TP-Link's port forwarding article explains how to spot double NAT: find the WAN IP address under More, Internet Connection, IPv4. If it is a private address such as one beginning with 192.168, another NAT device is connected to the WAN port of your main Deco, and you must open ports on that device as well. The Deco is then not the only router. There are two cures.
The checks in more detail
Put the provider's modem and router combination in bridge or modem mode so the Deco is the only router, or set the Deco to Access Point mode so the existing router does the routing and the Deco just shares the connection through its LAN port. TP-Link states that in Router mode the main Deco is the gateway and provides antivirus, parental controls, QoS and DHCP, while in Access Point mode those features disappear from the app, including port forwarding, address reservation, DDNS, UPnP and VPN server.
That is the price of AP mode. To use Access Point mode, TP-Link has a separate setup guide, and after switching, all Decos are clients of the main router. Choose Router mode plus bridging the upstream unit if you want the Deco's features. You can spot double NAT in the app: the WAN IP shown under More, Internet Connection, IPv4 will be private, such as 192.168.x.x, when another router sits in front of the Deco. Fixing it once at the upstream device is better than opening ports in two places. Consoles and some video services report NAT type in their network menus, and a strict or double result is a useful second confirmation of what the WAN IP already told you.
Differential
Likely causes of “TP-Link Deco mesh wifi shows double NAT or strict NAT”, and how to tell them apart
- 1
A provider combo unit routing
What separates it There are two routers because the provider's combo unit is still routing in front of the Deco
How to confirm Bridge the combo or use Access Point mode
- 2
An old router in front
What separates it Port forwards fail because an old router sits in front of the Deco and blocks them
How to confirm Remove the old router from the path, or bridge it, so that only the Deco routes traffic
- 3
Access Point mode chosen by mistake
What separates it Some features are missing because Access Point mode was chosen by mistake
How to confirm Switch the Deco back to Router mode, so the missing features return
- 4
Provider wifi still on
What separates it There are duplicate networks because the provider's wifi is still switched on
How to confirm Turn off the provider's wifi, so that the Deco is the only wifi network in your home
- 5
An upstream firewall
What separates it The ports stay closed because an upstream firewall also blocks the traffic
How to confirm Open the ports on both devices, so that traffic can reach the Deco and then the device
Before you touch a setting
Record this first — changing settings destroys the evidence
- The WAN IP shown in the app
- The modem or router in front
- The mode the Deco is in
- Which feature fails to work, such as gaming or remote access
Try in this order
0 of 7 completedFind the WAN IP
ReversibleFind the WAN IP address in the app, by going to More, then Internet Connection and IPv4.
Check whether it is private
ReversibleCheck whether it is a private address, since one beginning 192.168 means another router is in front.
Choose a fix
ReversibleChoose a fix, which is either to bridge the upstream unit, or to use Access Point mode.
Switch mode if needed
ReversibleSwitch the mode if needed, by following TP-Link's guide for setting a Deco to Access Point mode.
Recheck features
ReversibleRecheck the features afterwards, since you should know what Access Point mode removes, and then test again to see whether it helped.
Test games and ports
ReversibleTest your games and your ports from outside the network, to see whether they now work.
Switch back if needed
ReversibleSwitch back to Router mode if needed, so that the Deco routes traffic and the features return.
Model-specific
What is true of this model and not of its siblings
- Models
- Different Deco models may differ in features.
- HomeShield
- HomeShield models do not support the monthly report in Access Point mode.
- Other models this page answers
- These steps also fit the Deco BE63 mesh, Deco XE75 mesh, Deco X55 mesh, Deco M5 mesh.
Stop boundary
When this stops being a self-service repair
- !If the provider will not bridge its unit, use Access Point mode
- !If ports stay closed after removing the second NAT, check the provider blocks
- !If the WAN IP will not appear, contact TP-Link support
Evidence ledger
Sources behind this answer
Private WAN IP means another NAT device.
Router versus Access Point features.
Switching to Access Point mode.
VPN features by mode.
The company and its products.
Exact questions
Common questions
How do I know I have double NAT?+
You know you have double NAT when the WAN IP address in the app is a private address.
What do I lose in Access Point mode?+
Parental controls, QoS, port forwarding, DDNS and more.
Is Router mode the default?+
Yes, Router mode is the default, and the main Deco is then the gateway.
Can I bridge the modem instead?+
Yes, where the provider allows it.
Do all units change mode?+
Yes, they follow the main Deco.
Does UPnP work in AP mode?+
No, UPnP does not work in Access Point mode, since the router in front controls it.
Do I need to open ports twice?+
In a double NAT setup, yes, you need to open the ports on both devices.