How The Router gets Internet
There is a fiber optic network underground in the area. The ISP brings a fiber cable from the street to my house. That cable terminates at a small box called an ONT — Optical Network Terminal, in this case a Huawei unit. The ONT converts the fiber signal to ethernet, and through the ISP's router I get internet.
What the ISP Router Normally Does
The ISP router is not just a Wi-Fi box. It does several things at once.
PPPoE authentication: In Greece, most FTTH connections use PPPoE — Point-to-Point Protocol over Ethernet. When the router boots, it logs in to the ISP using a username and password. This is how the ISP knows you are a paying customer and assigns you a public IP address. With EON, the PPPoE connection also requires a specific VLAN ID — 835. The router tags its outgoing traffic with this VLAN ID so the ISP network can route it properly.
NAT (Network Address Translation): The ISP gives you one public IP address. But you have many devices — phones, laptops, smart TVs. NAT allows all of them to share that single public IP. The router keeps track of which device requested what and routes the responses back. So inside the house every device has its own IP, but outside the house they all share the same one.
DHCP: The router assigns private IP addresses to your devices. When your phone connects, it gets something like 192.168.1.5 from the router.
Firewall: The firewall controls network traffic. Who can communicate with whom.
Wi-Fi: The built-in radios broadcast one or two networks. Modern routers have a 5G network and a 2.4G network.
Most people never change any of this. They plug in the ISP router, it connects automatically, and everything works.
Why Use Your Own Router?
The ISP router has limited features. Beyond its basic firewall, it does not support VLANs , VPN Server, or DDNS. Its Wi-Fi is mediocre and it does not support access points with roaming. My solution was to use a UniFi Cloud Gateway Ultra (UCG). But the moment I connected the UCG to the ISP router, I ran into a problem that many people discover too late: double NAT.
What Happens If You Put Your Own Router Behind the ISP Router?
This is what I did initially. I plugged the UCG Ultra into one of the LAN ports of the Nova router. The UCG got a private IP from the Nova router — something like 192.168.1.2 — and started running its own network behind it. Everything seemed to work. Devices connected. Internet loaded. But in reality I had two networks running one behind the other. The Nova router was doing NAT, assigning IPs, and running its own firewall. The UCG was also doing NAT, assigning IPs, and running its own firewall. Two routers, both trying to manage the network, one on top of the other.
The result: double NAT. And with it, a series of problems that are not immediately obvious but become blockers the moment you try to do anything beyond basic browsing.
What Is Double NAT?
NAT — Network Address Translation — is what lets all your devices share one public IP. Your laptop makes a request, the router remembers which device made it, translates the source address to the public IP, and when the response comes back, it routes it to the right device. Double NAT means this translation happens twice. Once on the ISP router and once on the UCG. Your device's traffic gets translated by the UCG, then translated again by the Nova router before it reaches the internet. For basic browsing, this works fine. You open a website, the request goes out through two NAT layers, and the response comes back. No visible problem. But it breaks down for anything that needs a direct connection from the outside: VPN: I run WireGuard VPN on the UCG so I can access my home network remotely. With double NAT, VPN clients try to connect to my public IP, but that IP belongs to the Nova router — not the UCG. The traffic arrives at the Nova router, which has no idea what to do with it. The VPN connection fails unless I configure port forwarding on both routers.
DDNS: Dynamic DNS keeps a domain name pointed at my home IP. But with double NAT, the UCG sees a private IP (192.168.1.2), not the real public IP. It cannot update DDNS correctly because it does not know what the public IP is.
Port forwarding: If I want to forward a port — say for a game server or a service — I need to forward it on the Nova router to the UCG's IP, and then forward it again on the UCG to the actual device. Two layers of forwarding. If either one changes, it breaks.
The fix is to make one of the routers stop being a router. That is what bridge mode does.
What Bridge Mode Means
Bridge mode tells the ISP router to stop being a router. In bridge mode, the ISP router does not do NAT. It does not assign IP addresses. It does not run a firewall or serve Wi-Fi. It becomes a passthrough — a bridge between the ONT and whatever is connected to it.
The PPPoE authentication — the login that gets you a public IP — still needs to happen. But now it is the UCG's job. The UCG sends the PPPoE credentials (username, password, VLAN ID 835) to the ISP. The ISP assigns the public IP to the UCG.
The result: the UCG holds the real public IP. One router does everything. No double NAT.
