NAT Type Strict? How to Fix It on Xbox, PS5 and PC

Quick answer

NAT Type Strict (Type 3 on PS5) comes from one of three places: a second router in your home, your internet provider, or your own router’s settings. One 2-minute check tells you which: compare your router’s WAN IP (its internet address, shown in the router’s settings page) with your public IPv4 address (go to google.com and search for “what is my IPv4”). The steps to find both are below.

Same address? The problem is your router. Refresh UPnP, then try port forwarding, but never both at once. Different, and the WAN IP starts with 192.168, 10 or 172.16 to 172.31? A second box is doing NAT, so put your provider’s box in bridge mode. Different, and it starts with 100.64 to 100.127? Your provider uses carrier-grade NAT, so ask them for a public IPv4 address.

  • Xbox goal: Open NAT
  • PS5 goal: NAT Type 2
  • Never mix UPnP, port forwarding and DMZ
  • No factory reset needed

I’m Afroz, a CCIE network engineer. I made a video on this exact problem, and I checked every step on my own provider’s router. Here is the same method in writing, with the menus, port lists and sources.

Watch the full fix (about 10 minutes), or follow the written steps below:

Video NAT Type Strict Fix: The 2-Minute Check Most Guides Skip (Xbox, PS5, PC) (9:56) · Subscribe on YouTube

What you see, and what to do first

What you seeMost likely causeDo this first
Xbox says “Double NAT detected”.Two routers in your home.Put the provider’s box in bridge mode.
Your router’s WAN IP starts with 192.168, 10 or 172.16 to 172.31.Another box in front of your router.Bridge that box, or ask your provider if you only have one box.
WAN IP starts with 100.64 to 100.127.Your provider’s carrier-grade NAT.Ask your provider for a public IPv4 address.
WAN IP matches your public IPv4.Your router’s settings.Refresh UPnP, then test again.
Still Strict after port forwarding.Methods mixed, or NAT before your router.Undo the mix and run the 2-minute check.

What does NAT Type Strict mean?

NAT (network address translation) is how your router shares one internet address with every device in your home. Your NAT type tells you how easily other players can connect to your console. Strict is the most limited.

Xbox NAT typeWhat it means, in Microsoft’s words
OpenYou can play and host with people on any NAT type.
ModerateYou might not be able to play with some people, and you usually won’t host.
StrictYou can only play with people whose NAT is Open, and you can’t host.

PS5 uses numbers instead. Type 3 is the restricted case, and Sony says that with Type 3, play with other consoles might be impossible or limited. You don’t need Type 1. Sony says Type 1 means the console is connected directly to the internet, with no router at all. Behind a router, Type 2 is the best you will see.

How do you check your NAT type?

  • Xbox: press the Xbox button, then go to Profile & system > Settings > General > Network settings > Test NAT type.
  • PS5: go to Settings > Network > Connection Status > Test Internet Connection. The result shows NAT Type 1, 2 or 3.
  • Windows 10 PC: open Settings > Gaming > Xbox Networking. On Windows 11, if Xbox Networking is missing, look in your game’s own network settings.

The 2-minute check: router, second box or provider?

Every fix depends on where the NAT happens. This check finds it before you change anything.

  1. Find your router’s address. PS5: Settings > Network > Connection Status > View Connection Status, then look for Default Gateway. Xbox: Profile & system > Settings > General > Network settings > Advanced settings, then look for Gateway. Windows PC: press the Windows key, type cmd and press Enter. In the black window, type ipconfig, press Enter and look for Default Gateway. It usually looks like 192.168.0.1 or 192.168.1.1.
  2. On a phone or PC connected to the same Wi-Fi, open a web browser. Type that address into the address bar at the top (not into a search box), with http:// in front, for example http://192.168.1.1. Log in with the admin password printed on the sticker on the router, not the Wi-Fi password. With a mesh system such as eero or Deco, use its app instead.
  3. In the router’s settings page, find the WAN IP, its internet-side address. It is usually on a page called WAN, Internet or Status, and it may be labelled WAN IP, Internet IP or just IP address. It is not the address you typed to open the router. Write it down.
  4. Turn off any VPN or iCloud Private Relay, and stay on your home Wi-Fi. Go to google.com, search for what is my IPv4, and open the first result that is not an ad. The site shows your public IPv4 address: four numbers separated by dots, such as 203.0.113.45. If it also shows an IPv6 address with colons, ignore that one.
  5. Compare your router’s WAN IP with your public IPv4 address, then follow the diagram below.
Start by comparing the router’s WAN IP with your public IPv4 address. If they are the same, use Fix 3 on your router. If they are different, look at how the WAN IP starts: 192.168, 10 or 172.16 to 172.31 means a second box is doing NAT, so use Fix 1, bridge mode. 100.64 to 100.127 means your provider uses carrier-grade NAT, so use Fix 2. Anything else, or a blank WAN IP, means ask your provider. Router WAN IP vs public IPv4Same address, or different? SameDifferent Fix 3: your routerRefresh UPnP, then try portforwarding. Never both. What does the WAN IP start with? 192.168, 10 or172.16 to 172.31A second boxFix 1: bridge mode 100.64 to100.127Provider CGNATFix 2: call them Anything else,or blankAsk yourprovider
The check that decides your fix. It takes about 2 minutes and changes nothing on your router.
From my own router: on my provider’s gateway (a Bell Giga Hub), the page named “WAN” did not show the address at all. It sat in the Internet panel, labelled plain “IP address”. If you can’t find a WAN IP, check the Internet or Status page too.

