Double NAT happens when two routers both do network address translation, for example an eero plugged into a provider's modem and router combo. eero says double NAT lets you set up quickly without changing the existing equipment, but it creates two separate networks, which can trip up gaming, port forwarding and some remote access. The clean fixes are: put the provider's combo unit in bridge mode if it offers it, or, if it does not, turn off wifi on it and put your eeros in bridge mode. To bridge the eeros, open the app, Settings, Advanced networking, DHCP and NAT, and change Automatic to Bridge.
In bridge mode the eeros turn off their network services but keep providing wifi, and you cannot manage advanced features in the app. Bridge mode requires one eero to remain wired to the network.
The checks in more detail
eero says you may need bridge mode if the provider is AT&T U-Verse, requires PPPoE or requires a specific MAC address, although the Pro 6 and eero 6 now support PPPoE. To switch back, choose Automatic; the network restarts and devices may need to reconnect. Features that keep working in bridge mode for eero Plus include Guardian VPN, Malwarebytes, password manager and DDNS, while Advanced security, Ad Blocking, Content Filters and Hotspot Backup do not.
You can spot double NAT in the app: if the WAN IP address shown for your eero is in a private range such as 192.168.x.x or 10.x.x.x rather than a public address, another router sits in front of it. Consoles often report a strict or moderate NAT type in that case. Fixing it once, at the upstream unit, is better than working around it with port forwards.
Differential
Likely causes of “eero mesh wifi shows double NAT or strict NAT”, and how to tell them apart
- 1
A provider combo unit doing routing
What separates it There are two routers and two networks because the provider's combo unit is still routing traffic
How to confirm Bridge the combo or turn off its wifi
- 2
An old router in front
What separates it Port forwards fail because an old router sits in front of the eero and blocks them
How to confirm Bridge the old router, or remove it from the chain, so that only the eero routes the traffic
- 3
Provider wifi still on
What separates it There is interference and there are duplicate networks because the provider's own wifi is still on
How to confirm Turn off the provider's wifi, so that the eero provides the only wifi in the home
- 4
ISP requirements
What separates it You cannot use the eero as a router because the provider has requirements that stop that
How to confirm Use bridge mode on the eero where the provider requires it, and accept the features you lose
- 5
A missed switch back
What separates it Some features are missing because the eero was left in bridge mode after the fix
How to confirm Change Bridge back to Automatic in the settings, so that the eero routes the traffic again
Before you touch a setting
Record this first — changing settings destroys the evidence
- The provider and modem or combo model
- Whether the combo has bridge mode
- The WAN IP shown in the app
- Which feature failed to work, such as gaming or remote access
Try in this order
0 of 7 completedConfirm double NAT
ReversibleConfirm double NAT by looking at the WAN address in the app, since a private address suggests another router.
Ask for bridge mode
ReversibleAsk the provider for bridge mode, and enable it on the provider's combo unit, if that is allowed.
Or bridge the eeros
ReversibleOr bridge the eeros, in Settings under Advanced networking, then DHCP and NAT, choosing Bridge.
Keep one eero wired
ReversibleKeep one eero wired to the modem, since bridge mode needs a wired eero to connect to the internet.
Check features
ReversibleCheck which features you lose, since bridge mode turns off some routing and eero Plus features.
Test
ReversibleTest the things that failed, such as online games and remote access, to see if they now work.
Switch back if needed
ReversibleSwitch back if needed, by choosing Automatic, and the eero will start to route the traffic again.
Model-specific
What is true of this model and not of its siblings
- PPPoE
- eero says the Pro 6 and eero 6 support PPPoE from eeroOS 6.6.1.
- Gateway
- Bridge mode still needs one eero wired to the modem or router.
- Other models this page answers
- These steps also fit the eero Pro 6E, eero Pro 6, eero 6, eero Pro (2nd generation).
Stop boundary
When this stops being a self-service repair
- !If the provider will not enable bridge mode, use bridge mode on the eeros
- !If PPPoE is needed and the model does not support it, contact eero support
- !If gaming NAT stays strict after removing double NAT, check port forwarding
Evidence ledger
Sources behind this answer
Bridge mode, Automatic and features.
Features lost in bridge mode.
NAT explained.
The Internet, Network services, Wireless and Integrations sections.
The company and its products.
Exact questions
Common questions
Is it always a problem?+
It can affect gaming and port forwarding.
What is bridge mode?+
It turns off a device's routing and wifi so it works as a modem or access point.
What do I lose in bridge mode?+
Advanced features such as some eero Plus tools.
Does Guardian VPN still work?+
Yes, Guardian VPN still works, according to eero, when the network is in bridge mode.
Do I need bridge mode with AT&T U-Verse?+
eero lists it as a scenario that requires it.
Does the eero 6 support PPPoE?+
Yes, as of the eeroOS 6.6.1 release.
How do I switch back?+
You switch back by choosing Automatic in the settings, and the eero routes again.
Does the network restart?+
Yes, the network restarts when you change the mode, so wait for it to return.