NAT Types, Double NAT, and Why Port Forwarding Sometimes Cannot Work

What your console means by strict NAT, how to tell double NAT from carrier NAT, and why port forwarding is impossible on some connections no matter what you configure.

Your console says Strict NAT or NAT Type 3. Matchmaking takes longer, party chat fails, and you get dropped into worse lobbies.

Every guide tells you to forward ports. On a growing number of connections that advice cannot work, because there is nothing to forward — and no amount of router configuration will change it.

Understanding which situation you are in takes about two minutes and saves a lot of pointless fiddling.

Check what your connection actually looks like

The IP lookup shows your public address. Comparing it with your router's WAN address is the test that distinguishes the two cases below.

Look up your IP →

What NAT actually is

Your home has one public IP address and many devices. Network address translation lets them share it: the router rewrites outgoing traffic to appear from the public address and remembers enough to send replies back to the right device.

For anything you initiate, this is invisible. The complication is inbound connections. When something on the internet wants to reach you unprompted, the router has to decide which internal device it belongs to — and by default there is no answer, so it drops it.

Games care because peer-to-peer connections need each side to accept traffic the other initiates.

What the labels mean

Console manufacturers use different names for roughly the same idea. They are vendor classifications rather than a standard, so the boundaries do not line up exactly between platforms, and individual games can report their own connectivity state separately:

Type 2 / Moderate is fine. It is a perfectly normal result for a working home connection and should not be treated as a fault, and chasing Open is rarely worth the effort — Type 1 usually means no router at all, which is not something you want.

Strict is the one to fix, and the fix depends entirely on why you are strict.

How to check your NAT type

The Switch reports a letter from A to F rather than a word: A and B behave like Open and Moderate, D and F like Strict. PC games generally report their own connectivity state in the network or multiplayer settings, and different titles on the same machine can disagree — they are describing their own connections, not the router.

The two-minute diagnosis

Compare two addresses:

1. Your router's WAN address, from its admin page — sometimes labelled "Internet IP".
2. Your public address, from the IP lookup.

They match

You have a real public IP. Port forwarding will work, UPnP will work, and strict NAT is a configuration problem you can solve. Skip to the fixes below.

They differ

Something between you and the internet is also translating. Look at what the router shows:

100.64.0.0 – 100.127.255.255    Carrier-grade NAT (RFC 6598)
10.x.x.x / 192.168.x.x         A private upstream network — usually double NAT
172.16.x.x – 172.31.x.x         Same

The 100.64 range exists specifically for carrier NAT, so seeing it is close to conclusive. The private ranges are less definite: they usually mean a second router you own, but some ISPs hand out private addressing of their own, and business or campus connections often sit behind an upstream gateway you do not control. Before assuming it is your own equipment, check what is actually in the path — if there is only one box in your house, the extra layer is upstream and behaves more like the carrier case.

These need completely different responses, and confusing them is the single most common reason people spend an evening forwarding ports that could never have worked.

Double NAT — fixable

Two routers in series, each doing translation. Usually your ISP's modem-router with your own router behind it, or a mesh system added without reconfiguring the original.

Fixes, best first:

Bridge mode on the ISP device. Turns it into a plain modem and lets your router hold the public address. The cleanest answer, though not every ISP device supports it and some require a support call. Check what else the box is doing first: bridging can disable ISP-provided TV, VoIP handsets, managed Wi-Fi or IPv6 provisioning, and those are awkward to discover after the fact.

Put your router in the ISP device's DMZ or "exposed host" setting. This forwards unsolicited inbound traffic to your router, which then handles things normally. Implementations vary between vendors — some pass everything, some keep filtering above it — so verify rather than assume. Slightly less clean than bridging, usually works nearly as well.

Use only one router. If your ISP device is capable enough, running your own behind it may be adding nothing but a NAT layer.

Forward twice. Configure the same ports on both devices. It works and it is fragile — avoid unless the others are impossible.

Carrier-grade NAT — mostly not fixable

If your router's WAN address is in 100.64.0.0/10, your ISP is sharing one public address across many customers.

Port forwarding cannot work. Not "is difficult" — there is no public port that belongs to you to forward. Every guide telling you to open ports is written for the other case.

What you can actually do:

Ask your ISP for a public IPv4 address. Many will provide one, sometimes free, sometimes for a small monthly fee. This is the real fix and worth asking about before anything else.

Use IPv6. No address shortage, so no carrier NAT and no shared address to work around. That removes the addressing obstacle rather than every obstacle: inbound IPv6 is still governed by your router's firewall, which usually blocks it by default, and your ISP, your console and the game all have to support it. Increasingly common, not universal.

