Plex insists I'm double NAT, but I only have 1 router and 1 modem

The white box in the closet is probably a PoE injector running back to power the Ubiquiti fiber optic converter (likely the UACC-AE). So when you unplugged the “POA” line (which is really probably PoE) it powered down the converter. You could try unplugging it again and see if the lights go off on that fiber optic converter.

As far as I know those converters don’t have any NAT capability and neither do the PoE injectors if that is in fact what they are.

I went back to look at the small, white box and you are right, I put the wrong letter on it. It does say “PoE”. I did as you wrote and unplugged the only wire that ran from that modem mounted on the wall (IP tech confirmed that’s what it is), and unplugged it from the white box. As you indicated, the power to the modem switched immediately off.

So if neither of those devices have NAT capability, then I don’t know why my there is a discrepancy between what my IP address is supposed to be, and why it’s at 192.

I called the tech again, after reading all of your responses, and told him specifically that I am looking to get Plex working in the house and explained the issue to him. He said he was going to consult with a more knowledgeable tech and see if there is something else that could be the issue.

If I find a solution with tech support, I’ll post it.

I just had an idea. I do have VPN, but it’s off when I attempt to broadcast Plex. Is it possible with Nord VPN to manually put in the correct IP address? Again, I’m a novice at this sort of networking thing. Just an idea, not sure if it is possible or helpful.

Thanks for the update. Will be interesting to see the report from your ISP.

If you want to use Plex Media Server and a VPN at the same time on the same system, you must configure split-tunneling, so Plex Media Server bypasses the VPN.

Otherwise, Plex Media Server uses the VPN tunnel, and most VPNs do not support port forwarding (a quick search says Nord does not). Even if the VPN supports port forwarding, it may not be easy to make it work with Plex Media Server.

Wait to hear back from your ISP before going down the PMS via VPN route.

So I was fiddling with some settings in my router and managed to get the Private IP Address closer.

Under the LAN section of the router, I manually added 209.147.106.1 and after it updated, I tried again and the number is closer. Still doesn’t stay connected. How close of a match does it need to be? I’m wondering if this is a router configuration issue. User error, for instance? I’ll feel foolish if so.

As for VPN, I turn it off when trying to broadcast Plex. I figure I’ll try and tackle split tunneling once I managed to get this figured out.

Stop. That is absolutely the wrong path. It will not work.

The LAN side of your router MUST provide private IP addresses such as 192.168.x.y.

Wait to hear back from your ISP.

Thank you for telling me that. I’d hate to make it worse. I’ve undone what I did.

Resetting my router/modem, even the router says there’s another router.

And the $64,000 question is “Where is the second router?”

If it is not yours, then it is in the ISP network somewhere.

Ideally, the ISP provides a public, unique (not shared), IPv4 address that supports port forwarding. It does not have to be a static address, but OK if it is.

If they cannot, then hopefully they have a different solution that still works.

Otherwise, it isn’t the end of the world, but things get more complex.

What happens if you plug a PC into the LAN port on the little white box, i.e. the PoE injector? Can it access the internet and what IP address does the PC have?

If still getting the 192.168.5.x address then you need to trace that fiber optic line from the converter back to whatever it plugs into.

I did do that and listed the results above. I’ll post the results again.

After going through the router via LAN, the IP on the Windows computer nearby is 192.168.0.1

Connecting directly to the PoE Injector, bypassing the router entirely, we have 192.168.5.11

My IP address downstairs, on my iMac, begins with 192.168.0.80. This is also my Private Address, according to Plex.

The Public Address, according to Plex, begins with 209.147.

I’m at a loss.

An update, the ISP sent over someone to look at my connections, and he took a peek at Plex. Although he meant well, he didn’t quite understand Plex and was using notes from Reddit. I had to help him translate Terminal commands from how it works on Windows, vs what they are on Sequoia.

For example:

He tried the well known IPConfig. This doesn’t work on a Mac, requires more arguments. On Mac it’s ipconfig getifaddr en0, and we did that.

Instead of the ipconfig /flushdns (which he did), we had to use sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

The ISP’s tech guy they sent over told me he was recently promoted from installing the modems to tech support. Unfortunately, we spent more time trying to reset the router settings because we changed so much data in the router that it stopped working. We had to factory reset it 4 times. Yeah, I know, probably a case of Dumb and Dumber.

My brother sent me a screenshot of his Plex (lifetime member as well). I told him I wanted to see what a working Remote Access looks like. His looks similar to mine.

This is what his looks like:

And mine, after the tech guy’s visit (and restarting the router several times, and those commands listed above):

Do you guys think this could be a router issue? Something not configured correctly? Just posting questions. Hopefully, this helps somewhat.

Also, When I enable remote access, it will show as connected. However, if I click on other settings, after 3 or 4 clicks, I’ll see that the red exclamation point returns. This thing:

I really appreciate the help from all of you. I’m sure it’s exhausting.

Did you ever ask your ISP if they employ CG-NAT? I posed this as a possibility in my initial response. Everything you’ve described suggests this may be the case. Per my initial post, the IP range set aside specifically for CG-NAT is 100.64.0.0/10. However, there is no reason why they could not use any private range (RFC-1918) for this: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.

Some router, either on your premises or on the ISP side, is handing out those 192.168.5.x ip addresses. This is causing a double-NAT situation.

1 Like

If you are getting 192.168.5.11 when essentially plugged directly into the fiber optic converter, then there is another router on the other end of that fiber. What kind of gateway address do you get when plugged directly in and can you see a web page login (with identifying brand or model) by entering that number into a browser?

