Direct answer
For the Ubiquiti UniFi Dream Machine Special Edition, provider gateway/router mode, downstream router, CGNAT and local service state are different boundaries. First, compare both router WAN/LAN addresses and the provider-facing address.
What this covers
- Ubiquiti UniFi Dream Machine Special Edition (UDM-SE)
- UniFi network; Network application version, gateway ownership, VLANs, PoE and adoption state are part of every diagnosis.
- The specific fault this record addresses: shows double NAT or strict NAT
What it does not cover
- ×The same symptom on a different Ubiquiti product line, which has its own record and its own cited source
- ×An on-screen error code whose meaning has not been checked against this exact model's manual
- ×Live electrical, gas, sealed-system, internal battery-cell or structural repair — a technician boundary, not a self-service step
Differential
What actually causes this, and how to tell them apart
These are ordered by how often each one is the answer, not by how easy it is to try. The point of the middle column is that two causes producing the same headline symptom rarely produce the same detail — that detail is what tells you which one you have before you change anything.
- 1
The provider's gateway and your own router both do NAT
What separates it Your router reports a double-NAT warning, or its WAN address is a private range (10.x, 192.168.x, or 172.16–31.x) rather than a public one.
How to confirm Read your router's WAN IP; a private-range WAN means another router (the provider's gateway) is translating in front of it.
- 2
The provider gateway can be put in bridge/passthrough mode
What separates it The provider device is a combined modem-router that supports bridge mode.
How to confirm Where supported, bridge the provider gateway so only your router does NAT — this is the cleanest fix, though not every provider allows it.
- 3
Your own router can run in AP/bridge mode instead
What separates it You want to keep the provider's gateway as the router but still use your own hardware for Wi-Fi.
How to confirm Put your router into access-point/bridge mode so it stops doing NAT and simply extends the provider gateway's network.
- 4
It is not actually causing a problem
What separates it Everything works and double NAT was only noticed in a status page.
How to confirm Confirm something is genuinely broken before changing anything; double NAT that breaks nothing does not need a fix.
Before you touch a setting
Record this first — changing settings destroys the evidence
Every item below stops existing the moment a reset, re-pair or settings change is made. Written down first, they are what separates the causes above; recovered afterwards, they are guesswork.
- Your router's WAN IP — public, or a private range that proves a second NAT in front.
- What is actually failing: a game's NAT type, port forwarding, or a remote-access/VPN setup.
- Whether the provider gateway supports bridge mode, or you prefer to bridge your own router.
Confirm double NAT by reading your router's WAN IP
ReversibleA private-range WAN address proves a second router is translating in front.
Decide which device should do the NAT
ReversibleUsually bridge the provider gateway so your router is the single NAT.
Bridge the provider gateway, or put your router in AP/bridge mode
Reset / data riskCollapse the two NAT layers to one at whichever device you chose.
Retest the specific thing that was broken
ReversibleConfirm the game NAT type, port forward or VPN now works.
Model-specific
What is true of this model and not of its siblings
Generic advice for the product line fails here. Each item below is a property of this specific model family that changes which of the steps above apply to you.
- Model scope
- UDM-SE. UniFi network; Network application version, gateway ownership, VLANs, PoE and adoption state are part of every diagnosis.
- Type — rack GATEWAY/router with PoE, NO Wi-Fi
- The UDM SE is a rack UniFi gateway like the UDM Pro but with built-in PoE switch ports to power access points and cameras directly. It has NO built-in Wi-Fi radio, so Wi-Fi symptoms do not apply — add UniFi APs for wireless.
- PoE ports
- Its PoE ports power UniFi APs/cameras directly; a powered device not coming up can be a PoE budget or a port issue on the SE. It still needs separate APs for Wi-Fi.
- UniFi controller/app
- Managed through the UniFi Network application. Advanced (VLANs, adoption, firmware, NVR) compared with consumer routers.
- Symptom boundary
- This record covers Ubiquiti UniFi Dream Machine Special Edition when it shows double NAT or strict NAT. A different symptom on the same hardware, or this symptom on a different Ubiquiti product line, has its own record with its own causes and its own cited source.
Stop boundary
When this stops being a self-service repair
Continuing past any one of these costs more than the repair saves — in safety, in warranty, or in evidence a technician needs.
- !Do not place your router in a DMZ or disable its firewall as a substitute for fixing double NAT — collapse the NAT layers properly instead.
Evidence ledger
Sources behind this answer
Visible sources support the visible claims. Home Product Support records the publisher, the fact used and the review date; community reports can suggest an issue but do not become a published fact on their own.
Where the manufacturer's article stops. Ubiquiti Help Center publishes this as "DNAT, SNAT, and Masquerading in UniFi". Ubiquiti's own device-agnostic NAT-configuration article; no single article titled exactly "Double NAT" was found, this is the closest official one. Verified reachable via the Browser tool 2026-08-28. What that article does not carry is the model boundary — it is written for a product line, and UDM-SE is the scope applied here. Where a control label, terminal, indicator pattern or reset sequence differs on your unit, the manual for that exact model is the authority, not this page and not the article.
Exact questions
Common follow-ups
Does the UniFi Dream Machine SE have Wi-Fi built in?+
No — like the UDM Pro, the Dream Machine SE has no built-in Wi-Fi radio; it is a rack gateway/router with PoE ports. Wi-Fi comes from separate UniFi access points, which the SE can power directly over its PoE ports and which you adopt in the UniFi Network application. So there is no wireless network to troubleshoot on the SE itself; add and manage APs for Wi-Fi.
My router says I have a double NAT — is that a problem?+
Only if it is actually breaking something, such as a strict NAT in a game, a port forward that will not work, or a remote-access setup. Double NAT means two routers are each translating addresses in series — usually your provider's gateway plus your own. The clean fix is to put the provider's gateway into bridge mode so only your router does NAT, or put your own router into access-point mode so only the provider's does. If nothing is broken, you can leave it.
Does this answer apply to every Ubiquiti model?+
No. It is scoped to UDM-SE. UniFi network; Network application version, gateway ownership, VLANs, PoE and adoption state are part of every diagnosis.
What should I record before troubleshooting double NAT or strict NAT?+
Record the complete model identifier, exact message or indicator, software/firmware where visible, the operating stage and what still works.
Why is a factory reset not the first step?+
A reset can erase accounts, networks, maps, schedules or preferences without distinguishing double NAT, strict NAT. The ordered checks preserve that evidence.
When should I stop and use qualified service?+
Do not expose admin, camera or desktop services directly.
Answer for the exact device and software version shown above.