The UniFi Cloud Gateway Ultra is a full router, and a double NAT appears when the provider's own box in front of it is also routing, which gives the Ultra a private address on its WAN port instead of the public one. The symptoms are familiar: games report a strict NAT type, port forwards that you set on the Ultra never work, remote access to your own devices fails and some services complain about two layers of address translation. The ShiftCtrl article on UniFi double NAT sets out the choices.
The checks in more detail
First find out whether you have one: open the Ultra's page in the UniFi application and read the WAN IP address. If it starts with 10, 192.168 or 172.16 to 172.31, a router sits in front. If it begins with 100.64 to 100.127, the provider is using carrier-grade NAT, which no setting on your side can remove and for which you need to ask for a public address, often free on request. The best fix is to turn the provider's box into a plain modem.
Many gateways have a bridge mode or IP passthrough option in their admin page: bridge mode turns off the box's routing so that the Ultra receives the public address by DHCP, and passthrough hands the address to a chosen device and keeps some functions. Follow the provider's instructions, restart the box, then the Ultra, and recheck the WAN address. If the box cannot be bridged, plug the Ultra into one of its LAN ports and put the Ultra's address in the box's DMZ or exposed host setting, which forwards everything to the Ultra and reduces the double-NAT trouble, though the box still translates.
NETGEAR and Google also document the same principle for other routers. Turn off Wi-Fi on the provider's box once the Ultra and its access points take over, to avoid two networks. Remember that for most browsing a double NAT causes no slowdown, and it matters for gaming and hosting. After the change, run the NAT type test on a console, and test a port forward. If the provider insists the box cannot bridge, ask about a modem-only device for the same plan.
Differential
Likely causes of “Ubiquiti UniFi Cloud Gateway Ultra shows double NAT or strict NAT”, and how to tell them apart
- 1
The provider box still routing
What separates it A private WAN address
How to confirm Put it into bridge or passthrough mode
- 2
A box that cannot bridge
What separates it No bridge option
How to confirm Use the DMZ or exposed host setting
- 3
Carrier-grade NAT
What separates it A WAN address in 100.64 to 100.127
How to confirm Ask the provider for a public address
- 4
Two Wi-Fi networks
What separates it The old box still broadcasts
How to confirm Turn its Wi-Fi off
- 5
A forward set on the wrong layer
What separates it Port forwards fail
How to confirm Fix the front device first
Before you touch a setting
Record this first — changing settings destroys the evidence
- The WAN address in the UniFi application
- The provider box model
- Whether bridge or passthrough exists
- The NAT type on a console
Try in this order
0 of 6 completedRead the WAN address
ReversibleIn the UniFi application.
Bridge the provider box
ReversibleOr use passthrough.
Restart the box then the Ultra
ReversibleAnd recheck.
Use the DMZ
ReversibleIf bridging is impossible.
Turn off the box's Wi-Fi
ReversibleTo avoid two networks.
Test NAT type
ReversibleAnd a port forward.
Model-specific
What is true of this model and not of its siblings
- Private WAN address
- 10, 172.16 to 31 or 192.168.
- CGNAT range
- 100.64.0.0 to 100.127.255.255.
Stop boundary
When this stops being a self-service repair
- !If the provider will not bridge, ask for a modem-only device
- !If the WAN address is in the 100.64 range, ask about a public address
- !Check the Ultra's WAN settings
Evidence ledger
Sources behind this answer
Bridge mode, passthrough and CGNAT on UniFi.
Ports, routing and IDS/IPS throughput of the Cloud Gateway Ultra.
NETGEAR's guide to double NAT with an ISP gateway.
Exact questions
Common questions
How do I know I have double NAT?+
The Ultra's WAN address is private.
What is carrier-grade NAT?+
The provider shares one public address.
Does double NAT slow browsing?+
Not noticeably.
What does bridge mode do?+
It turns off the box's routing.