NETGEAR Orbi 850 Series mesh shows double NAT or strict NAT

The checks in more detail

If the provider's box cannot bridge, set the Orbi to access point mode, so that it acts as a Wi-Fi system behind the other router, at the cost of the Orbi's own routing features such as parental controls and guest networking, which the upstream router then provides. In orbilogin.com, Advanced, Advanced Setup, Router/AP Mode lets you choose. Restart the system after a change. If the provider uses carrier-grade NAT and gives no public address at all, no setting fixes it and a request to the provider is needed.

After changing modes, check that the Wi-Fi names and passwords still work, because switching a router to access point mode can reset some settings, and satellites may need to be resynced. A short note of your settings before the change saves time. Check the provider's box for a setting called DMZ or IP passthrough: DMZ to the Orbi's address can solve port issues without full bridging, though it exposes the Orbi to the internet and is less safe than passthrough, so use it only if passthrough is unavailable.

Use the Orbi's own firewall to limit what is exposed. After fixing double NAT, retest the game or service that complained, and note the NAT type the console reports, because some providers still apply carrier-level translation that no home setting can remove. If you stay in access point mode, remember to give the Orbi a fixed address on the upstream router so you can reach its settings page easily.