IP Passthrough Guide: Setup, vs Bridge Mode & Fixes
What is IP passthrough? Learn how IP passthrough works on AT&T & Verizon, differences vs bridge mode and DMZ, how to fix double NAT, and ports.
Quick Answer
IP Passthrough is a gateway mode that passes the ISP’s public WAN IPv4 address directly to a secondary router connected behind it, eliminating Double NAT while preserving the upstream gateway’s modem and voice functions. Unlike true Bridge Mode, the primary gateway still tracks network sessions in its internal NAT table. If port forwarding fails after configuring IP Passthrough, or if upstream Carrier-Grade NAT (CGNAT) prevents public access, using a VPN is remarkably simple—just install the app and toggle a switch. Proton VPN features a dedicated Moderate NAT mode to help gamers join lobbies effortlessly, while PureVPN supports full port forwarding to host rooms and local servers.
Why You Need IP Passthrough: Taming the ISP Gateway
You upgraded your home network with a high-performance Wi-Fi 7 or mesh router—perhaps an Asus ROG, Netgear Nighthawk, or UniFi Dream Machine. You plugged it into your AT&T Fiber or Verizon Fios optical terminal gateway, expecting blazing speeds and full control over your local network.
Instead, you hit a wall: your PlayStation or Xbox reports Strict NAT (NAT Type 3), your Plex media server refuses remote connections, and online port scanners show your forwarded ports as "Filtered" or "Closed".
You are stuck in Double NAT. Because modern ISP fiber gateways (like the AT&T BGW320 or Verizon CR1000A) combine a modem, router, and VoIP terminal into one locked appliance, you cannot simply switch them into standard bridge mode. This is where IP passthrough mode comes to the rescue.
What Is an IP Passthrough? (Direct Definition)
IP passthrough is a specialized router gateway mode that assigns the provider’s public WAN IPv4 address directly to a designated secondary router on the local LAN. By passing the public IP through, inbound internet packets bypass the gateway’s address translation layer, eliminating Double NAT while allowing your personal router to handle all firewall rules, port forwarding, and local DHCP.
Eliminate Double NAT on cascaded routers
Passed via DHCP (DHCPS-fixed) to 1 device
Maintains ISP landline phone & TV services
IP Passthrough vs Bridge Mode vs Port Forwarding vs DMZ
Many users confuse IP passthrough with bridge mode or think it operates identically to port forwarding or router DMZ. Here is how they stack up at the packet level:
| Feature | IP Passthrough | True Bridge Mode | Port Forwarding | Router DMZ |
|---|---|---|---|---|
| Primary Gateway Role | Modem + internal NAT session tracking; WAN IP shared with downstream router | Transparent Layer 2 MAC bridge; routing and NAT completely disabled | Normal NAT router; selectively forwards specific incoming port numbers | Normal NAT router; forwards all unmatched incoming packets to one private IP |
| Downstream Router WAN IP | Receives the true public IPv4 address via DHCP (e.g. 76.x.x.x) | Receives the true public IPv4 address directly from ISP DHCP/PPPoE | Receives a private LAN IP (e.g. 192.168.1.50) causing Double NAT | Receives a private LAN IP (e.g. 192.168.1.100) causing cascaded NAT |
| ISP Gateway VoIP & TV Support | Fully Preserved (AT&T Voice and IPTV stay functional on gateway ports) | Usually Disabled or Broken on combined carrier gateways | Fully Preserved | Fully Preserved |
| Double NAT Elimination | Yes (inbound traffic passes directly to secondary router) | Yes (modem acts purely as physical media converter) | No (two independent NAT layers process every packet) | Partial (still runs two NAT tables; frequent UDP session desync) |
| Gateway State Table Usage | Still consumes gateway NAT translation table entries (conntrack) | Zero gateway state table usage; secondary router handles all sessions | Consumes gateway NAT table | Consumes gateway NAT table |
| Configuration Complexity | Moderate: Requires MAC binding, Wi-Fi disabling, and subnet shifts | Simple if available, but locked on many modern fiber ONTs | Tedious: Requires port-by-port mapping on both cascaded routers | Simple to toggle, but creates major security and UDP gaming risks |
Understanding IP Passthrough Allocation Modes
When configuring IP passthrough on AT&T BGW320, BGW210, or NVG gateways, you will encounter the Allocation Mode dropdown. Selecting the correct mode is critical to ensure connection stability after gateway reboots:
The gateway statically binds the public WAN IP to the exact MAC address of your personal router. Whenever your router requests a DHCP lease, it always receives the public IPv4.
The gateway delivers the public IP address to the first Ethernet device that connects and requests a DHCP lease.
You manually enter the public IP, subnet mask, default gateway, and DNS servers into your personal router WAN interface.
Interactive IP Passthrough & Double NAT Troubleshooter
Select your hardware setup and network characteristics to evaluate whether IP passthrough can fix your connection or if upstream carrier limits block your ports:
The physical hardware provided by your ISP.
Check your personal router WAN status page.
The router managing your internal home devices.
Your gateway has a genuine public IPv4 address. IP Passthrough will successfully deliver incoming internet traffic to your secondary router without double address translation.
Configure DHCPS-fixed on your gateway, turn off gateway Wi-Fi to prevent radio interference, and create port forwarding rules exclusively on your secondary router.