Do you know where that fiber goes? Is it going into an outdoor box on the outer wall of your house? Are there any powered electronics inside there? Are you in an apartment complex with a router feeding all the apartments?

If there are no more electronics between your fiber converter on the inside and the ISP, then it pretty much has to be CG-NAT like @pshanew suggested.

Not a problem with the TP-Link router.

When you take the router out of the loop you still have the 192.168.5.x address instead of a 209.147.x.y address.

That is normal and misleading.

Remote access is never working. Plex “optimistically” says it is working, but it is still trying to initialize things. When the process fails, it returns to “unavailable” status.

If the process were working, Plex would continue to show “fully available…” after two or three minutes.

Agree with @pshanew & @kamhouse. There are still some unknowns that need to be figured out.

  • Ask the ISP if they’re using CG-NAT. It is used in some ISP networks to conserve IP addresses (there is a limited supply). Knowing this will help to understand what is happening and what options are available.

  • Ask if they can provide a public, unique (not shared), IPv4 (not IPv6) address that supports port forwarding. EDIT: To be clear, the ISP will not need to configure port forwarding in their equipment, they just cannot block it from working. The port forward will be configured in your TP-Link router.

2 Likes

Thank you guys for the replies.

Sorry for missing the CG-Nat thing. I’ll call the ISP first thing Monday and ask them about that.

I live in a house, not an apartment building.

I did go outside and there is a box on the outside wall, where their modem is. I didn’t open the box on the outside.

I called them again. He said they are, indeed, using CG-NAT. However, since I’ve designated a public, unique IP address, the CG-NAT is bypassed, per the tech.

He is giving me a different IP address. When I asked him the 2nd question listed, the question regarding them providing a public, unique (not shared) IPv4 address, he says that due to CG-NAT, that their system is unable to do so. If I understood him correctly. I read to him the question.

He’s going to send me a new IP, Gateway, Subnet Mask (usually the same).

With this new info, which he said the router will automatically do for me, do I add the new IP Address to the port forwarding, with port 32400?

I hope I didn’t mess up with the questions.

I’ll return and report what’s happened.

Thank you all for your patience with me so far.

Unfortunately, not every ISP can provide such an address. Still, providing a public IP address is better than a private IP address.

After they reconfigure things with their equipment, the TP-Link routing table will show a public IP network instead of the 192.168.5.x network & addresses (as shown in an earlier post).

Configure a port forward statement in the TP-Link router, but know that Plex may still complain about a double-NAT situation (that’s the nature of CG-NAT networks).

You will not add the new IP address to the port forward statement.

Different routers use different terms when port forwarding:

  • External / Public / Service Port: 32400 (default, leave it that way for now)
  • Public / Source IP: blank/all. Not shown on all routers. If it is not, then not a problem. You want to allow all IP addresses, as you will not always know the IP address of the remote device (ex: phone moving between cells).
  • Protocol: TCP (All/Both adds UDP, which neither hurts nor helps).
  • Internal Port: 32400 (always)
  • Internal IP Address: The IP address of your Plex server (192.168.0.80 per earlier posts).

In Plex Media Server Settings → Remote Access

  • Check the box to manually specify public port
  • Use the default, 32400.

Then try and enable remote access and see what happens.

1 Like

So when setting up port forwarding, is there something I need to select for Service Name? I deleted my old entry. I typed in the word “Plex” after “Service Name”.

When I click on “Common Services”, it shows a list of options, none of which are Plex.

I normally type Plex, where the red “This field is required”.

However, if I click the “View Common Services” box, I get these options:

Am I supposed to choose one of these instead of typing in Plex? If so, I might have been my own worst enemy here. Which of these should I choose if not typing in Plex? I assumed it was just a way to identify this specific port forwarding entry. I’m beginning to wonder if this is the reason for my troubles. Well, one of the reasons.

The “Service Name” box is just for your reference.

“Common services” is just a shortcut to allow very common ports (those listed) to be forwarded.

No. Just forward TCP port 32400 (external and internal for now) to your Plex server (Device IP Address).

I must be doing something wrong.

The IP address he sent me begins with 209.147, however, it isn’t listed anywhere inside the router. Only the 192.168…

Port forwarding is not having any result with Plex, either.

Perhaps I am looking in the wrong place in the Router settings.

He sent me, via email, the IP address, Gateway, Subnet, and even the DNS. I’m not sure if I’m supposed to manually add that info into the router. If I am supposed to add it, not certain where. There are many places to add info.

I tried adding it under the DHCP Server tab. Router wouldn’t connect to the internet.

I added it under the Internet setting, by changing Internet Connection Type from Dynamic IP to Static, then filling in the blanks. The Router wouldn’t connect to the internet.

I believe I tried changing the IP address under the LAN tab (only lets you change IP Address and subnet mask), I believe it also didn’t connect to the internet.

Of course, those tests were done with the previous IP info he sent me.

Based on what I’ve written, can you see what I’m doing wrong? I’m thinking it’s an issue of me not configuring the router correctly.

I’ll post the logs again, maybe some change.

I’m beginning to wonder if Plex is incapable of being reached by remote access at all, on this computer. Perhaps just something that simply will not work no matter what I try.

Well. I’ll keep trying, I guess.

I appreciate all the help. I know it’s probably been frustrating for you all.

Seems we’ve exhausted all methods of fixing this issue at all. Could be a Mac Sequoia issue, or the router just will not, or the ISP. I’m at my wits end with this problem. I’ve never had so much trouble getting something to work.

Plex Media Server Logs_2025-08-19_15-52-34.zip (3.3 MB)