Router, modem and gateway: what each one actually does

A modem converts the signal on your ISP's line into Ethernet. A router forwards IP packets between two networks using a forwarding table. A gateway, in the sense your provider uses the word, is one box doing both of those plus NAT, DHCP, Wi-Fi and a small Ethernet switch, which is why the term tells you almost nothing on its own.

The modem converts a signal and nothing else

"Modem" contracts modulator-demodulator, and Etymonline dates the word to 1937, in reference to electrical transmission of sound and other signals. The job is to impose digital data on a carrier, then strip it off at the far end. A DOCSIS cable modem does that with radio frequency on coax, a DSL modem with the signal on a copper phone pair. Both hand plain Ethernet to whatever is plugged in, and neither knows what sits behind them.

Fiber breaks the vocabulary. The box on the wall of a fiber install is an ONT, an Optical Network Terminal. It converts light pulses to Ethernet and authenticates the line with the ISP. Hitron, which builds them, calls an ONT the fiber equivalent of a cable modem, not a modem. Installers and customers call it the modem anyway. The pedantry has a practical edge: you cannot plug a router into a fiber strand, so something must convert the light first.

Routing, NAT and DHCP are three separate jobs

RFC 1812, "Requirements for IP Version 4 Routers" (June 1995), separates a router from other packet switching devices by one property: "a router examines the IP protocol header as part of the switching process." It strips the arriving link layer header, modifies the IP header, and attaches a new one. That is routing. Nothing there rewrites addresses or hands them out.

NAT is the second job. RFC 1631 defined it in May 1994 as a stopgap for IPv4 exhaustion that could be installed incrementally, "without changes to either hosts or routers." RFC 3022 obsoleted it in January 2001 and split traditional NAT in two: Basic NAT maps addresses only, while NAPT maps tuples of local address and local port onto one registered address and a range of assigned ports. NAPT is what your home router runs, and it is why a whole household reaches the internet through one public IPv4 address. Its private inputs come from RFC 1918 (February 1996): 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, none routed on the public internet.

DHCP is the third. RFC 2131 (March 1997) defines a client-server protocol that hands a host an address plus the rest of its configuration in four messages: DHCPDISCOVER, DHCPOFFER, DHCPREQUEST, DHCPACK. What the client gets back is a lease, "the period over which a network address is allocated to a client," not a permanent assignment. A device can route without doing NAT. It can do NAT without running DHCP. Consumer firmware bundles all three behind one setting labeled router mode, and that is where most household networking trouble starts.

Two unrelated things are called a gateway

The generic term is default gateway: the router interface a host sends traffic to when the destination is not on its own subnet. RFC 1122 files it under routing outbound datagrams, a local versus remote decision followed by gateway selection. The word is a fossil. RFC 1812 notes that older Internet documents called routers gateways, "a name which more recently has largely passed out of favor to avoid confusion with application gateways." The standards dropped the word about when ISPs picked it up.

The marketing sense is the combo unit in the home, and the two collide constantly. Your own router is the default gateway for your laptop. If an ISP box sits upstream, that box is the default gateway for your router. Work out which sense a support page means before changing anything.

Double NAT happens when a router sits behind a router

Connect your own router to an ISP gateway, leave both in their default state, and you have two routers, two NAT instances, two DHCP servers and two private subnets stacked back to back. The usual shape: the ISP box leases 192.168.0.x on its LAN, your router leases 192.168.1.x behind it, and your router's own WAN address comes out of the ISP box's pool.

That is also the test. Open your router's status page and read the WAN or internet address it reports. If that address is itself inside 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16, the device upstream is doing NAT as well. A public address there means it is not.

Netgear's knowledge base names four casualties: online games, VPN connections, port forwarding and triggering, and secure websites that use SSL. A port forward may also need configuring identically on both boxes. Consoles report the same problem as a restricted NAT type.

None of which means you should rush. Browsing, streaming and video calls are outbound and tolerate it fine. Fix it when you host a service, terminate a VPN at home, or play a game that complains about NAT type.

Check for carrier NAT before blaming your own equipment

RFC 6598 (April 2012) reserved 100.64.0.0/10 as Shared Address Space, so ISP-side translation would not collide with customers' RFC 1918 addressing; the same RFC tells providers to filter it at their boundaries and keep it out of external DNS. If your router's WAN address falls between 100.64.0.0 and 100.127.255.255, your provider is translating you before a packet reaches your house.

That changes what any fix can achieve. Bridging your own ISP box removes one NAT layer, not the carrier's, so it will not hand you an inbound-reachable public IPv4 address. IPv6 is not rescuing this quickly. Google measured 50.1 percent of its users arriving over IPv6 on 28 March 2026, up from 46.33 percent a year earlier, but that was one day above the halfway mark, not a settled level, and APNIC Labs, weighting its sample differently, put global IPv6 capability nearer 42 percent in late April 2026. A dual-stack house still pushes IPv4 traffic through the same NAT layers.

Bridge mode, and how unevenly it is implemented

Bridge mode turns off routing, NAT and DHCP on the ISP combo unit and leaves signal conversion running. Your own router becomes the only device doing all three, and the double NAT is gone. What varies is whether your provider offers it, what it is called, and what it costs you.

Those rows come from provider forums and third-party ISP pages, not vendor documentation, so check your own account. Bridge mode is not one standardized feature with one name.

If your provider has no bridge mode, stop your own router from routing. Run it as an access point: turn off its DHCP server and connect the ISP gateway to one of its LAN ports, not its WAN port. The ISP box stays the only router, and one NAT layer goes away.

Why the one-box gateway keeps gaining ground

CableLabs published DOCSIS 4.0 on 26 March 2020, targeting up to 10 Gbps downstream and 6 Gbps upstream through Full Duplex DOCSIS and Extended Spectrum DOCSIS, the latter widening usable spectrum to 1.8 GHz. Six years on, DOCSIS 4.0 in a home still means an ISP gateway. Comcast's XB10 is the visible example: Xfinity calls it its first device combining DOCSIS 4.0 with Wi-Fi 7, Comcast claimed up to 300 simultaneous devices at announcement, and it went to X-Class customers on X-500 and above. Retail DOCSIS 4.0 modems were still not broadly on sale as this was written, on trade coverage rather than vendor word.

Wi-Fi pushes the same way. Wi-Fi CERTIFIED 7 arrived in January 2024 across 2.4, 5 and 6 GHz, with 320 MHz channels in 6 GHz, 4K-QAM the Wi-Fi Alliance rates 20 percent above Wi-Fi 6's 1024-QAM, and Multi-Link Operation; on 6 January 2026 the Alliance extended it to client devices using 20 MHz channels only, for low-power IoT. A current gateway is therefore a modem, a router, a NAT engine, a DHCP server, a Wi-Fi 7 access point and a switch in one shell.

Buy your own hardware anyway where the plan allows it. On DOCSIS 3.1 service at gigabit or below, a plain modem plus a router of your choosing sidesteps the bridge mode question: a plain modem has no routing to disable. Netgear's Nighthawk RS150, a dual-band Wi-Fi 7 router rated up to 5 Gbps, showed $179.99 against a $199.99 list price at the time of checking. Against a monthly rental line, that pays back inside a couple of years. Check your provider's own pricing page for the current rental figure, because equipment fees get repriced and renamed more often than the hardware changes.