For gaming, Proton VPN provides an instant Moderate NAT boost. For multi-service homelabs, PureVPN provides full port forwarding without risking gateway table overloads.
How to Configure IP Passthrough on AT&T BGW320 & Verizon Routers
Follow this battle-tested configuration sequence to eliminate Double NAT cleanly without causing Wi-Fi conflicts or routing dropouts:
Access Upstream Gateway Management Interface
Connect a computer directly to an Ethernet port on your ISP gateway. Open your browser and navigate to 192.168.1.254 (AT&T BGW320/210) or 192.168.1.1 (Verizon CR1000A). When prompted, enter the Device Access Code printed on the gateway’s physical label.
Configure IP Passthrough Settings (DHCPS-fixed)
On AT&T, navigate to Firewall > IP Passthrough. Set Allocation Mode to Passthrough. Set Passthrough Mode to DHCPS-fixed. In the Passthrough Fixed MAC Address dropdown, choose your personal router’s WAN MAC address.
Disable Gateway Wi-Fi & Conflicting Packet Filters
Go to Home Network > Wi-Fi > Advanced Options on the gateway and turn OFF Wi-Fi operation on both 2.4 GHz and 5 GHz bands. Leaving it enabled creates 802.11 co-channel interference with your personal router. Under Firewall > Firewall Advanced, disable "Packet Filters" and "Reflexive ACL" so your downstream router handles filtering.
Reconfigure Subnets & Reboot Secondary Router
Log into your personal router (e.g. Asus, Netgear). Make sure its internal LAN subnet is different from the gateway (e.g., set your router LAN IP to 192.168.50.1). Reboot both devices. Once restarted, check your personal router’s WAN status—it should display your ISP’s actual public IP address!
Why Port Forwarding Still Fails After Enabling IP Passthrough
Many Reddit homelab and gaming threads lament: "I enabled IP Passthrough, but my server port is still closed on CanYouSeeMe.org!" Here are the 4 common reasons:
If you are on AT&T Internet Air (fixed wireless), T-Mobile 5G Home Internet, or Starlink, your WAN IP is shared among hundreds of neighbors in the 100.64.0.0/10 block. IP Passthrough passes this carrier-private IP to your router, but external incoming traffic from the public web is dropped before ever reaching your home.
After saving IP Passthrough on the gateway, your downstream router might still retain its previous private IP lease (192.168.1.64). Until you release and renew the DHCP lease (or reboot your secondary router), traffic will still route through double address translation.
Do NOT configure NAT/Gaming port rules on the AT&T gateway AND port forwarding on your Asus/Netgear router simultaneously. In IP Passthrough mode, the gateway automatically forwards all unsolicited packets to your router; configuring rules on both creates state-machine routing loops.
If you test your port by typing your public IP into a browser on a phone connected to your home Wi-Fi, the connection will fail unless your router supports Hairpin NAT (NAT Loopback). Always test from a cellular hotspot or an external online port checker.
When Gateway Tweaks Get Too Complex: The One-Click VPN Solution
Navigating gateway IP allocation modes, dealing with subnet conflicts, and debugging silent carrier dropouts can consume hours of frustration. Moreover, if your ISP has placed you behind Carrier-Grade NAT (CGNAT), even flawless IP passthrough configuration cannot open a single incoming port.
Other networking workarounds are notoriously complex, but a VPN solution is remarkably simple—just install the app and click a single feature toggle switch. An encrypted VPN tunnel establishes a direct public gateway to the internet, bypassing your ISP’s hardware limits, clearing Double NAT, and assigning a clean incoming port instantly:
Choose the right port-forwarding provider tailored to your gaming or hosting requirements:
Proton VPN
- Built-in Moderate NAT mode resolves console and PC lobby matchmaking without touching gateway settings
- Supports 1 dedicated incoming forwarded port (NAT-PMP) for self-hosting Minecraft or P2P multiplayer
- Remarkably simple: just install the desktop app and click the port forwarding toggle switch
- 100M+ accounts across privacy ecosystem, 5 independent security audits, and 30-day refund window
PureVPN
- Full port forwarding support: configure multiple simultaneous ports via member dashboard
- Ideal for hosting game servers (Minecraft, FiveM, Ark, Palworld) and exposing local services
- Completely circumvents carrier gateway NAT session exhaustion and upstream CGNAT barriers
- 3M+ users, certified no-log infrastructure, and 31-day risk-free money-back guarantee
This page contains affiliate links. If you sign up through them, NAT Checker may earn a commission at no extra cost to you.
Proton VPN includes a dedicated Moderate NAT mode specifically engineered for gaming. It supports up to 1 forwarded port (NAT-PMP) and optimizes peer-to-peer matchmaking so you can join multiplayer lobbies in Call of Duty, GTA Online, and Xbox Live without being blocked by Strict NAT.
PureVPN offers full all-port forwarding via its dedicated add-on. If you need to host game rooms (Minecraft, FiveM, Ark), expose multiple local web services, or operate a home media server behind restrictive CGNAT, PureVPN delivers the multi-port flexibility that single-port solutions cannot provide.
This page contains affiliate links. If you sign up through them, NAT Checker may earn a commission at no extra cost to you.
Frequently Asked Questions: IP Passthrough & Port Forwarding
Authoritative answers to the most common questions regarding IP passthrough, bridge mode, and gateway NAT troubleshooting.