mode. TP-Link says that several Decos can then connect by cable.
11. On eero, open Settings > Advanced networking > DHCP & NAT. Change Automatic to Bridge.
12. eero says that bridge mode turns off eero Plus features such as Advanced security, ad blocking and content filters.
13. Google says that Nest Wifi bridge mode works only with a single Wifi device, not a mesh.
14. For Nest Wifi, Google recommends bridge mode on the provider’s router, or removing that router if the modem is separate.
15. After either change, restart the Mac’s Wi-Fi. Check that only one private hop remains in `traceroute`.
16. If you keep double NAT, set port forwards on both routers. Forward the port to the mesh first, then to the device.

The exact menus for your router, from FRITZ!Box and Xfinity to eero and Livebox: [router guides](https://kilobat.app/routers).

## With Kilobat

1. Trace the route with Kilobat. Two private hops at the start mean two routers at home.

   ```
   kilobat trace 1.1.1.1
   ```
2. Show where traffic leaves the Mac, and the public address that Cloudflare sees.

   ```
   kilobat ip --public
   ```
3. Kilobat reads routes and addresses. It cannot change modes on your router.

## Questions

**Does double NAT make my internet slower?**

Google says that for most people double NAT does not affect Wi-Fi performance. It matters for online games, port forwarding and UPnP.

**Which is better, bridge mode on the provider’s router or on the mesh?**

Bridge mode on the provider’s router keeps the mesh features, such as security, filters and port forwarding. Bridge mode on the mesh keeps the provider’s features instead.

**Why does my mesh still show a private WAN address after IP Passthrough?**

Restart the mesh router after the change so that it asks for a new address. Check that the MAC address in the gateway is the mesh router’s WAN port.

**Can I fix carrier-grade NAT with bridge mode?**

No. Carrier-grade NAT is in the provider’s network. Ask the provider for a public IPv4 address, or use IPv6 where it works.

## Sources

- [Apple Support: Recommended settings for Wi-Fi routers and access points](https://support.apple.com/en-us/102766)
- [Google Nest Help: Fix Double NAT when two routers run at the same time](https://support.google.com/googlehome/answer/6277579?hl=en)
- [TP-Link: Deco with Existing Router: Router Mode and Access Point Mode](https://www.tp-link.com/us/support/faq/1432/)
- [eero Support: What is bridge mode?](https://eero.com/support/articles/what-is-bridge-mode)
- [Xfinity: Use Bridge Mode on your wireless gateway](https://www.xfinity.com/support/articles/wireless-gateway-enable-disable-bridge-mode)
- [AT&T Business Support: Configuring IP Passthrough and DMZplus](https://www.att.com/support/smallbusiness/article/internet/KM1188700/)
- traceroute(8) and route(8), man pages installed with macOS 27.2

Checked on 7 November 2026.

## Related guides

- [Find where a connection slows down with traceroute](https://kilobat.app/guides/traceroute-mac): traceroute shows each router on the path from your Mac to a host, with the time each one takes to answer.
- [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address): If the Mac gets no answer from a DHCP server, it gives itself a link-local address from 169.254.0.0/16.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet): A VPN sends traffic through a tunnel.
- [Chromecast, AirPlay TV or printer does not show up on a Mac](https://kilobat.app/guides/casting-printer-not-showing-mac): Chromecast, AirPlay and AirPrint find devices with Bonjour messages on the local network.
- [AirPlay or AirPrint stopped working after a new router or mesh](https://kilobat.app/guides/airplay-airprint-mesh-router): AirPlay and AirPrint find devices with Bonjour, which uses multicast on the local network.