Double NAT and CGNAT: the silent party crashers

Double NAT means two routers think they own translation — your packets bounce through two layers of pretend public addresses. CGNAT means your ISP shares one real public IPv4 across many homes; inbound hosting without cooperation is structurally awkward.

Quick symptom check

• Your “WAN IP” on the inner router is a private RFC1918 range (10/8, 172.16/12, 192.168/16).
• Port checks succeed on LAN but never from the internet.
• Traceroute shows your ISP hop before your home router should appear.

Fix hierarchy (least disruptive first)

1. Bridge the inner router or demote it to AP/switch mode.
2. Ask the ISP for a true public IP (sometimes a paid tier).
3. Use an outbound tunnel or relay to a VPS with a clean public IP.

For broader Internet architecture context (not ISP sales), ARIN’s educational material on IPv4 exhaustion explains why CGNAT exists: ARIN IPv6 guide hub.