Double NAT on a Nighthawk means another router sits in front of it and both translate addresses. The WAN address the Nighthawk shows in its status page tells you: a private range such as 192.168.x.x means another router is upstream. Consoles and games often report the same thing as a strict or moderate NAT type. There are two clean cures. Put the provider's combined modem and router into bridge or modem mode, so the Nighthawk is the only router, or run the Nighthawk as an access point behind the existing router.
The checks in more detail
NETGEAR notes that features such as port forwarding, UPnP, parental controls, Armor and QoS are unavailable in access point mode on its routers, so keep router mode if you want them. A cable modem router such as the CAX80 has its own modem, so double NAT should not occur unless you add another router behind it. If the provider will not bridge its unit, you can forward ports on both devices, which is clumsy but works, or place the provider's unit's DMZ address on the Nighthawk.
After the change, restart the modem and router and test from outside your network. Note that a new router with no internet can also be a MAC-address issue, a different problem. A console's network menu usually shows its NAT type, and a strict or double result confirms what the WAN address already suggested. It is better to remove the double NAT once, at the upstream device, than to open ports on both routers; voice and game services also prefer a single router.
After the fix, restart the console or game so it detects the network afresh, because many titles remember the old result until they restart. If you cannot bridge the provider's unit, ask the provider to disable its own wifi and routing, which many will do on request, and then check the Nighthawk's WAN address again to confirm it is public. Test again after a full restart of both devices, because a stale lease can keep the old address for a while.
Differential
Likely causes of “NETGEAR Nighthawk routers shows double NAT or strict NAT”, and how to tell them apart
- 1
A provider combo unit routing
What separates it Two routers are in play because the provider's combo unit routes in front of the Nighthawk
How to confirm Put the provider's unit in bridge mode, or ask the provider to, so only the Nighthawk routes
- 2
An old router behind or in front
What separates it The ports stay closed because an old router sits in front of, or behind, the Nighthawk
How to confirm Remove one of the two routers from the path, so that only one device does NAT
- 3
AP mode chosen
What separates it Some features are grayed out because AP mode is on
How to confirm Switch the Nighthawk back to router mode and the grayed-out features return
- 4
Provider wifi on
What separates it Duplicate networks appear because the provider's wifi is still on
How to confirm Switch off the provider's wifi so the Nighthawk is the only wifi network in the house
- 5
A cable model with another router added
What separates it You see double NAT because another router was added behind a cable modem
How to confirm Bridge one of the two routers, so that only one of them does address translation
Before you touch a setting
Record this first — changing settings destroys the evidence
- The WAN address on the router's status page
- The provider's unit and which mode it is in
- Whether the router is a cable model
- Which feature fails, such as gaming or remote access
Try in this order
0 of 7 completedRead the WAN address
ReversibleRead the WAN address in the router's status page, since a private address means another router.
Choose a fix
ReversiblePick a fix: bridge the provider's unit or use AP mode.
Check what AP mode removes
ReversibleBefore choosing AP mode, check what it removes, such as port forwarding, UPnP and Armor.
Apply
ReversibleApply the change and restart both units so they pick up the new setup.
Retest
ReversibleRetest what failed, such as online games and remote access.
Forward upstream if needed
ReversibleForward ports upstream too if needed, since with two routers both devices must let traffic through.
Revert if needed
ReversibleIf needed, revert by returning the Nighthawk to router mode.
Model-specific
What is true of this model and not of its siblings
- CAX80
- The CAX80 is a cable modem router, so it has no separate provider unit.
- Router mode
- Keep router mode to keep Armor, UPnP and port forwarding.
- Other models this page answers
- These steps also fit the Nighthawk RS300 Wi-Fi 7 router, Nighthawk RAXE500 router, Nighthawk RAX120 router, Nighthawk RAX50 router.
Stop boundary
When this stops being a self-service repair
- !If the provider will not bridge, forward ports on both devices
- !A private WAN address with no other router in the house is one for NETGEAR support
- !If the ports stay closed, ask the provider whether their unit can be bridged
Evidence ledger
Sources behind this answer
Features grayed out in AP mode.
Reserved IP, service name and rule order.
The list of NETGEAR troubleshooting articles.
Power, Internet, WiFi, Ethernet and WPS LEDs.
The company and its products.
Exact questions
Common questions
What does AP mode remove?+
Port forwarding, UPnP, Armor and other features.
Can I forward on both?+
Yes, you can forward on both routers, though it is clumsy and hard to keep tidy.
Does the CAX80 have double NAT?+
The CAX80 does not have double NAT by itself, since it is a cable modem router.
Do consoles report it?+
Often as strict or moderate NAT.