Need Advice on Router/Double NAT Situation With Sky Max and TP link EX75

[Dunc1]

Hi all,

I’m after a bit of advice ahead of an upgrade.

Next week I’m switching over to Sky Full Fibre (FTTP), and they’ll be installing the Sky Max Hub as part of the package. Currently, I’m on Virgin Media, running their hub in modem mode, with a TP-Link Deco EX75 system taking care of all routing, Wi-Fi, and management.

Frankly, I love the Deco setup – the control, coverage, and the way it handles my environment is absolutely spot on. I’ve got a fairly busy network at home too:

• 3 Raspberry Pi units (all on reserved IPs, on Ethernet)
• 28 other devices (smart sensors, cameras, Macs, etc.)
• Sons Gaming on both PC and Xbox (low latency matters!)
• I also need to access my network from outside — running VPNs, SSH into Raspberry Pis, and remote desktop connections.

The problem is:

I’ve read the Sky Max Hub doesn’t support modem/bridge mode.

That’s a real problem, because I want to keep the Deco EX75 running in full router mode, just like it is now — not neutered in Access Point mode, and with remote access needs, double NAT becomes a major concern — not just for gaming but for VPNs, SSH, port forwarding, and external access.

Double NAT problems in my setup:

• For day-to-day devices like Raspberry Pis (on Ethernet), smart sensors, Macs, and smart home kit: double NAT wouldn’t matter much. They talk out to the internet just fine.
• Gaming would suffer: Xbox especially hates double NAT, and online PC gaming would likely throw NAT warnings.
• Remote Access (VPNs, SSH, Remote Desktop) would break without complicated double-layered port forwarding or tunnelling.

In short, double NAT isn’t a minor irritation here — it would seriously cripple the things I need my network to do.

My ideal setup would be:

• Sky Max Hub > Ethernet > Deco EX75 (WAN port) > Everything else (Pi, Smart Home, Gaming, Remote Access)

I do not want:

• To run Deco in Access Point mode (losing router functionality)
• To have two routers fighting each other (double NAT nightmare)
• To lose my ability to VPN/SSH into my home network cleanly

Options I’m considering:

1. DMZ Option — If the Sky Max Hub supports a DMZ, I could put the Deco into it. This would shove all inbound and outbound traffic straight to the Deco, which would then behave like the real router without needing full bridge mode.
2. IP Passthrough — Some routers offer a setting to pass the public IP directly to another device. If the Sky Max Hub does, this would also work nicely.
3. Replace the Sky Max Hub — Get a third-party modem/router that authenticates using Sky’s Option 61/MER settings and plug the Deco straight into that, bypassing Sky’s kit entirely. (More complicated but clean.)

Questions I need help with:

• Has anyone successfully run a Deco (or similar) behind a Sky Max Hub without running into double NAT hell?
• Does the Sky Max Hub have a DMZ or IP Passthrough feature hidden somewhere?
• Is it still possible in 2025 to replace the Sky Hub altogether on FTTP without getting blocked by Sky?
• Any real-world experiences with Xbox gaming and remote SSH/VPNs behind Sky equipment?

 Summary:

Double NAT would break gaming and remote access for me.

I need either DMZ, IP Passthrough, or a way to ditch the Sky Hub.

I’m looking for the cleanest, most reliable way forward.

Really appreciate any advice or experience you can share!

Cheers,

Dunc

[JimM1]

@Dunc1 The new ONT for the fibre is the Ethernet connection out, AS long as you have NO need for a landline Phone from sky, then that ONT acts as the modem/bridge and you connect the Deco system direct to the ONT authenticate and you are good to go. Will read the rest off you post so see what if's. Edit:- have a quick read and also the link about in one off the post's relevant to Tp-Links. And also!

Answered: Ipv6 for Sky Full fibre | Sky Community

Has Sky removed the Option 61 requirement from non... | Sky Community

[Dunc1]

Hi Jim1,

Thanks a lot for taking the time to reply — that’s really helpful and actually makes a lot of sense.

I don’t use a landline either, so based on what you’ve said, it sounds like I could in theory just plug my Deco EX75 system straight into the ONT and bypass the Sky Max Hub altogether. That would be absolutely ideal because I want to keep full control of the network without being tied into their router.

Just one thing I’m not 100% sure on though — you mentioned authentication.

I know Sky uses DHCP Option 61 (MER authentication), but do you know if the Deco systems can handle that directly?

Have you had any experience setting it up yourself?

Or do you know if it’s a case of just entering a dummy username/password in the PPPoE settings and letting it connect?

Would love to hear a bit more if you’ve done it or seen it work.

Really appreciate your advice so far — it’s helped me get my head around it a lot clearer than Sky’s own tech support did!

Cheers,

Dunc

[Dunc1]

@Jim 

Hi Jim1,

Thanks a lot for taking the time to reply — that’s really helpful and actually makes a lot of sense.

