>NAT Type Explained: Strict, Moderate and Open on Xbox, PS5 and Switch 2

Introduction

Your console says NAT type: Strict. A friend cannot join your party and voice chat keeps dropping. Guides online then offer a dozen fixes at once: turn on UPnP, forward ports, put the console in the DMZ, call the internet provider. Some of these help and some make the network less safe. And when the provider shares one public address between many homes, nothing you change on your own router helps at all.

Below: what a NAT type measures, what every label means on Xbox, PlayStation, Nintendo Switch and Switch 2 and on a PC, which type is good enough to play, whether NAT type has anything to do with ping, and how to fix a strict NAT in the order the console makers recommend. Double NAT and carrier-grade NAT, the two causes that sit outside your home, get sections of their own. To see your own NAT type first, the NAT Type Test checks it in the browser in a few seconds and shows what Xbox, PlayStation and Switch will likely report.

What is NAT type?

A home router has one public internet address and shares it between every device in the house. To do that it rewrites outgoing traffic. Each request leaves with the router's public address and a port number the router picks, and the router remembers which device asked, so the reply finds its way back. This is network address translation (NAT).

A NAT type is a console's or a game's verdict on how your router does this, above all on how it treats traffic from players your console has not talked to yet. It matters because many online games, and most party and voice chat, connect players directly to each other instead of passing everything through a server. A direct connection works only if the other player's traffic can get in. A router that lets it in rates as Open, one that lets it in only from some players rates as Moderate, and one that keeps it out rates as Strict.

How the router decides: mapping and filtering

Two behaviours decide the type. RFC 4787, the standard for how a NAT should handle UDP, the traffic games and voice chat use, calls them mapping and filtering.

• Mapping is the outside port the router gives your console. A good router keeps the same outside address and port for one console port, whoever the console talks to. RFC 4787 makes this a requirement and calls it endpoint-independent mapping. A worse router hands out a new port for every server and every player, so the address your console tells other players is already out of date when they try it.
• Filtering is whether the router lets in packets from someone your console has not sent anything to yet.

Port forwarding, UPnP and the DMZ fix both for the ports they cover: the console gets one fixed outside port, and the router lets traffic to it in.

You may also meet the older names full cone, restricted cone and symmetric NAT. They come from the first version of the STUN protocol. Its successor, RFC 5389, retired that classification, because many real routers did not fit any of its types. Consoles run their own tests and use their own labels, which is why one router can read as Moderate on an Xbox, Type 2 on a PlayStation and B on a Switch.

NAT types on Xbox, PlayStation, Nintendo Switch and PC

The scales do not map one to one. On PlayStation, Type 1 means a console plugged straight into the modem with no router at all, so nearly every console at home shows Type 2, whatever the router is like. Nintendo uses letters from A to F, and the Switch 2 uses the same scale as the original Switch. Call of Duty shows both kinds of names. Activision, its publisher, treats Open and Type 1, Moderate and Type 2, Strict and Type 3 as the same three levels.

Xbox: Open, Moderate, Strict and Unavailable

• Open NAT: you can play and host multiplayer games with people of any NAT type. This is the result Microsoft asks you to reach when you troubleshoot.
• Moderate NAT: you might not be able to play with some people, and you normally won't be chosen as the host of a match. Most matchmaking still works, but friends with Strict NAT may not be able to reach you.
• Strict NAT: you can play only with people who have Open NAT, and you can't host. Joining friends and party chat can fail. This one is worth fixing.
• Unavailable: party chat and multiplayer in some games do not work at all. Microsoft troubleshoots it together with Teredo, a tunnelling protocol the console needs for party chat and some multiplayer games.

PlayStation: NAT Type 1, Type 2 and Type 3

Sony defines the types in its PS4 user guide, and Activision uses the same Type 1, 2 and 3 for every Sony console. Type 1 is a console connected directly to the internet. Type 2 is a console connected through a router. With Type 3, connecting to other consoles may be impossible or the console's network features may be limited.

• NAT Type 1 is not a better setting to aim for. It means there is no router between the console and the internet, so the answer to "is NAT Type 1 or 2 better?" is that Type 2 is what a working home network shows.
• NAT Type 2 is the normal, healthy result at home, so yes, NAT Type 2 is good on a PS5. In Call of Duty and Destiny 2 it plays like Moderate: everyone except Strict players can connect to you.
• Type 3 is the one to fix. Parties, joining friends and Remote Play may fail.

Nintendo Switch and Switch 2: NAT types A to F

Nintendo describes five of its six letters, and the descriptions are the same for the Switch 2:

• A is preferred and works well for connecting with other players.
• B is compatible with most other NAT types.
• C may have trouble connecting to some players whose NAT type is more restrictive.
• D generally connects only to players with type A. Worth fixing.
• F means your network restricts communication so much that connecting to other players is impossible.
• E is not described anywhere on Nintendo's support pages.

