NAT types explained
Your console says Strict. Here is what that means, and the one thing to check before changing any settings.
What the label is actually measuring
NAT type is not a setting on your router. It is a result your console works out by talking to a test server and seeing how your connection behaves. It is reporting how easily it can accept a direct connection from another player.
That matters because multiplayer games often connect players to each other rather than routing everything through a central server. Both players sit behind routers that drop unsolicited traffic by default, so something has to arrange the introduction. NAT type describes how well that negotiation goes.
Moderate is the target, not Open
This surprises people who assume Open must be better. Open means nothing is filtering inbound traffic to your console, which usually means it sits in a DMZ or has every port forwarded to it. That works, and it also means anything on the internet can reach it directly.
Moderate is the healthy state. Ordinary translation is happening, your router is still dropping unsolicited traffic, and the console can negotiate the ports it needs when it needs them. Everything works and nothing is exposed. If you are Moderate, you are done.
Three causes of Strict, in the right order
Check carrier-grade NAT first
Not because it is the most likely, but because every other fix is wasted effort if it is the cause. Compare your router's WAN address to the one on our front page. If the router shows something between 100.64 and 100.127, your provider is translating a second time on equipment you do not control, and no setting at home will change your NAT type. That is a phone call. See what carrier-grade NAT is.
UPnP is turned off
The usual cause when the connection is otherwise normal. Consoles rely on UPnP to ask the router for the ports they need, on demand, without anyone configuring anything. With it off, the console cannot ask, so it reports Strict. Turning it on in the router settings fixes it immediately.
The tradeoff is real: UPnP is unauthenticated, so anything on your network can open a port without telling you. A reasonable position is to leave it on if you play console games and nothing sensitive is on the network, and to look occasionally at what it has opened.
Double NAT
Two routers in series, each translating. Almost always a provider's combined modem and router feeding a router you bought. The console negotiates successfully with the inner router and the outer one drops the traffic anyway.
The fix is to have only one device translating. Put the provider's box into bridge or passthrough mode, or use it alone and turn off routing on yours. You can spot double NAT the same way as carrier-grade NAT: your router's WAN address will be a private one that does not match the public address we show you.
If you would rather forward ports by hand
Some people prefer explicit rules to UPnP. That works, and it needs a fixed private address for the console first, using a DHCP reservation in the router rather than a static address set on the console. Otherwise the rules point at whatever device happens to hold that address after the next power cut.
Each game and platform publishes the ports it wants. The general shape is a handful of TCP and UDP ports per platform, plus game-specific ones. Port forwarding explained covers doing it safely, and the warning there applies: every rule is a permanent open path from the internet to one device.
Putting a console in the DMZ forwards every port to it and is frequently suggested as a quick fix for Strict NAT. It does work, and it removes all filtering from that device at once. UPnP, or a short list of specific rules, gets you the same result without the rest.
What Strict actually breaks
Worth knowing, because sometimes the answer is that it does not matter.
- Party chat and voice. The most common symptom, since voice is often peer to peer.
- Matchmaking speed. You can be matched only with players whose connections are more permissive, so the pool is smaller and waits are longer.
- Hosting. You will rarely or never be selected as the host of a session.
What it does not break is playing games at all. If matchmaking feels normal and voice works, a Strict label is not a problem you need to solve.