How to Properly Set Up IP Passthrough and Fix Double NAT on AT&T Fiber And Netgear Orbi

Eli Linares 13 min read
Double NAT

Set Up IP Passthrough & Fix Double NAT on AT&T Fiber (Tested on BGW620-700 & Orbi RBE971)

Connecting a high-performance mesh Wi-Fi system like the Netgear Orbi 970 Series (RBE971) to an AT&T Fiber Gateway (BGW620-700) should deliver blisteringly fast, seamless connectivity. However, if you plugged the Orbi’s WAN port straight into an Ethernet port on the AT&T gateway out of the box, you are almost certainly running into a common networking pitfall: Double NAT.

While this guide documents settings tested on an AT&T BGW620-700 and a Netgear Orbi RBE971, the same network logic and menu structures apply to other AT&T gateways (such as the BGW320 and BGW210) and other Netgear Orbi mesh systems (such as the 770, 850, and 960 series, etc.).

This article will guide you through the steps to properly configure IP Passthrough and avoid double NAT while doing so. I will also present you with most, if not all, of the possible errors and conflicts you might find while trying to get rid of your double NAT issue.

Important Reminder About The Troubleshooting Steps:

It is worth mentioning that perhaps only some of the advise below will apply to your particular issue, the guide follows a specific order of presenting the issues, so that in most cases you will not need to go through the whole guide, unless your network’s topology and configuration require you to do so in order to successfully get rid of the double NAT issues.

What Is Double NAT and Why Is It a Problem?

Network Address Translation (NAT) maps multiple private IP addresses on your local network to a single public IP address provided by your ISP.

When both your AT&T Gateway and your Netgear Orbi run their own routing and NAT engines in series:

  • The AT&T Gateway receives your public fiber IP and translates it into an internal private network (usually 192.168.1.x).
  • The Netgear Orbi treats the AT&T gateway as “the internet,” takes that private IP on its WAN port, and runs a second layer of NAT for your devices (typically using an IP such as 192.168.1.x or 10.0.0.x).

The Consequences:

  1. Broken Inbound Connections: Port forwarding and self-hosted services fail because traffic hitting the AT&T gateway isn’t cleanly routed through to the Orbi.
  2. Gaming Issues: Consoles (PS5, Xbox, Switch) and PC games report Strict NAT or Type 3 NAT, leading to lobby matchmaking errors and VoIP dropouts.
  3. VPN & Remote Access Failures: Dual firewalls complicate IPsec/WireGuard tunnels and remote access protocols.

How to Check If You Have Double NAT

Before changing any configuration settings, check whether your Orbi is actually caught behind a second NAT layer.

Check the Orbi WAN IP Address

  1. Open a browser and log into your Orbi administration dashboard (navigate to http://orbilogin.com, http://10.0.0.1/, or it could also be http://192.168.1.1 from a device connected to Orbi Wi-Fi/LAN).
  2. Go to Advanced > System Status (or the main dashboard Internet Port tile).
  3. Check the Internet / WAN IP Address:
  • Double NAT Confirmed: The WAN IP begins with a private RFC 1918 block: 192.168.x.x, 10.x.x.x, or 172.16.x.x–172.31.x.x.
  • Clean Single NAT: The WAN IP is a public routable address (matches what you see when visiting whatismyipaddress.com).

How to Solve Double NAT: The Proper IP Passthrough Method

AT&T fiber gateways do not offer a traditional “Bridge Mode” toggle. Instead, AT&T provides IP Passthrough, which directs the gateway’s public IP address directly to the WAN MAC address of your Orbi while bypassing its internal NAT routing table.

⚠️ Note on Subnets: The AT&T gateway typically operates on 192.168.1.x (or 192.168.5.x). Netgear Orbi routers automatically detect this upstream network and shift their own internal network to 10.0.0.x to prevent routing conflicts.

Follow these steps to eliminate the second NAT layer:

Step 1: Record Your Orbi’s WAN MAC Address

  1. In the Orbi web interface (orbilogin.com), go to Advanced > System Information.
  2. Note the WAN MAC Address (labeled “Internet MAC” or “Router MAC”). You will need this to identify the router inside the AT&T gateway.