Fix 1: two routers (double NAT)

Your provider gave you a box with Wi-Fi, and you plugged your own router or mesh system into it. Now both boxes do NAT, and your console sits behind both. Microsoft points to the same cause: if you use both a router and a gateway, both may be doing NAT. A provider box with no Wi-Fi is usually just a modem, so skip to Fix 2.

  1. Check whether the provider’s box holds your internet login (a username and password, often for a sign-in type called PPPoE). If it does, get those details from your provider first. Your own router will need them after the change.
  2. Open the provider’s box: connect a PC to its Wi-Fi or plug the PC into it with a cable. Run ipconfig as in step 1 of the check, and open that Default Gateway address in a browser the same way.
  3. Find bridge mode or IP passthrough. On my Bell gateway it is called Advanced DMZ, which is not the normal DMZ. If it asks for a device, pick your own router, not your console.
  4. If the box held your login, open your own router’s Internet settings, choose the connection type (usually PPPoE) and enter that username and password.
  5. Bridge mode can turn off the provider box’s Wi-Fi, so join your own router’s Wi-Fi afterwards. Then run the 2-minute check again.

No bridge mode or IP passthrough on the provider’s box? Put your own router or mesh in access point mode instead. You set this in your own router’s settings page or mesh app, where it may be called AP mode or bridge mode. Then the provider’s box is the only one doing NAT, so apply Fix 3 on that box. If your internet does not come back after the change, call your provider.

Fix 2: your provider uses carrier-grade NAT (CGNAT)

To save IPv4 addresses, some providers put many customers behind one public address. That is carrier-grade NAT, or CGNAT. The address block 100.64.0.0 to 100.127.255.255 is set aside for exactly this (RFC 6598). Port forwarding only opens your own router. Another player’s console still stops at your provider, and no router setting can open that.

Call your provider and ask these two questions, word for word: “Am I behind CGNAT?” and “Can I get a public IPv4 address?” You don’t need a static IP for gaming. Some providers offer a public IPv4 address only on certain plans. Starlink, for example, uses CGNAT by default and offers public IPv4 as an option on some plans. If your provider can’t give you one, Microsoft’s advice is to change providers.

An ordinary VPN app on your console or PC usually won’t fix CGNAT. What can work is a VPN that runs on your router, or a rented server that forwards traffic to you. Both are more advanced setups.

Fix 3: your own router, in the right order

If your router’s WAN IP matched your public IPv4 address, the fix is on your router. There are three ways to open NAT. UPnP lets your console open its own ports. Port forwarding opens them by hand. DMZ opens every port to one device. Microsoft’s Xbox support page is clear about mixing them:

Don’t combine port forwarding, UPnP, and perimeter network (also known as DMZ) settings.
Microsoft Xbox Support, “Troubleshoot NAT errors and multiplayer game issues”, verified 11 November 2026

So work through them one at a time, in this order.

  1. Undo the mix. Take your console out of the DMZ and delete its port forwarding rules. Keep any DMZ setting you used to bridge a router in Fix 1. My Bell gateway even shows who made each rule, you or UPnP.
  2. Refresh UPnP. In your router’s settings page (the one you opened in the check), UPnP is usually under Advanced or NAT settings. If it is on, turn it off and save. Restart your console and router, and your modem if it is separate: unplug each one, wait 20 seconds and plug it back in. Turn UPnP back on, restart them again the same way and test your NAT type. On my Bell gateway, UPnP was off from the start, so check it.
  3. Update the router’s firmware. In the router’s settings page, look under System or Administration, and don’t turn the router off while it updates.
  4. Switch to port forwarding. Turn UPnP off. Find your console’s MAC address: on Xbox under Network settings > Advanced settings, on PS5 under View Connection Status. Use the wired MAC if you use a cable, or the Wi-Fi MAC if you use Wi-Fi. In the router’s settings page, open DHCP or LAN settings, find that MAC address and reserve the IP address next to it. Then forward the ports in the tables below to that reserved IP.
  5. Use DMZ only as a last resort. Delete the port rules, keep UPnP off and point the DMZ at your console’s reserved IP. It works for one console only.
Don’t press the reset button. A restart means unplugging each device, waiting 20 seconds and plugging it back in. A factory reset wipes all your router settings. Clearing the alternate MAC address on an Xbox adds nothing either: it is just a slower restart.

