Open NAT on Console: Fix Strict and Moderate

When a console reports a strict or moderate NAT, it means the router is not letting the console’s traffic through cleanly. The console’s error screen usually says something like “NAT Type: Strict” or “Moderate”, and online features such as voice chat, matchmaking, or joining friends’ games fail or behave erratically. This page explains what the NAT types mean, why the common fixes work or fail, and what to do when they do not. If the problem persists after trying the steps here, the cause may be outside your control—your ISP or mobile carrier—and the networking page on NAT covers the underlying mechanism in more depth.

What NAT Types Mean

NAT (Network Address Translation) is how your router lets multiple devices share one public IP address. The console’s NAT type is a rating of how permissive the router is with unsolicited incoming connections. There are three levels:

• Open: The console can send and receive traffic freely. All online features work.
• Moderate: The console can send and receive, but some incoming connections are blocked. Voice chat or matchmaking may fail intermittently.
• Strict: The console can only communicate with other open NAT consoles. Many features fail, and you may not be able to join friends’ games.

The rating is determined by the console’s attempt to connect to a game server and have the server send traffic back. If the router does not forward that return traffic correctly, the NAT is not open.

Why UPnP Usually Fixes It

Most routers support UPnP (Universal Plug and Play), a protocol that lets devices request port forwards automatically. When a console asks for a port to be opened, UPnP does it without manual configuration. If UPnP is enabled and working, the console typically gets an open NAT.

To check UPnP:

1. Log into your router’s web interface (usually at an address like 192.168.1.1 or 192.168.0.1).
2. Find the UPnP setting—often under “Advanced” or “Network”—and ensure it is enabled.
3. Save the change and restart the console.

If UPnP is enabled and the NAT is still not open, the problem is likely that UPnP is failing to create the port mapping. This can happen if the router’s UPnP implementation is buggy, if another device has already claimed the port, or if the router does not support UPnP for the console’s requested ports.

Why UPnP Fails

UPnP is a convenience, not a guarantee. It fails in several common scenarios:

• Multiple consoles: If two consoles on the same network request the same port, only one can get it. The other gets a moderate or strict NAT.
• Router firmware bugs: Some routers have broken UPnP implementations that do not create the mapping correctly.
• ISP-level CGNAT: If your ISP uses Carrier-Grade NAT, your router does not have a public IP address. UPnP cannot open ports on the ISP’s equipment, and no router setting will fix it.
• Mobile hotspot: Cellular networks often use CGNAT, and the hotspot device may not support UPnP at all.

The Port-Forwarding Fallback

When UPnP fails, the manual solution is port forwarding. This tells the router to send specific ports to a specific device (your console) at all times. It is more reliable than UPnP because it does not depend on the console’s request being honored.

Before you start, you need:

• The console’s IP address (set it to static or use DHCP reservation).
• The ports required by your console’s game or service.

Steps:

1. Set a static IP for the console. On the console, go to network settings and note the current IP, subnet mask, gateway, and DNS. Then set the IP to a static value outside the DHCP range (e.g., if the router hands out 192.168.1.100-199, use 192.168.1.50). Alternatively, use DHCP reservation in the router.

2. Log into the router and find Port Forwarding. This is usually under “Advanced” > “NAT” or “Security”.

3. Create a rule. Enter the console’s IP address and the ports required. For Xbox, the common ports are 88 (UDP), 3074 (UDP and TCP), and 53 (UDP and TCP). For PlayStation, the ports are 1935 (TCP), 3478-3480 (UDP), and 3479-3480 (TCP). For Switch, the ports are 1024-65535 (UDP) and 1-65535 (TCP) for some games, but the official requirement is 45000-65535 (UDP).

4. Save and restart the console.

If the router does not have a port forwarding option, it may have “Port Triggering” instead. Port triggering opens ports when the console sends outbound traffic, but it is less reliable for incoming connections.

When You Cannot Fix It

If you have tried UPnP and port forwarding and the NAT is still not open, the cause may be outside your router:

• ISP uses CGNAT: Your router has a private IP address (e.g., 100.64.x.x) instead of a public one. You cannot port forward because the ISP’s NAT is in the way. Contact the ISP to ask for a public IP, or use a VPN that supports port forwarding.
• Mobile hotspot: Cellular networks almost always use CGNAT. The hotspot device may not support UPnP or port forwarding. You cannot fix this from the device.
• Router is not yours: If you are on a college campus or a managed network, the administrator controls the router. You cannot change settings.

In these cases, the only workaround is to use a VPN service that provides port forwarding, or to play on a different network.

Comparison of Fixes

Common Misdiagnosis

A frequent mistake is to blame the console or the game. People reset their console, reinstall the game, or buy a new router, only to find the NAT still strict. The error is natural because the console’s error message says “NAT Type: Strict” without explaining why. But the NAT type is a symptom of the network path, not the console itself.

Another common error is to assume that enabling UPnP is enough. UPnP is a request; the router must honor it. If the router’s UPnP is faulty, or if another device has already taken the port, UPnP will not help. Port forwarding is the manual override.

Finally, some users think that a “moderate” NAT is acceptable. It is not—moderate NAT can cause intermittent failures, and the fix is the same as for strict. Do not settle for moderate if you can get open.

What People Get Wrong

• Believing that UPnP is a fix-all: UPnP is a convenience, not a guarantee. It fails in many real-world scenarios.
• Assuming the console is at fault: The console is just reporting the NAT type. The problem is in the network.
• Port forwarding without a static IP: If the console’s IP changes, the port forward points to the wrong device. Always set a static IP or DHCP reservation.
• Ignoring CGNAT: If your public IP is not actually public, no amount of router configuration will help.

Command-Line Diagnostics

While the console does not have a command line, you can diagnose the network from a PC on the same network.

Check your public IP:

ipconfig

Look at the “Default Gateway”—that is your router’s IP. Then, from a web browser, visit a site like whatismyip.com to see your public IP. If the public IP starts with 100.64. through 100.127., you are behind CGNAT.

Check if the router has a public IP:

tracert 8.8.8.8

The first hop should be your router’s IP. The second hop should be your ISP’s router. If the second hop is also a private IP (like 10. or 192.168.), you are behind CGNAT.

Test port forwarding:

From an external network (e.g., a phone on cellular data), use an online port checker to see if the forwarded port is open. If it is not, the port forward is not working.

Final Steps

If you have exhausted UPnP, port forwarding, and confirmed you have a public IP, the remaining option is to contact your ISP. Some ISPs offer a public IP for an extra fee, or you can use a VPN with port forwarding. If none of this works, the network you are on simply does not allow open NAT, and the limitation is outside your control.

For a deeper explanation of how NAT works and why these symptoms occur, see the networking guide on NAT.