Two Routers, One Confused Network: Untangling Double NAT on a UK IPTV Setup

A mate of mine spent £180 on a shiny Wi-Fi 6 router, plugged it into his Virgin Hub 5, and spent the next fortnight wondering why Plex had gone moody and his phone kept losing the living room telly when he tried to cast. The broadband was fine. Netflix was fine. The problem was that he had built a network with two front doors and no agreed house rules: double NAT.

It is one of the most common own-goals in UK cord-cutting, because the fix sounds simple — put the ISP router out of the way — and the reality depends entirely on which box your provider gave you. Virgin, BT, Sky and TalkTalk all handle this differently, and one of them barely handles it at all.

What double NAT actually does to your telly

In a normal home setup, one router does NAT: it takes all your devices and presents them to the internet as a single address. Add a second router behind the first and now you have NAT inside NAT. Outbound traffic — iPlayer, ITVX, live IPTV streams — usually survives this without a murmur, which is why people assume nothing is wrong.

The trouble is inbound. If an app or service needs to reach back into your network, it now has to get through two routers, and the outer one has no idea the inner one exists. That shows up as Plex remote access refusing to stay connected, a home VPN that works on the sofa but not on mobile data, port forwards that point at the wrong device, and UPnP mappings that two routers fight over. Local discovery can get flaky too, so casting from a phone or tablet sometimes works and sometimes pretends your TV has vanished.

For plain live telly and catch-up, double NAT is often harmless. For anything that wants to talk back to your house, it is a nuisance.

The three proper ways out

Which one you can use depends on your ISP and, sometimes, on the exact hub model.

Virgin Media: modem mode

This is the cleanest of the lot. Virgin Hubs — Hub 3, Hub 4 and Hub 5 — have a modem mode that turns off routing and Wi-Fi and hands the public address straight to whatever you plug into Ethernet port 1. Log into the hub at 192.168.0.1, find modem mode, enable it, and wait. The hub reboots, only port 1 stays live, and your own router needs its WAN set to DHCP rather than PPPoE. Give it five minutes and a power cycle before you decide it has failed. The Hub 5 in particular can be slow to settle.

BT and TalkTalk: PPPoE passthrough

BT Smart Hub 2 does not have a true bridge mode, which surprises people. On BT FTTP you can sidestep it entirely: plug your own router into the Openreach ONT and set the WAN to PPPoE with the username [email protected] and any password you like. That is not a typo — BT accepts a placeholder password. TalkTalk and Plusnet are similar PPPoE setups, with credentials from your account. On BT FTTC, where the Smart Hub is also the modem, your options are narrower: either use the hub as a modem with a DMZ workaround, or introduce a separate Openreach modem.

Sky: the awkward one

Sky Broadband does not use PPPoE in the usual way, and its hubs do not offer modem mode. Third-party routers need DHCP option 61 with a Sky client identifier, which is a faff to set up and not every router exposes it. Sky FTTC lines may also need VLAN 101. If you are on Sky and not deeply confident, the honest advice is to use the DMZ compromise below rather than spend a weekend chasing it.

The DMZ compromise

If you cannot bridge or use modem mode, put your second router's WAN address into the ISP router's DMZ. That forwards all inbound traffic to the second router, which fixes remote access and most port-forwarding misery even though the double NAT technically remains. It is not elegant, but it is reversible in two minutes and it does not require a support call.

When you should not bother

If your household only watches live telly, iPlayer, ITVX, Channel 4 and a normal IPTV app — and nobody remotes into Plex, runs a home VPN or forwards ports — leave the ISP router alone. Double NAT is not secretly degrading your picture quality. It is not why the stream stutters at 9pm. Spending an evening rebuilding your network to fix a problem you do not have is a poor use of a Sunday.

Also skip it if you are on a shared or rented connection where you cannot change the ISP settings. A DMZ entry is as far as you should go.

The rollback plan for Sunday at 9pm

Before you change anything, photograph the existing settings and write down the ISP router admin password. Keep the old router plugged in and configured as it was. Know how to get back in: Virgin hubs in modem mode are reachable at 192.168.100.1 from a device plugged into port 1, and a factory reset with a pin will also bring them back.

If the change kills the connection, do not panic-cycle everything at once. Unplug your own router, reconnect the ISP router exactly as it was, power it up, and give it five minutes. If you are mid-match, use mobile data for the commentary and sort it in the morning. The internet is not going anywhere, even if your telly briefly is.

One last label warning: access point mode is not bridge mode. Access point mode turns a router into a Wi-Fi extender and leaves the routing to the ISP box. That is useful for filling a dead spot, but it will not solve double NAT. Read the menu twice before you click.