Accept moderate NAT. Most modern titles work acceptably through CGNAT using relay servers. Matchmaking is slower and you may not host, but it plays.

More detail on identifying and living with it is in what your IP address reveals.

Fixes when you do have a public IP

In order of preference.

Enable UPnP. Lets the console request its own port mappings automatically. It is the reason most people never think about NAT at all. The trade-off is that any device on your network can open ports without asking — a real if modest security consideration. For most home networks the convenience wins, provided you trust the devices on it and the router implements UPnP competently — some older ones have handled it poorly. If you would rather not, forward manually instead.

Forward ports manually. More work, more control. Pin the console's internal address first, or DHCP will eventually reassign it and silently break the rule — a very common cause of "it worked for a month and then stopped". A DHCP reservation on the router is easier and safer than configuring a static address on the console, since the router then avoids handing that address to anything else. Each game publishes its required ports; use the game's own documentation rather than a third-party list, which goes stale.

Check for a second firewall. Some ISP routers apply their own filtering above the NAT layer. If forwarding looks right and still does not work, look for a separate firewall or "security" setting.

Try disabling SIP ALG. Intended to help voice traffic, some implementations rewrite packets in ways that interfere with games and chat instead. The effect depends heavily on the router, so treat it as something to test rather than a guaranteed fix — turn it off, retest, turn it back on if nothing changed.

Things that look like NAT problems

These four get blamed for each other constantly, and they are unrelated:

Open NAT guarantees none of the other three. A connection can have Open NAT and still be unplayable, and Strict NAT with excellent latency.

High ping with open NAT. Improving your NAT type will not lower your ping. The relationship runs one way only: strict NAT can raise latency, because connections that cannot be made directly get relayed through an intermediate server instead. Going from strict to open removes that penalty and nothing else — it cannot shorten the distance to the game server. If matchmaking works but the game feels bad, that is ping, jitter or loss instead — and if it only happens while someone else is streaming or uploading, bufferbloat rather than anything NAT-related.

Only one game affected. More likely that game's servers or your route to them. Your NAT configuration is not per-game, so a problem confined to one title points elsewhere — though games do differ in which ports and traversal methods they use, so it is a strong hint rather than proof. An MTR to the game's servers will show whether the path is the problem.

Voice chat failing while gameplay works. Often a separate service on different ports, and sometimes SIP ALG interference rather than NAT at all.

Intermittent strict NAT. A changing internal address is the usual cause, and a DHCP reservation fixes it. Also worth checking: UPnP mappings expire and are not always renewed, several devices can compete for the same port, and a WAN address that changes on reconnect can reset the state above you.

Frequently asked questions

What does strict NAT mean?

Your router is not allowing inbound connections to reach your console, so peer-to-peer links with other players have to be relayed or fail. It is caused either by NAT configuration you can change, or by carrier-grade NAT that you cannot.

How do I change NAT type to open?

Enable UPnP, or forward the game's ports to a console with a static internal address. If your router's WAN address is in 100.64.0.0/10, neither will work — you are behind carrier NAT and need a public IP from your ISP instead.

What is double NAT and how do I fix it?

Two routers each translating addresses, usually an ISP modem-router with your own router behind it. Put the ISP device in bridge mode, or place your router in its DMZ. Distinguishable from carrier NAT because the WAN address is in 10.x or 192.168.x rather than 100.64.x.

Why does port forwarding not work for me?

Compare your router's WAN address with your public IP. If they differ and the WAN address is in 100.64.0.0/10, you are behind carrier-grade NAT and no rule on your router can create a public inbound path — the port would have to exist on the ISP's shared address. If the WAN address is private (192.168.x, 10.x, 172.16–31.x) there is another gateway in the path: usually a second router you can bridge, sometimes an upstream network you do not control. If the two addresses match, port forwarding can work and the problem is the rule itself — most often pointing at an internal address DHCP has since reassigned.

Is moderate NAT bad for gaming?

Not really. Moderate (Type 2) is a normal result and works fine for nearly everything. Open is rarely meaningfully better in practice, and it is not worth chasing on its own.

Does NAT type affect ping?

No. NAT governs which connections can be established, not how fast packets travel. High ping with open NAT points to distance, congestion or Wi-Fi rather than anything NAT-related.

Should I enable UPnP?

For most home networks, yes — it resolves NAT problems automatically, provided you trust the devices on your network. The security consideration is that any device on your network can open ports without prompting. If that concerns you, forward the specific ports manually instead.