I don’t use a landline either, so based on what you’ve said, it sounds like I could in theory just plug my Deco EX75 system straight into the ONT and bypass the Sky Max Hub altogether. That would be absolutely ideal because I want to keep full control of the network without being tied into their router.

Just one thing I’m not 100% sure on though — you mentioned authentication.

I know Sky uses DHCP Option 61 (MER authentication), but do you know if the Deco systems can handle that directly?

Have you had any experience setting it up yourself?

Or do you know if it’s a case of just entering a dummy username/password in the PPPoE settings and letting it connect?

Would love to hear a bit more if you’ve done it or seen it work.

Really appreciate your advice so far — it’s helped me get my head around it a lot clearer than Sky’s own tech support did!

Cheers,

Dunc

[JimM1]

@Dunc1 I am a Asus user myself, have been for many years, but have help with setup few people getting the Tp-Link on to the system, and appears if you follow the settings you get on with zero problems. You may find as the Tp-Link is very mobile app orientated that just using the auto find and connect works an applies the settings, i have been doing this for longer than i care to remember but web manager based using my laptops / pc's etc. manage my Tp-Links and Asus that way, not an app person / mobile at all. Always willing to help out, and you have a link now to @Danny11616 who has just done the Deco but not sure what model he has, but sure time permitting would be glad to take a look settings wise at his if you run into issues. 

Will be putting my Asus Router's direct onto the ONT shortly, still helping out and keeping my SR203 upfront at present as it is the only router that SKY can look at if you have issues and since returning to sky only 7 weeks ago best for me to see what they think operational wise so NO issues with there Router to date, and really have never once had to call them, Fibre control is now way different, but it is all exchange equipment that control's what is needed, that is the black box hole.

Looks like you have a good handle on what is going on so go for it, best advice set up your SKY router as a fall back as a JIC you need it, NOT a sky Max user, way to tied into system for operation, having done so with the EE router where you had to do something's with the stupid app, NEVER going down that rabbit hole ever again. Help with the Max will be down to some other user to stand up, know what i mean, you may even be the person once you have played....

[JimM1]

@Dunc1 This is what sky SR203 Router is up see the hours run once the picture is cleared for general viewing.

SR203 runtime online FF500

[Danny11616]

@Dunc1 If you are still looking for some help I can help you out. I can confirm I only have my deco X50 connected to the ONT terminal and this is providing the network to the whole house. I would recommend setting this up from the beginning again and facotry reset the deco's so that it can connect and configure everything it should. 

As for the internet connection part I had to work out how to get ipv6 working on my network and this is the setup I have done which is now working properly. 

Ipv4 - Dynamic IP (This will work just fine without ant problems)

Ipv6 - Dynamic IP (You will then need to go into internet settings to set the following) Get Ipv6 address - Seamless | Prefix Delegation - Enabled | DNS address - Auto | Assigned Type - DHCPv6

The DNS for the Ipv6 will not populate due to the Sky servers using Ipv4 servers so don't worry if this doesn't appear. As for the other settings on the Deco I haven't really touched anything else apart from optimising the network so it works properly once all of the Decos have been setup around the house. I am looking to possibly get a wifi 7 one to be the main router as it will have more powerful antenas than the one I currently have setup so that the signal is stronger but that is my prefence. Hopefully this helps. 

[JimM1]

@Danny11616 Thanks for posting up... Jim

[Dunc1]

Hi @JimM1 , hi @Danny11616 , thanks both for taking the time to reply — really appreciate the help.

I’m still working through my options, and you’ve both given me a lot to think about.

Jim — can I just ask which Asus router you’re using at the moment?

The ones I’m currently considering are either the RT-AX82U or the RT-AX86U Pro.

I’m trying to work out if I need the more expensive Pro model, or whether the AX82U would be enough for me in reality.

At the moment, the maximum Sky Fibre speed here is 900 Mbps, which both routers can easily handle.

However, I’m pretty sure Sky will eventually bring out faster packages — maybe 1.2Gbps, 1.4Gbps — and part of me thinks if I’m spending on a new router now, I might as well future-proof properly rather than regret it later.

Danny — it sounds like you’ve gone straight from your Deco X50 into the ONT without any additional router at all.

That’s interesting, and it makes me wonder if I’m over-complicating it by thinking I need an Asus router at all.

If you don’t mind me asking both of you a few questions:

To Jim:

• What Asus model are you running right now?
• Are you planning to go direct onto the ONT yourself when you’re ready, or keep the Sky router involved as a fallback?

To Danny:

• Was it straightforward setting up the Deco X50 directly on the ONT, or did you have any fiddly issues (like needing a Sky username/password)?
• How’s your performance been since doing it — stable speeds, no dropouts, no double NAT issues?

I’m trying to get it right first time rather than going round in circles — and you’ve both helped massively already.

Thanks again for your advice!