Step 2: Access the AT&T BGW620-700 Gateway

  1. Connect a computer directly to one of the LAN ports on your AT&T gateway (or connect to its default Wi-Fi).
  2. Open your web browser and go to http://192.168.1.254.
  3. When prompted, enter the Device Access Code located on the physical sticker of the BGW620-700.

Step 3: Configure IP Passthrough

  1. Click the Firewall tab in the top navigation bar, then select IP Passthrough.
  2. Set Allocation Mode to Passthrough.
  3. Set Passthrough Mode to DHCPS-fixed.
  4. In the Device List dropdown, locate and select your Orbi RBE971 (match the MAC address you retrieved in Step 1). If it does not appear in the dropdown list, select Enter MAC Address and manually paste your Orbi WAN MAC into the Passthrough Fixed MAC Address field.
  5. Click Save at the bottom of the page.

Step 4: Disable Redundant Gateway Features

To prevent Wi-Fi channel crowding and latency issues:

  1. Disable AT&T Wi-Fi: Go to Home Network > Wi-Fi > Advanced Options. Turn both the 2.4 GHz and 5 GHz Wi-Fi radios to Off and save.
  2. Disable Packet Filters (Optional but Recommended): Under Firewall > Packet Filter, click Disable Packet Filters to prevent double-filtering of traffic that your Orbi firewall will handle.

Step 5: Power-Cycle Both Devices in Sequence

For the public WAN assignment to propagate via DHCP, reboot in this specific sequence:

  1. Power off both the AT&T Gateway and the Netgear Orbi.
  2. Turn on the AT&T BGW620-700 first and wait 3–5 minutes until the status lights turn solid green/white.
  3. Turn on the Netgear Orbi RBE971.
  4. Log back into orbilogin.com. Verify that the Orbi’s WAN/Internet IP is now displaying your AT&T public IP rather than an internal 192.168.1.x address.

What If You Follow The Above Steps, But the Orbi Still Shows An Internal IP And Not Your Public One

It can happen at times that even following the correct steps above, you are still double natting and the Orbi Router refuses to obtain your real public IP (The one that matches what you see when visiting whatismyipaddress.com). Now we will explore possible reasons and ways to fix them.

Since your AT&T BGW620-700 has the correct settings and switching modes didn’t break the lock, we are dealing with a known AT&T firmware quirk. The gateway’s internal DHCP server is holding onto that 192.168.x.xx lease and refusing to serve the public WAN IP to your Orbi.

Because your Orbi’s internal network is already isolated on 10.0.0.X, you can break this stalemate by clearing the gateway’s device table and manually changing the AT&T gateway’s local subnet.

Step 1: Clear the AT&T Gateway Device Table

The gateway might be trying to assign the public IP to a ghost lease or a different interface.

  1. Log into your AT&T Gateway (192.168.1.254).
  2. Go to Device > Device List.
  3. Click the Clear Device List or Rescan button. This wipes the active lease cache and forces the gateway to re-evaluate the connected Orbi.

Step 2: Change the AT&T Gateway’s Internal Subnet

When the AT&T gateway and the router try to negotiate passthrough, the fact that the gateway’s default local IP (192.168.1.254) is close to the lease it’s handing out (192.168.1.65) can cause routing conflicts inside the gateway’s firmware. Changing the AT&T local range forces it to reset its routing tables completely:

  1. On the AT&T Gateway interface, navigate to Home Network > Subnets & DHCP.
  2. Look for Device IPv4 Address (which should currently be 192.168.1.254).
  3. Change it to 192.168.2.254.
  4. Under the DHCP Server settings on that same page, change the DHCP Start Address to 192.168.2.64 and the DHCP End Address to 192.168.2.253.
  5. Click Save.

Note: Your browser will lose connection to the gateway. To log back into the AT&T gateway in the future, you will now use 192.168.2.254.

Step 3: Pull the New IP

Once the AT&T gateway finishes saving those subnet changes:

  1. Turn your Netgear Orbi completely off, wait 30 seconds, and turn it back on.
  2. Log into your Orbi at 10.0.0.1 (or http://orbilogin.com ) and check the WAN IP.

