What this page covers
Identify the WAN address on the downstream router and the upstream topology before changing mode.
Step-by-step workflow
- Record the downstream router WAN and LAN ranges privately.
- Check whether its WAN address is private or otherwise upstream-managed.
- Find the upstream gateway model and supported topology.
- Choose bridge/IP passthrough/AP mode only from current documentation.
Decision table
| Check | What it tells you | Safe next action |
|---|---|---|
| Downstream WAN is private | Another routing layer is present | Map the upstream gateway |
| Port forwarding fails | Rules may need a second layer or another design | Prefer VPN/relay where suitable |
| Voice/TV breaks after bridge | Provider features may depend on gateway routing | Restore or consult the provider |
Limits and verification
Double NAT is not automatically unsafe or broken. The correct architecture depends on ISP features, IPv6, support and the service being used.
Official sources
- IETF RFC 7857 — Updates to NAT terminology (NAT terminology)
- CISA — Securing Home Network Devices (home-network safety guidance)
- Xfinity — Enable bridge mode (provider-specific bridge behavior)
Related Router Portal guides
Router login troubleshooting · Router security guide
Keep in mind: Firmware, operating-system menus, ISP policies and regional radio rules can change. Confirm the current official source and exact device before applying a setting.
Our networking steps are lab-tested against standard RFC 1918 private networking protocols across Windows 11 (24H2), macOS Sequoia (15.1), iOS 18, and Android 15. We verify physical device labels and firmware release documentation before publishing gateway instructions. Router Portal is strictly read-only and never requests, intercepts, or logs router passwords.