This is one of the most frustrating call-outs we get, because on the surface nothing is wrong. Netflix streams in 4K. Speed tests come back at the full line rate. Everyone else in the house is perfectly happy. And yet your work VPN will not connect, or it connects and drops every few minutes, or the app for your doorbell camera works on the phone network but not on your own home Wi-Fi. We see this pattern regularly in Murrayfield, where a lot of households run a home office alongside a growing pile of smart-home kit, and the answer is almost never the thing people assume.
The short version: your Wi-Fi is fine. What has usually broken is the path through your network to the outside world, and it broke the day someone added a second router.
The Symptom That Tells You It Is Not the Wi-Fi
There is a clean diagnostic split worth learning, because it saves you an evening of moving the router around the house. Ordinary web browsing, streaming and email are all outbound connections: your device starts the conversation, and the reply comes back along the same path. Almost any network configuration will carry those successfully, which is why the household verdict is always “the internet is working fine”.
VPNs, remote desktop, security cameras, games consoles hosting a match, and network-attached storage you reach from outside all depend on something harder: a connection that either has to be initiated from outside, or that needs a stable, predictable path held open in both directions. Those are the ones that fall over. If your broken list looks like that list, stop troubleshooting Wi-Fi. It is a routing problem.
What Double NAT Actually Does to You
Network Address Translation is what lets a whole houseful of devices share one public address. Your router keeps a table of which internal device asked for what, so replies reach the right machine. One router doing this is normal and invisible.
The trouble starts when there are two. If you have kept your provider’s router and then plugged a mesh system, a gaming router or a second access point into it in its default mode, you now have two devices both translating addresses, one behind the other. Your laptop sits on a private network, inside another private network, inside the internet.
The outer router has no meaningful idea the inner one exists. So when a VPN tunnel needs a consistent path back, or a camera app tries to negotiate a direct route home, the request reaches the outer router and stops there — not with an error you can search for, but with a silent timeout. This is double NAT, and it is comfortably the most common cause of this complaint we see on home networks.
The Murrayfield Job That Made This Our First Check
A household near Roseburn called us out for what they described as bad Wi-Fi upstairs. Two people working from home, one on a corporate VPN that dropped roughly every ten minutes, and a set of outdoor cameras that had stopped being reachable while away from the house.
The Wi-Fi survey came back clean — strong signal on both bands in every room, no meaningful channel congestion. What we found instead was a three-unit mesh system installed a few months earlier, plugged into the provider’s router and left in its out-of-the-box router mode. Two layers of NAT, and a VPN client renegotiating its tunnel every time the outer router aged the session out of its translation table.
The fix took about twenty minutes and involved buying nothing: we put the provider’s router into modem-only mode, let the mesh handle routing and the address pool for the house, and rebuilt the reservations for the cameras and the network drive. The VPN has been stable since, and the cameras came back the moment there was a single translation layer instead of two.
That job is why double NAT is now the first thing we check on any “the internet works but this one thing does not” call, before we so much as look at a signal reading.
When Port Forwarding Cannot Possibly Help
Here is the judgement call that separates the bench answer from most of the advice online. Nearly every forum thread on unreachable cameras or a home server ends with “set up port forwarding on your router”. On a growing number of UK broadband connections, that instruction cannot work, no matter how carefully you follow it.
Some providers now place customers behind Carrier-Grade NAT, which means the address your router thinks is its public address is not actually unique to you — it is shared with other customers upstream. You can forward ports on your own router all evening; there is another translation layer above it that you neither control nor can configure.
The check takes thirty seconds and we do it before touching any settings. Compare the WAN address your router reports with the address a “what is my IP” site shows you. If they do not match, or if the router’s WAN address begins with 100.64 through 100.127, you are behind Carrier-Grade NAT. The answer then is not a router setting at all — it is either asking the provider for a routable address, or moving to a relay-based remote-access method that needs no inbound connection. Knowing this early stops people replacing perfectly good hardware to fix something hardware was never going to fix.
The Two Other Culprits We Find
DNS rebinding protection
Many routers block DNS answers that resolve to internal addresses, as a security measure. It is a sensible feature that also breaks corporate VPNs and self-hosted services that rely on the same hostname working inside and outside the house. The symptom is very specific: the VPN connects, reports success, and then nothing behind it is reachable by name while everything is reachable by raw address.
MTU and fragmentation
If a VPN connects and then hangs the moment you open something substantial — a large file share, a remote desktop session that stalls on the first full screen redraw — the packet size the tunnel is using may be larger than the path can carry once the VPN’s own overhead is added. Small requests succeed, large ones vanish. Reducing the MTU slightly on the router or the client resolves it, and it is a five-minute test rather than a rebuild.
Checking It Yourself, in the Right Order
Work outwards, not inwards. Confirm the problem follows the network and not the laptop by tethering to a phone — if the VPN connects instantly on mobile data, your home network is confirmed as the variable. Then count your boxes: anything between your laptop and the wall socket that has its own Wi-Fi name or its own admin page is a candidate second router.
Next, compare the router’s WAN address against your apparent public address, as above. Only after those three checks does it make sense to change any settings — and if the answer is double NAT, the correct fix is to pick one device to do the routing, not to add another. If your provider’s box turns out to be too old to offer a modem-only mode, our guide on when to replace your home router covers what genuinely warrants new hardware.
It is also worth reading our walkthrough on setting up a VPN connection in Windows 11 to rule out a client-side misconfiguration first, and if the thing failing is a work drive rather than a tunnel, the same underlying causes show up in our guide to a mapped shared drive that keeps disconnecting.
Where We Come In
Untangling a stacked home network is a visit job rather than a workshop one, because the answer lives in how the boxes are wired together. We decide which single device should be routing, then rebuild the address reservations so cameras, printers and network storage keep the same addresses afterwards — the step most often skipped, and why some people flatten their network and find the printer missing the next morning.
That work is covered by our networking and Wi-Fi service, usually as a home visit in Murrayfield, with Corstorphine, Haymarket and Roseburn on the same round — including same-day computer repair in Corstorphine where the timing works. Currie, Balerno and Livingston are on our regular run too.
If the connection that matters is a work one, we can often resolve it without a visit through remote support, and for small firms running staff from home we handle the whole arrangement under business IT support. Where a rebuild leaves a redundant router or an obsolete access point, we take the old kit away through IT recycling and e-waste disposal.
The thing worth remembering is the diagnostic split at the top. When everything works except the one connection you actually need, moving the router is not the answer. Counting the routers is.
Last updated: 19 August 2026