Xbox ports to forward

PortType
88UDP
3074UDP and TCP
53UDP and TCP
80TCP
500UDP
3544UDP
4500UDP

Two Xboxes on one network? On the second console, go to Profile & system > Settings > General > Network settings > Advanced settings > Alternate port selection, and choose a port. Then forward that port to the second console’s reserved IP. Microsoft notes that not every router can give two consoles Open NAT.

PS5 ports to try

TypePorts
TCP80, 443, 3478, 3479, 3480
UDP3478, 3479, 49152 to 65535

Sony lists these on its PS5 network error pages and says “if possible, try opening these ports”. Sony has no dedicated port-forwarding guide, so treat this list as Sony’s suggestion.

Did it work?

Run the NAT test from “How do you check your NAT type?” again. On Xbox you want Open. On PS5 you want Type 2. Moderate is better than Strict, but you may still miss some players and usually won’t host. Still Strict? Run the 2-minute check again, because a change in Fix 1 can move you to a different case.

NAT Type Strict FAQ

Why is my NAT type still strict after port forwarding?

Usually for one of two reasons. Port forwarding is mixed with UPnP or DMZ, which Microsoft says not to combine. Or something before your router is doing NAT, such as a second box or your provider’s CGNAT. Port forwarding only opens your own router, so run the 2-minute check.

Does clearing the alternate MAC address fix NAT Type Strict?

No. It only gives you a slower restart. A normal restart of your console and router does the same job.

Is NAT Type 2 good on PS5?

Yes. Type 2 is the best result behind a router. Sony says Type 1 means the console is connected directly to the internet with no router at all.

How do I know if I'm behind CGNAT?

Compare your router’s WAN IP (in the router’s settings page) with your public IPv4 address (go to google.com and search for “what is my IPv4”). If they don’t match, and the WAN IP starts with 100.64 to 100.127, your provider is using carrier-grade NAT. Your provider can confirm it.

Can a VPN fix NAT Type Strict?

An ordinary VPN app usually can’t, because it does not open incoming connections. A VPN running on your router, or a rented server, can work around CGNAT, but both are advanced setups.

Should I turn on UPnP, port forwarding and DMZ together?

No. Use one method at a time. Microsoft’s own guidance is not to combine port forwarding, UPnP and DMZ settings.

Terms used on this page

NAT (network address translation)
how a router shares one internet address with many devices.
WAN IP
your router’s internet-side address, shown on its status page.
Double NAT
two boxes in a row both doing NAT, such as a provider gateway and your own router.
CGNAT (carrier-grade NAT)
NAT done by your provider, sharing one public address between many customers.
UPnP
a router feature that lets a console open the ports it needs by itself.
Bridge mode
a setting that stops a provider’s box from doing NAT, so your own router does it alone.
The short version: NAT Type Strict has three causes, and one check finds yours. Compare your router’s WAN IP with your public IPv4. If they match, fix your router one method at a time. With two boxes, use bridge mode. With CGNAT, ask your provider for a public IPv4 address, or switch providers.

Next steps

Standards and primary sources

  1. Microsoft Xbox Support, Troubleshoot NAT errors and multiplayer game issues — NAT types, double NAT, the WAN check, the order of fixes, Xbox ports, two consoles.
  2. Sony, Test Internet Connection (PS4 User’s Guide) — what NAT Types 1, 2 and 3 mean.
  3. Sony, PS5 error code NW-102308-4 — the PS5 ports to try.
  4. IETF, RFC 6598 — 100.64.0.0/10, the shared address space for carrier-grade NAT.
  5. IETF, RFC 7021 — how CGNAT affects incoming connections.
  6. Starlink Support, public IPv4 and CGNAT — an example of a provider that uses CGNAT by default.
  7. Andrews & Arnold, Bridge Mode — after bridge mode, your own router signs in with the PPPoE login.
  8. My own provider gateway (Bell Giga Hub), checked page by page on 4 November 2026 — where the WAN IP sits, UPnP off by default, “Advanced DMZ”.
All sources above were re-checked and verified on 11 November 2026. The Bell gateway findings are from my own router, checked on 4 November 2026.
Cite this page
Afroz Ahmad, “NAT Type Strict: How to Fix It on Xbox, PS5 and PC”, afrozahmad.com, reviewed 11 November 2026.
https://afrozahmad.com/blog/nat-type-strict-fix/
Latest posts by Afroz Ahmad (see all)

Related Posts