PC: the NAT type comes from whatever tests it

A PC has no single NAT type. The label comes from whatever runs the test. Call of Duty reports Open, Moderate or Strict on PC, Destiny 2 warns about a strict NAT in the game, and Warframe tells you when it detects one. A browser test measures the network the PC is on.

Which NAT type is best for gaming?

Open, Type 1 or A is the best result, but the more useful question is who can reach whom. Microsoft, Activision and Bungie all describe the same rule, and the table follows it. The row is your NAT type, the column is the other player's.

So what NAT type should you be on? Open if you host lobbies or often play with the same friends, since then nobody is locked out by your side. Moderate, Type 2 or B is enough for most matchmaking. Strict, Type 3, D and worse are worth fixing, because a Strict player can reach only Open players.

Does NAT type affect ping or lag?

Not directly. None of the console makers describes NAT type as a speed setting. Microsoft writes about who you can play with and host for, and Sony about how easily the console connects to other consoles. Nintendo reports the NAT type next to download and upload speed as a separate result, and notes that even with the best types a match can time out because of high latency. Ping is the time a packet takes to reach the other end and come back, and it depends on distance, the route and the load on your line.

What a NAT type changes is which connections can be made at all:

• Matchmaking: with Strict NAT fewer players can connect to you, so searches take longer and lobbies fail and start over.
• Hosting: games prefer a host with Open NAT. With Strict NAT you are never chosen.
• Party and voice chat: these connect players directly, so they fail first.
• Relays: when two players cannot connect directly, a game that supports it sends their traffic through a relay server instead, and the longer path can add delay. RFC 4787 names the relay as the price of a router that changes the port for every destination.

Activision is the one publisher that links NAT type to quality. It says an Open NAT "will provide the best connection quality" and that port forwarding "can improve connection speed, lobby wait times, and overall gameplay, particularly for a host." In a game where every match runs on the publisher's own servers, the NAT type matters mostly for the features that still connect players directly, such as parties.

Why is my NAT type strict?

The usual causes:

• UPnP is off or stuck. Consoles use UPnP to ask the router to open the ports they need. Microsoft's first troubleshooting step is to turn it off and on again.
• Two routers in a row, which is double NAT (below).
• The provider shares one address between many customers, which is carrier-grade NAT (also below).
• The router changes the outside port for every destination. Some routers and firewalls work this way.
• A VPN. On a console or a router running a VPN, the NAT type you see is the VPN server's.
• The network itself. Work, school, hotel and public Wi-Fi networks can limit the traffic games use.
• Fixes that fight each other. Microsoft warns not to combine port forwarding, UPnP and the DMZ.
• Two consoles on one network asking for the same port (section below).

Double NAT detected

Double NAT means two devices in a row translate your addresses, usually the provider's modem-router and your own router behind it. An Xbox reports it as Double NAT detected, and you may have trouble hosting or joining games and parties, or hearing other players. Bungie names a telling sign: the console's own test says Moderate or Type 2, while Destiny 2 warns about a strict NAT.

To check, open your router's status page and find its WAN or Internet IPv4 address. A private address there (10.x.x.x, 172.16.x.x to 172.31.x.x or 192.168.x.x) means another router sits in front of yours. The fix Microsoft and Bungie both give is bridge mode on the provider's box, sometimes called NAT-disabled mode, so that only your own router translates addresses.

CGNAT: am I behind it?

Carrier-grade NAT (CGNAT) is a NAT run by the internet provider. Public IPv4 addresses have run out, so the provider puts many customers behind one public address and gives each home router an address from a shared range. RFC 6598 reserves 100.64.0.0 to 100.127.255.255 for exactly this.

You are behind CGNAT if your router's WAN address falls in that range. If the WAN address is public but different from the address websites see, something else upstream translates it too. Either way, nothing you change at home can open a port on the provider's NAT. Microsoft's advice for that case is short: if your provider can't give you a public IP address, you'll have to change providers to fix the NAT type.

A shared address has a second cost. Everyone behind it shares its reputation too, so another customer's spam or abuse can bring CAPTCHAs and blocks to you. The IP reputation guide explains how those lists work.

Starlink is a well-known example. Its default IPv4 setup uses CGNAT from the 100.64.0.0/10 range and lets no inbound traffic in. A public IPv4 address is an option on its Local and Global Priority plans, its own Wi-Fi routers do not support port forwarding, and native IPv6 works on every plan. On any other provider, ask whether your plan uses CGNAT and whether a public IPv4 address is available.

How to fix strict NAT

Do one step at a time and run the console's NAT test after each. Microsoft asks for exactly that and warns against skipping ahead. It also says not to combine port forwarding, UPnP and the DMZ, so keep to one way of opening ports.

Step by step: the order that works

1. Refresh UPnP. Turn UPnP off in the router settings, restart the router and the console, then turn UPnP back on.
2. Update the router's firmware. Microsoft, Sony and Nintendo all list this step.
3. Give the console a fixed local address. Microsoft suggests the router's DHCP reservation, so the router always hands the console the same address. Port forwarding and the DMZ both need it.
4. Forward the ports for your platform (the table below) to that fixed address, with UPnP and the DMZ turned off.
5. Use the DMZ only if forwarding fails. The router's DMZ, also called a perimeter network, moves one device outside the router's firewall, and only one device can be there.
6. Reset the router to factory defaults as the last step on Microsoft's list, then set it up again.

