Ubiquiti's port forwarding article describes double NAT and carrier-grade NAT directly. You are affected if the gateway's WAN address is in a private range: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 or, for carrier NAT, 100.64.0.0/10. That means another router or your provider is translating addresses in front of the gateway. The fix Ubiquiti gives is to put the ISP modem or router into bridge mode so the gateway gets a public address on the WAN.
The checks in more detail
If that is not supported, forward the ports on the upstream router to the gateway's WAN address as well as on the gateway, or ask the provider for a DMZ option that forwards automatically. Ubiquiti warns that behind NAT, reaching the upstream router's public address from a LAN client, called hairpin NAT, will not work. For remote access to services, Ubiquiti suggests WireGuard or Teleport VPN instead of exposing ports, and Teleport can work behind NAT, though it may need an IPv6 WAN in some cases.
If your provider uses carrier NAT you cannot forward ports at all; ask for a public address or use a VPN. After a change restart the modem then the gateway and check the WAN address again in Internet settings. If your provider only offers a combined modem and router with no bridge mode, some allow IP passthrough or a DMZ host that points at the gateway's WAN address, which behaves much like bridge mode for most purposes.
Ask for it by name, and after the change confirm the gateway's WAN address is public and that a port check from outside reaches it. If the provider gives out carrier NAT addresses, ask whether a public address is available for a small fee, since it removes the problem altogether. After fixing NAT, re-run the port check from outside and note the date, since a provider can move you back onto carrier NAT after an equipment change without telling you.
Differential
Likely causes of “Ubiquiti UniFi gateways shows double NAT or strict NAT”, and how to tell them apart
- 1
A provider gateway routing
What separates it The gateway has a private WAN address because a provider gateway is routing in front of it
How to confirm Bridge the provider's unit, or ask the provider to do it, so that the UniFi gets a public address
- 2
Carrier-grade NAT
What separates it The WAN address begins 100.64 because the provider uses carrier grade NAT
How to confirm Ask the provider for a public IP address, or use a VPN that works behind NAT
- 3
Ports forwarded on one device only
What separates it The ports stay closed because they were forwarded on only one of the two devices
How to confirm Forward the ports on both devices, so that traffic reaches the gateway and the host
- 4
Hairpin NAT
What separates it You cannot reach your own public address from the LAN because of hairpin NAT
How to confirm Use the internal address for the service from inside your network
- 5
An upstream firewall
What separates it The traffic is blocked because a firewall upstream stops it
How to confirm Test with the upstream firewall disabled, and open the ports that the service needs
Before you touch a setting
Record this first — changing settings destroys the evidence
- The WAN address that the gateway shows
- The provider unit and its mode
- Which ports fail to open from outside
- Whether the provider uses carrier NAT
Try in this order
0 of 7 completedRead the WAN address
ReversibleRead the WAN address, since a private range or a 100.64 address means there is NAT in front.
Ask for bridge mode
ReversibleAsk for bridge mode on the provider's unit, so that the gateway gets the public address.
Or forward upstream
ReversibleOr forward the ports upstream, to the gateway's WAN address, so that traffic can reach it.
Or use a VPN
ReversibleOr use a VPN such as Teleport or WireGuard, which can work behind carrier grade NAT.
Restart
ReversibleRestart the modem first, and then the gateway, and wait for both to finish starting up.
Recheck
ReversibleRecheck the WAN address after the restart, to see whether it is now a public address.
Test from outside
ReversibleTest from outside your network, using cellular data on a phone rather than your wifi.
Model-specific
What is true of this model and not of its siblings
- WAN
- All three gateways show the WAN address in Internet settings.
- Ports
- Multiple WANs can be used for failover on models that have more than one WAN port.
Stop boundary
When this stops being a self-service repair
- !If the provider will not bridge or supply a public address, use Teleport or WireGuard
- !If the WAN address is public and ports stay closed, check the upstream firewall
- !If the gateway shows no WAN address, follow the no-internet steps
Evidence ledger
Sources behind this answer
Rules and why they fail.
UPnP and its risks.
Teleport invitations and IPv6.
LED states, IP address checks and TCP 8080.
The company and its products.
Exact questions
Common questions
What is carrier NAT?+
Carrier NAT is when the provider translates addresses, using the 100.64.0.0/10 range.
What is hairpin NAT?+
Hairpin NAT is reaching the public address from inside, and it does not work behind NAT.
Is UPnP a substitute?+
Ubiquiti recommends keeping UPnP off, so it is not a substitute for a proper rule.
Can Teleport work behind NAT?+
Yes, Teleport can work behind NAT, according to Ubiquiti's FAQ.
Should I use a DMZ?+
Use a DMZ only if the provider offers it, and only for one trusted device.