[JimM1]

@Dunc1 Current Asus is 2 off XT8's, wired backhaul in AI Mesh mode wan connected on the Primary Router to the SR203 as just back mid March to sky, SR203 is only going to be up and running so i know it is good, and to date NO issues with the SR so yes it will be going back in it's box fairly shortly, RP-AX58 is in RE mode primarly connected wireless to the SR203 also, little fiddly to set up but directing the downstairs traffic up to the Router,

Tp-Link powerline Wired and wireless covering Ring camera, doorbell, garage and Sat box non sky unit.

XT9's are the ones now, 8's are little harder to find, NOT a spider antenna fan so those are just not for me.

All the Asus are AX compatible when on the EE Smarthub+ 160 wide channel fully open, the FF500 pipe is what it is, home network is what i am so speed internal, external just don't care about, and as a Network specialist throughput is more important than any speed test that does not put out any data.

FF500 is only to keep the wife and daughter off my back, she is retired now and on either off her laptops all the time, if the daughter is not 4k watching, PS5 downloading and the two off them fighting about the speed, that is why i went from the 40/10 fttc to FF500 just for NO AGRO reason ever again, could even do it on a FF150 but for virtually hardly any extra cost on FF500 why not....

Only double NAT issue for me is printing wirelesely so just have to drop off the Asus onto the SR203 for that not a problem to do...

[Chrisee]

@Dunc1 if I could add a couple of points first the DHCPv6 PD authentication used by @Danny11616 works on roughly 80% of UK exchanges not 100% the DHCPv4 Option61 which works on all UK lines is not supported by TP-Link. There is no way I know of knowing whether it will work on your line or not. My own set up is to use the Sky hub as the router running my own Deco set up in Access Point mode which works well giving me a rock steady home network..

You mention higher speed profiles possibly being offered by Sky which is likely to happen on City Fibre connections which Sky are apparently close to offering but they will need to launch a new hub to do so. However for Openreach connections given their use of GPON where a distribution point with up to 32 connections share a 2.4Gb/s download capacity whether in practice you would see much if any improvement in performance is moot as very few real world applications can use 900Mb/s. In practice most nearly all customers use a fraction of the bandwidth they buy which is why GPON works well for normal use but speed test results can be variable. 

[Dunc1]

@Chrisee 

Thanks for the really helpful reply — that’s explained it really clearly.

I 100% agree with you.

In a real-world situation, very few people actually need more than 900Mbps.

Most home devices, even now, barely scratch the surface of that.

I’m under no illusions that faster speeds make a massive practical difference day-to-day.

That said (and I’m just being honest!), sometimes it’s not really about need —

it’s that little inner child in me who still remembers wanting the biggest toy at Christmas!

It’s a bit of a future-proofing itch, a bit of a “what if,” and probably a bit of excitement just knowing the tech is there, even if it’s not strictly necessary.

But your points about GPON, real-world bandwidth sharing, and Sky’s network rollout plans make total sense.

I’m going to focus on getting a stable, well-set-up network first — and worry about any theoretical upgrades later.

Thanks again — really appreciate the advice and the level-headed approach.

Exactly what I needed.

[Dunc1]

@Danny11616 

Thanks so much for taking the time to explain that — it’s really appreciated.

That’s exactly the sort of clear, real-world advice I was hoping for.

It’s really helpful to know that you’ve got your Deco X50 connected directly to the ONT and running everything without needing the Sky Hub —

and the point about factory resetting them first makes a lot of sense too. I’ll definitely follow that approach.

Thanks also for laying out the IPv6 settings so clearly — it’s brilliant to have that mapped out before I dive in.

Good to know as well not to panic when the DNS entries don’t populate — that’s exactly the kind of little thing that would have had me second-guessing myself otherwise!

I’m in the same boat as you really — in the real world I don’t need Wi-Fi 7, but there’s definitely that little voice whispering about stronger antennas and future-proofing…

Thanks again — your post’s been a huge help in getting my head around this properly!

[Dunc1]

@JimM1 

Thanks for explaining all of that — it’s really helpful seeing it laid out like that.

You’ve clearly got a seriously well-thought-out setup there — and it’s reassuring to hear that running the SR203 alongside everything else hasn’t caused you any major issues, especially while bedding in the new line.

I completely get where you’re coming from too about throughput mattering more than speed tests. Real-world performance inside the house is what really matters, not how big a number you can flash up on Speedtest.net for 30 seconds!

I’m exactly the same in terms of thinking longer term about stability and coverage — and to be honest, keeping the wife and kids off your back is probably the biggest technical challenge of all!

It’s also good to hear that you’re only seeing the double NAT issue with wireless printing — and even then it’s easily worked around. That gives me a lot of confidence because that’s been one of my main worries about running two systems together.

Really appreciate you sharing all of that — it’s helping me map out my own plan much more clearly.

[Chrisee]

@Dunc1 been there done that myself.