If none of this helps, the cause sits outside your home. Put the provider's box into bridge mode for double NAT, or ask the provider for a public IPv4 address for CGNAT.

Ports for Xbox, PlayStation and Steam

These are the vendors' own lists. On Xbox, port forwarding is done on the router, not on the console.

Steam lists its ports as remote ports, the ones a firewall must let your PC reach, rather than ports to forward to it. Nintendo's NAT pages list no ports. Its main advice is in the Nintendo section below.

Xbox: Teredo, IPv6 and Unavailable NAT

When the NAT type is Unavailable, or the console cannot get a Teredo address, Microsoft points to two router options, allowing Teredo tunnelling and allowing IPv6 tunnelling. If that does not help, it suggests turning IPv6 off on the router. Otherwise Microsoft recommends IPv6: the Xbox works without it, but several Xbox features already use IPv6, and IPv6 removes the need for NAT.

Two consoles on one network

Not every router can give two Xbox consoles an Open NAT at the same time. Microsoft's fix is to set the second console's Alternate port selection to manual in its advanced network settings, write down the port it picks, and forward that port instead of 3074. The DMZ is no help here, because it holds only one device. If the router still cannot manage both, Microsoft's remaining options are a router that supports several consoles or connecting one console at a time.

PlayStation

Sony's advice: restart the console and the router, try a wired connection, update the router's firmware, set a static IP address on the console and open the ports listed above. Sony's connection troubleshooting page does not mention UPnP. For a Type 3 result that will not go away, Sony's Remote Play page tells you to ask your provider.

Nintendo Switch and Switch 2

For types D and F, Nintendo's first step is to turn off the IPv6 connection in the console's internet settings. That is the opposite of Microsoft's advice for the Xbox. After that come a restart, a router firmware update, a factory reset of the router, and contacting the provider or the router's maker.

PC and Steam

Windows has had Teredo turned off since Windows 10, version 1803, and Microsoft says to use native IPv6 instead. For Steam games, Valve runs a relay network that can carry peer-to-peer traffic, and games that use it send that traffic through Valve's relays rather than straight between players.

Is UPnP safe?

UPnP lets any program on your home network ask the router to open a port, without a password or a prompt. Consoles rely on it for that, and security agencies warn about it for the same reason. CISA, the US cybersecurity agency, says malware inside a network can use UPnP to bypass the router's firewall, and that you should disable UPnP unless you have a specific need for it. The Canadian Centre for Cyber Security also recommends turning it off on home routers, and notes that some devices need it to work.

The game side leans the other way. Bungie recommends UPnP when possible, though it calls port forwarding "generally safer", and Microsoft puts UPnP first in its NAT steps. If only your console needs open ports, forwarding them and leaving UPnP off is the tighter setup. If you keep UPnP on, keep the router's firmware current and know which devices are on the network. The DMZ exposes a device more than either.

What a browser NAT test can show

A web page can send traffic to STUN servers through WebRTC and read the outside address and port each server reports back. If every server sees the same port, the router keeps one mapping for all destinations. If each server sees a different port, the router behaves the way consoles usually report as Strict. When no server answers at all, UDP, the traffic games and voice chat use, is blocked.

What a page cannot see is filtering, the difference between Open and Moderate, because it cannot receive traffic that nobody inside asked for. The console's own test decides that part. The NAT Type Test on packet.guru, linked at the top of this guide, runs this check in the browser, translates the result into the Xbox, PlayStation and Switch terms, and has a router WAN check that spots double NAT and CGNAT.

FAQ

Why does my NAT type switch from Open to Moderate?

It can happen when something else on the network takes the port, such as a second console or a PC game, or when the router's UPnP entries go stale. Microsoft's first step for that is refreshing UPnP, and for two consoles it is the alternate port described above.

Does a VPN change my NAT type?

For the device on the VPN, yes. Its traffic leaves through the VPN server, so the NAT type you see is that server's, which may be Strict. A console that is not on the VPN keeps its own NAT type. The VPN test shows whether a VPN is on and leaking.

Does NAT type affect download speed?

No. A download is a connection your console opens to a server, and every NAT type handles that. Nintendo shows the NAT type and the download and upload speeds as separate results of one test.

Can I get rid of CGNAT?

Only the provider can. Ask for a public IPv4 address (Starlink, for one, offers it on its Priority plans) or move to a provider that gives one. IPv6 avoids NAT for the games and services that use it.

Sources

• Troubleshoot NAT errors and multiplayer game issues (Xbox Support, Microsoft)
• NAT Related Troubleshooting on Nintendo Switch 2 and Nintendo Switch (Nintendo Support)
• Home Network Security (CISA)
• RFC 4787: NAT Behavioral Requirements for Unicast UDP (IETF)