By shifting the AT&T gateway to the 192.168.2.X block, you break the sticky lease. The gateway will now either hand your Orbi the true public WAN IP, or at the very worst, a 192.168.2.X address. If it lands on a 192.168.2.X address, you can safely go into the AT&T Passthrough screen (now at 192.168.2.254), select the new Orbi MAC signature, and reboot to successfully lock in the public WAN IP.

Possible Conflicts and Warnings from the ATT Gateway While Doing The Above

Hopefully at this point your problem has been solved. However, it can happen in certain network topologies that while following the previous steps and attempting to set up this configuration, you might receive this warning from the ATT Gateway:

You have fixed IP allocations that conflict with the proposed DHCP Server Range Warning: This DHCP change will result in the Home and Guest network IP address ranges overlapping, giving Guest network devices access to the Home Network.

This warning happens because of two separate issues overlapping on your AT&T BGW620-700:

  • The Sticky Lease/Allocation Conflict: Your previous configuration has a “fixed allocation” locking your Orbi to the 192.168.1.65 address. The gateway will not let you change the main subnet until that active assignment is removed.
  • The Guest Network Overlap: The gateway has a separate configuration block for a “Guest Wi-Fi” network that is hardcoded to use the 192.168.2.X range by default. Moving your main home network to 192.168.2.X causes them to collide.

To bypass this safety block cleanly, follow these steps in order:

Step 1: Temporarily Turn Off IP Passthrough

To wipe out the fixed IP conflict, we need to temporarily stop the gateway from trying to assign that passthrough profile.

  1. On the AT&T Gateway, go back to Firewall > IP Passthrough.
  2. Change the Allocation Mode back to Off.
  3. Click Save.

Step 2: Use a Different Subnet Range (Bypasses the Guest Network Error)

Instead of fighting the guest network on the 192.168.2.X block, we will jump to a completely different private network block like 192.168.5.X. This bypasses the guest network error completely.

  1. Navigate to Home Network > Subnets & DHCP.
  2. Change Device IPv4 Address to 192.168.5.254.
  3. Under the DHCP Server settings on that same page, change the fields to match the new block:
  4. Click Save.

(Note: Your browser will lose connection. To log back in, go to your address bar and type 192.168.5.254).

Step 3: Re-enable IP Passthrough

Now that the subnet is completely shifted and the old allocation conflicts are broken, we re-apply your configuration:

  1. Log into the AT&T Gateway at its new address: 192.168.5.254.
  2. Go to Firewall > IP Passthrough.
  3. Set Allocation Mode to Passthrough.
  4. Set Passthrough Mode to DHCPS-fixed.
  5. Select your Orbi’s MAC address from the dropdown list (or select Manual Entry and type it in).
  6. Click Save.

Step 4: Final Reboot

  1. Turn off your Netgear Orbi.
  2. Unplug the AT&T Gateway from power for 10 seconds, then plug it back in. Wait 3 minutes for it to fully load up.
  3. Turn your Netgear Orbi back on.

Log into your Orbi at 10.0.0.1—the 192.168.1.65 lease will be broken, and it should finally pull your external public IP address!

While doing the above, You Might Find An IP Allocation Problem

The error “You have fixed IP allocations that conflict with the proposed DHCP Server Range” means the AT&T gateway is blocking you because it still has an active rule explicitly mapping a device to an address starting with 192.168.1.X (such as your Orbi’s sticky 192.168.1.65 lease).

The gateway’s firmware will not let you shift the main pool to 192.168.5.X while an explicit, old static assignment exists anywhere in the system.

How to Cleanly Clear the Conflict and Change the Subnet

To fix this, we need to locate and delete the specific IP allocation rule holding onto the 192.168.1.X address before changing the subnet.

Step 1: Remove the Fixed IP Allocation Rule

  1. Look at the tab menu at the very top of your screenshot. Click on the rightmost tab under Home Network called IP Allocation.
  2. Scroll through the list of devices until you find your Netgear Orbi (or the device mapped to 192.168.1.65).
  3. Click the Delete, Clear, or Release button next to that specific device allocation entry.
  4. Go to Firewall > IP Passthrough and verify that Allocation Mode is completely turned Off for now. Save changes.

