What Is Bridge Mode on a Router and When Should You Use It? Double NAT, ISP Gateway Pairing, and Mesh System Pass-Through Explained

Most ISPs hand you a combined modem and router in a single box — an “all-in-one gateway.” When you connect your own router to that gateway, you end up with two devices both performing Network Address Translation (NAT) simultaneously. This is called double NAT, and it quietly breaks several things: port forwarding stops working, gaming consoles report “Strict NAT” or “NAT Type C,” VPN tunnels struggle to establish, and any app that needs a public-facing port fails silently. Bridge mode eliminates double NAT by turning off the gateway’s routing function so only your own router handles NAT. Run a speed test before and after to confirm the change doesn’t affect your downstream throughput.

What Is Double NAT and Why Does It Matter?

NAT (Network Address Translation) is how a router maps many private IP addresses (the devices in your home) to a single public IP address assigned by your ISP. When two devices in series both perform NAT, traffic passes through two separate “invisible” network layers — your device sits behind the inner router, which itself sits behind the outer gateway. From the internet’s perspective, neither your device nor your inner router is directly reachable.

In practice, double NAT causes:

• Broken port forwarding: A rule on your inner router only opens a port on that router’s NAT table. The outer ISP gateway still blocks the traffic before it ever reaches your inner router. You’d need to forward the same port on both gateways, which is cumbersome and error-prone.
• Strict NAT on gaming consoles: Xbox, PlayStation, and Nintendo Switch report NAT type based on whether inbound connections can reach them. Double NAT typically forces Strict or Type C NAT, which restricts who you can connect with in multiplayer and causes matchmaking delays. Our guide on fixing Strict NAT on WiFi covers this in detail.
• VPN and remote access issues: IPsec and WireGuard VPN tunnels depend on a clean public IP reaching your router. Double NAT can cause tunnel establishment failures or dropped connections during active sessions.

What Bridge Mode Actually Does

Bridge mode turns off the Layer 3 (routing) functions of your ISP gateway — including NAT, DHCP, and the built-in WiFi radio — while keeping the Layer 2 (modem) function active. The gateway still demodulates the incoming cable or fiber signal and hands off an active connection, but it passes your ISP’s public IP address directly to the WAN port of your own router. Your router then handles all NAT, DHCP, firewall, and WiFi functions for your home network. The result is a single clean NAT layer, exactly as if the ISP gateway didn’t exist.

Note that bridge mode on the ISP gateway is different from AP mode on your own router. AP mode on your router disables your router’s routing functions so you can use it as a wireless access point behind another router. Bridge mode on the ISP gateway does the reverse: it disables the ISP device’s routing so your own router takes over. The two are complementary and solve different problems.

When Should You Enable Bridge Mode?

Enable bridge mode on your ISP gateway whenever you plan to use a third-party router for your home network and you need port forwarding, VPN, or optimal NAT type. Specific scenarios:

• You bought a WiFi 6 or WiFi 7 router and connected it to an Xfinity, Cox, or Spectrum gateway
• You deployed a mesh system (eero, Deco, Orbi) and plugged it into your ISP gateway — mesh systems handle their own NAT and routing, making the gateway redundant
• You’re running a home server, Plex, or self-hosted services that need open inbound ports
• You host online gaming sessions and your console reports Strict NAT or NAT Type C

When not to enable bridge mode: Some ISPs bundle VoIP phone service through the gateway, and putting the gateway into bridge mode can disconnect your phone line. Check with your ISP before enabling bridge mode if you use their phone service.

How to Enable Bridge Mode by ISP

Xfinity / Comcast (xFi Gateway)

Open a browser on a device connected to the Xfinity gateway and navigate to 10.0.0.1 (the gateway’s admin page). Log in with your admin credentials — the defaults are printed on the gateway label. Go to Gateway › At a Glance and look for the Bridge Mode toggle. Enable it, accept the confirmation prompt (the gateway WiFi will disable), and wait 2–3 minutes for the reboot. Your own router should receive a public IP on its WAN port. Alternatively, you can enable bridge mode through the Xfinity app under Internet › View WiFi equipment if your account supports it.

AT&T (BGW320, BGW210, and Other Broadband Gateways)

AT&T gateways do not have true bridge mode but offer IP Passthrough, which has the same effect. Log into the gateway admin at 192.168.1.254, go to Firewall › IP Passthrough, select Passthrough from the allocation mode dropdown, choose DHCPS-fixed, and select your router’s MAC address from the connected device list. Save and reboot. Your router will receive the public IP on its WAN port on the next DHCP renewal.

Spectrum / Charter

Spectrum provides a separate modem and router in most setups, which avoids double NAT entirely if you connect your own router directly to the Spectrum modem. If you have a Spectrum Wave 2 or RAC2V1S combo unit, Spectrum does not officially expose a bridge mode option in the admin UI. The recommended approach is to call Spectrum support and request they provision the gateway as a “modem only,” or return the combo unit and request a standalone DOCSIS modem instead. Our guide on DOCSIS 3.1 modems covers compatible standalone options.

Verizon Fios

Fios uses a proprietary ONT-to-router setup. Log into the Fios router at 192.168.1.1, go to Advanced › Network Settings › Network Connections, select the broadband connection, and enable IP Passthrough. Assign the passthrough target to your router’s MAC address. Note that Fios TV multicast may require the Fios router to stay active; if you use Fios TV, check their current guidance before enabling passthrough.

Bridge Mode for Mesh Systems

When you connect an eero, TP-Link Deco, or Google Nest mesh system to an ISP gateway, the mesh base station becomes a third-party router behind the gateway — creating double NAT. The cleanest fix is to put the ISP gateway into bridge mode (as above) so the mesh system gets the public IP and handles all routing. If your ISP gateway doesn’t support bridge mode, the alternative is to put the mesh system itself into bridge/AP mode via its app — but this disables the mesh’s own NAT, DHCP, and some security features (eero Secure, for example, stops working in bridge mode). See our mesh WiFi explainer for a full breakdown of mesh network architecture.

Verify It Worked

After enabling bridge mode and your own router reconnects, run a speed test from a wired device to confirm you’re receiving your full plan speed. Then check your router’s WAN status page — it should show a public IP (not a 10.x.x.x or 192.168.x.x address, which would indicate you’re still behind the gateway’s NAT). On a gaming console, go to the network settings and run a NAT test: you should now see NAT Type 2 (PlayStation) or Open NAT (Xbox) if your router’s firewall allows the relevant ports.