A double NAT with a UniFi Dream Machine SE means two routers in a row, usually a provider's modem that also routes in front of the gateway, and it causes trouble for port forwards, game consoles, VPNs and some cameras. To check, look at the WAN address on the UniFi gateway's status page in the UniFi Network app. If it is a private address, such as one starting with 192.168, 10 or 172.16 to 172.31, the gateway is behind another router. Compare it with what a site that shows your public address says: if they differ, there is a second layer of NAT.
The checks in more detail
Some providers also use carrier-grade NAT, which shows a 100.64 address and cannot be fixed on your side; ask the provider for a public address if you need to host. There are three ways to cure a double NAT caused by your own modem. The best is bridge mode, set in the provider's modem or gateway, which turns off its routing and passes the public address to the UDM SE; each provider's device has a different menu, and some do not allow it, in which case ask the provider.
The second is to put the UDM SE in the modem's DMZ or IP passthrough mode, which sends all traffic to it and effectively removes the modem's router role. The third is to forward the needed ports twice, once on the modem to the UDM SE and again on the UDM SE to the device, which works but is clumsy. After changing the modem mode, restart both, modem first, and look at the UDM SE's WAN address again; it should now be the public address.
If the connection fails to come up, the provider may have tied service to the old device's address, so restart the modem again or call. Remove any old port forwards and firewall rules, then set them up fresh on the UDM SE. Test a forward from mobile data. A console's NAT type should improve to open. Keep Wi-Fi from the old modem off to avoid interference, and use UniFi access points instead. Update the firmware. If the provider forbids bridge mode, a separate modem you own is an option. Ubiquiti's help pages explain the steps.
Differential
Likely causes of “Ubiquiti UniFi Dream Machine Special Edition shows double NAT or strict NAT”, and how to tell them apart
- 1
A provider modem that also routes
What separates it A private WAN address on the gateway
How to confirm Put the modem in bridge mode
- 2
Carrier-grade NAT
What separates it A 100.64 WAN address
How to confirm Ask the provider for a public address
- 3
A modem that cannot bridge
What separates it No bridge option
How to confirm Use DMZ or passthrough, or forward twice
- 4
Old forwards and rules
What separates it Confusion after the change
How to confirm Remove them and set up fresh
- 5
Provider tied to the old device
What separates it The WAN does not come up
How to confirm Restart the modem and contact the provider
Before you touch a setting
Record this first — changing settings destroys the evidence
- The WAN address
- The modem's model and mode
- Whether the address starts with 100.64
- The console's NAT type
Try in this order
0 of 6 completedCheck the WAN address
ReversibleIn UniFi Network.
Compare with your public address
ReversibleTo confirm double NAT.
Set the modem to bridge mode
ReversibleOr DMZ.
Restart modem first
ReversibleThen the gateway.
Remove old forwards
ReversibleAnd rebuild them.
Test from mobile data
ReversibleOutside.
Model-specific
What is true of this model and not of its siblings
- Bridge mode
- Turns off the modem's routing.
- 100.64
- Indicates carrier-grade NAT.
Stop boundary
When this stops being a self-service repair
- !If the provider will not allow bridge mode, consider your own modem
- !Ask for a public address if carrier-grade NAT
- !Note settings before changes
Evidence ledger
Sources behind this answer
Exact questions
Common questions
What is double NAT?+
Two routers in a row.
How do I check?+
The WAN address is private.
What is carrier-grade NAT?+
The provider shares one public address.
What is the best fix?+
Bridge mode on the modem.