The Nova router is still physically in the chain because the ONT connects to it and some ISPs in Greece require it in the path. But it does not make decisions anymore. It just passes traffic through.
Option 1: UniFi Behind the ISP Router
Not everyone needs bridge mode.
If your needs are simple — you browse the web, stream video, connect some devices, and do not need VPN, port forwarding, or DDNS — then keeping UniFi behind the ISP router works fine. The UniFi gear still gives you better Wi-Fi, better visibility, and better control than most ISP routers. The trade-offs are the following:
Double NAT is present but invisible for basic use
VPN will not work without extra configuration on both routers
DDNS may not point to the correct IP
Port forwarding requires two steps
The ISP router's DHCP and the UCG's DHCP can sometimes conflict
For a lot of people this is fine. They never need VPN or remote access. They never forward a port. The ISP router handles the WAN, UniFi handles the LAN, and that is it.
I did this for the first few weeks. It worked. Then I tried to set up WireGuard VPN and hit the double NAT wall.
Option 2: ISP Router in Bridge Mode
This is what I switched to. The ISP router becomes a bridge and the UCG takes over. In this setup:
The UCG handles the PPPoE login to the ISP.
The UCG gets the real public IP.
The UCG manages routing, NAT, DHCP, firewall, VLANs, VPN, and DDNS.
The ISP router passes traffic and nothing else.
Everything lives in one place. One firewall, one DHCP, one VPN, one set of VLANs..
It does need some prep though. You need the PPPoE credentials from your ISP, you need the VLAN ID for the WAN, and you need to configure the ISP router into bridge mode in its admin panel.
Benefits Of Bridge Mode
The first thing I noticed: the UCG's WAN page showed a real public IP instead of 192.168.1.x. That confirmed bridge mode was working. After that:
VPN worked immediately: WireGuard on the UCG accepted connections from the internet without any port forwarding hacks. I configured it once, scanned the QR code on my phone, and I was connected to my home network within minutes.
DDNS pointed to the right IP: The FreeDNS updater on the UCG started reporting the correct public IP. When the ISP changed my IP — which happens every few days — the DDNS record updated automatically. VPN kept working because it used the domain name, not the IP.
Speed stayed the same: Some people worry that bridge mode reduces performance. It did not. My connection still tests at the full 500/250 Mbps. If anything, removing a layer of NAT reduces overhead slightly.
The network diagram got simpler: One routing device instead of two. Easier to troubleshoot, easier to explain, easier to maintain.
What About ISP Wi-Fi?
In bridge mode, the ISP router's Wi-Fi is usually disabled. If it is not, you can disable it yourself from the ISP router's settings.
This means you need your own devices to set up Wi-Fi networks. I use three UniFi U6+ access points for Wi-Fi coverage. They are managed by the UCG and are much better than any ISP router's built-in radios. Multiple SSIDs mapped to different VLANs, devices roam between floors, I can connect many devices without worrying about the Wi-Fi choking, and I have consistent coverage in every room.
Where Do I Find the PPPoE Credentials?
In bridge mode the ISP router no longer handles the PPPoE login. The UCG does. That means you need three things from your ISP:
PPPoE username
PPPoE password
VLAN ID — For Nova/EON in Greece this is **835**. The UCG must tag its WAN traffic with this VLAN ID or the ISP will not accept the PPPoE authentication.
If you do not know your PPPoE credentials, call your ISP and ask. They will usually need some details to verify your identity. Nova gave me mine without much trouble but I have heard others in Greece had to insist or visit a physical store.
How to Configure PPPoE on UniFi
In the UniFi controller you set this under the WAN settings for the UCG:
Connection type: PPPoE
Username: your Nova PPPoE username
Password: your Nova PPPoE password
VLAN ID: 835
One warning: if you enter the wrong VLAN ID the connection just does not work. When I first set this up I had the VLAN ID wrong and spent an hour thinking bridge mode was broken. It was not. 835 was the missing piece.
My Final Network Setup
Here is what my WAN connection looks like today:
The UCG manages everything: routing, NAT, DHCP for all VLANs, firewall rules, WireGuard VPN, and DDNS updates. The Nova router sits in the chain physically but does nothing logically. The ONT converts fiber to ethernet. That is the entire WAN layer.
This is part of my Building My Smart Home series — where I document everything I built, what worked, what broke, and what I learned. Follow along for practical infrastructure posts aimed at developers who want to build real systems.
