Double NAT and ISP Modem Setup

Double NAT happens when both your ISP modem and UniFi gateway perform routing. It causes subtle, painful problems.

Symptoms

• Port forwards do not work from the internet
• VPN clients connect but traffic fails
• Console/gaming “NAT type strict”
• UniFi inform or adoption flaky (device sees wrong path)
• Speed tests OK on gateway but services unreachable from outside

Typical bad layout

Internet → [ISP Modem/Router 192.168.0.1] → [UniFi Gateway 192.168.1.1] → LAN
              ^ NAT #1                          ^ NAT #2

Preferred layout

Internet → [ISP Modem in BRIDGE] → [UniFi Gateway] → LAN

Put the UniFi gateway as the only router on the network.

How to fix

1. Log in to ISP modem — enable bridge mode, IP passthrough, or DMZ to UniFi WAN MAC (ISP-dependent terms).
2. Reboot modem, then UniFi gateway.
3. Confirm UniFi WAN receives public or ISP-assigned routable IP (not another 192.168.x.x from modem — sometimes unavoidable with CGNAT).

Carrier-grade NAT (CGNAT)

Some ISPs do not give a public IPv4 address. Port forwards may be impossible without business service or IPv6. Options:

• Request static IP or business tier
• Use outbound-only tools (VPN out, cloud relay)
• IPv6 where supported

UniFi-specific checks

• Settings → Internet on gateway — note WAN IP type.
• Ensure DNS on devices points to gateway or trusted resolver.
• After fixing NAT, retest adoption and VPN.

Still stuck?

Document modem model, WAN IP on both modem and gateway, and open an i2unifi ticket if controller inform path is suspected — include on-site topology.