Step 2: Clear the Device Cache

  1. Click the Device tab at the top left of the page, then select Device List.
  2. Click the Clear Device List or Rescan button. This fully forces the gateway to drop any memory of old active connections.

Step 3: Change the Subnet to 192.168.5.254

  1. Go back to Home Network > Subnets & DHCP (the page in your screenshot).
  2. Input your desired values again:

  • Device IPv4 Address: 192.168.5.254
  • DHCPv4 Start Address: 192.168.5.64
  • DHCPv4 End Address: 192.168.5.253

Finally, click Save at the bottom. The warning highlight will disappear, and the settings will successfully save.

Step 4: Re-enable IP Passthrough

  1. Log back into your gateway at its new management IP: 192.168.5.254.
  2. Go to Firewall > IP Passthrough.
  3. Turn Allocation Mode back to Passthrough, set it to DHCPS-fixed, select your Orbi’s MAC address, and click Save.
  4. Power-cycle your Orbi router.

One Final Issue To Finally Get Rid of Double NAT Once and For All

Unfortunately, we could still find ourselves in a situation where, after following all the steps above, the Netgear Orbi might still not be pulling the public IP, but don’t despair; follow the steps below to finally and once and for all fix the double NAT issue.

The good news is that you should have by now successfully broken the old sticky network lock, moved the AT&T gateway’s local subnet to 192.168.5.254, and your Orbi router has properly grabbed a brand new local IP (192.168.5.XX).

Seeing the entry automatically pop back up under IP Allocation is normal. Because your Orbi is plugged in, the gateway detected it right away and assigned it a standard dynamic IP address from its fresh new pool.

Since the gateway’s IP pool is completely updated, you can now cleanly activate the true public IP passthrough by binding it to this new lease.

Step 1: Match the Allocation Setting to Your IP Passthrough Rules

Right now, your screenshot shows that under New Allocation, the gateway is set to “Address from DHCP pool”. This means it is still treating your Orbi as a regular home client rather than passing the public IP through.

  1. In the New Allocation dropdown menu shown in your screenshot, click the dropdown box.
  2. Select “Passthrough” from the list (if “Passthrough” is not in that specific dropdown, leave it as Address from DHCP pool and proceed to Step 2).
  3. Click Save at the bottom left.

Step 2: Lock in IP Passthrough Mode

  1. Click on the Firewall tab at the very top menu, then choose IP Passthrough.
  2. Verify that Allocation Mode is set to Passthrough.
  3. Verify that Passthrough Mode is set to DHCPS-fixed.
  4. In the Passthrough Fixed MAC Address list, select your Orbi’s MAC address (94:18:65:f8:fc:ef).
  5. Click Save.

Step 3: Force the Final Handoff

To completely get rid of the 192.168.5.64 address and swap it out for your public WAN IP, the Orbi must request an IP update one last time now that all the rules are perfectly aligned:

  1. Keep your AT&T gateway running.
  2. Go to your computer or phone connected to your Orbi network and log into the Orbi page at 10.0.0.1.
  3. Go to the ADVANCED tab > Connection Status.
  4. Click the Disconnect / Release button, wait 10 seconds, and then click Connect / Renew.
  5. (Alternative): If you cannot find the release/renew buttons, simply unplug the power cable from the back of your Netgear Orbi router, wait 30 seconds, and plug it back in.

Once the Orbi finishes reconnecting, check its status page at 10.0.0.1. The 192.168.5.X address should completely disappear, replaced by your true public internet IP address! (The same one you see when you visit https://www.whatismyip.com)

I hope that this article will help and guide you in solving your double NAT situation with your AT&T Gateway and your Netgear Orbi router. If you have any questions, do not hesitate to leave a comment with any questions or concerns you might have, remembering to follow the rules. 🙂

5 1 vote
Article Rating
Subscribe
Notify of
guest

This site uses User Verification plugin to reduce spam. See how your comment data is processed.

| Let's keep the conversation clean please; read the discussion rules.

0 Comments
Newest
Oldest Most Voted
0
Would love your thoughts, please comment.x
()
x