Types of NAT Explained: Full Cone, Restricted, Symmetric
Understand full cone, restricted cone, port restricted, and symmetric NAT. How each handles packets, and why NAT type matters for peer-to-peer connections.
When two devices on different private networks try to communicate directly — for example, in online gaming, VoIP, or peer-to-peer file sharing — the Network Address Translation (NAT) device between each device and the internet determines whether that direct connection can succeed. The four NAT types — full cone, restricted cone, port restricted, and symmetric — differ in how they treat incoming packets. This page explains the mechanism of each type, and why the difference only becomes visible when two peers attempt to reach each other without a relay.
What NAT Does to a Packet
A NAT device (typically a home router) translates the private IP address and port of an outgoing packet into a public IP address and port. It records this mapping in a translation table. When a response comes back to the public address and port, the NAT consults the table and forwards the packet to the original private address and port.
The critical difference between NAT types is how the device treats incoming packets that are not responses to an outgoing packet — that is, packets that arrive unsolicited, or that arrive for a mapping that was created by a different remote host. The four types are defined by the rules they apply to these incoming packets.
The Four NAT Types
Full Cone NAT
How it works: Once an internal device sends a packet to any external host, the NAT creates a mapping. From that point on, any external host can send packets to that mapped public address and port, and the NAT will forward them to the internal device. The external host does not need to have received a packet from the internal device first.
Effect: The mapping is completely open. Any source IP and port can reach the internal device through that mapping.
Restricted Cone NAT (Address-Restricted Cone)
How it works: The NAT creates a mapping when the internal device sends a packet. However, an incoming packet is only forwarded if it comes from the same IP address that the internal device sent a packet to. The source port of the incoming packet does not matter — only the source IP address must match.
Effect: An external host can send packets to the internal device only if the internal device has previously sent a packet to that host’s IP address. The external host can use any source port.
Port Restricted Cone NAT
How it works: This is a stricter version of restricted cone. The incoming packet must come from the exact same IP address and the exact same port that the internal device sent a packet to. If the internal device sent a packet to IP 203.0.113.5 port 5000, then only packets from 203.0.113.5 port 5000 will be forwarded. Packets from the same IP but a different port are dropped.
Effect: The mapping is tied to a specific remote endpoint (IP:port).
Symmetric NAT
How it works: For each new destination IP and port, the NAT creates a different public mapping. If an internal device sends a packet to IP A port 1000, the NAT assigns one public port. If the same internal device sends a packet to IP B port 2000, the NAT assigns a different public port. The mapping is only valid for the exact destination the internal device sent to. Incoming packets are only forwarded if they come from that exact destination IP and port, and the mapping is unique to that destination.
Effect: The public port changes per destination. Even if two internal devices use the same internal port, the public port will differ for each external destination.
Comparison Table
| NAT Type | Incoming Packet Rule | When It Does NOT Apply |
|---|---|---|
| Full Cone | Any external IP:port can send to the mapped public port | If the internal device has never sent a packet outward, no mapping exists — no incoming packets will be forwarded |
| Restricted Cone | Source IP must match a previously contacted IP | If the internal device has contacted the IP but the incoming packet comes from a different IP |
| Port Restricted Cone | Source IP and port must match a previously contacted IP:port | If the source port differs from the one contacted, even if the IP matches |
| Symmetric | Source IP and port must match the exact destination of the outgoing packet, and the public port is unique to that destination | If the internal device contacts a new destination, the old mapping is not reused — a new public port is assigned |
Why NAT Type Matters: Peer-to-Peer Connections
When two peers (e.g., two game consoles) try to connect directly, each sends a packet to the other’s public IP and port. For the connection to succeed, each NAT must accept the incoming packet from the other peer. The NAT type determines whether that acceptance happens.
- Full cone: Both peers can connect easily. The first packet from each peer creates a mapping that the other peer can use.
- Restricted cone: Each peer must first send a packet to the other’s public IP. Once that is done, the other peer’s packets are accepted. This works if both peers send packets simultaneously.
- Port restricted cone: Each peer must send a packet to the exact public IP and port of the other. This is more difficult because the public port may not be known until the first packet is sent, and the port may change.
- Symmetric: Each peer’s NAT assigns a different public port for each destination. When peer A sends a packet to peer B, it uses a port that is only valid for B. But B’s NAT will only accept a packet from A’s other port (the one A used to contact B). This creates a deadlock: A’s mapping for B is not the same as A’s mapping for a different destination, and B’s NAT requires that exact mapping. Direct connection fails without a relay.
What People Get Wrong About NAT Types
A common misdiagnosis is that a “strict” or “symmetric” NAT is a configuration error or a sign of a faulty router. In reality, symmetric NAT is a deliberate security feature. It prevents unsolicited incoming connections by ensuring that a mapping is only usable by the exact destination it was created for. This is not a mistake — it is a design choice that prioritizes security over connectivity.
Another misconception is that changing the NAT type is always possible through router settings. While some routers offer a “gaming mode” or “open NAT” option that effectively makes the NAT full cone, many consumer routers, especially those with carrier-grade NAT (CGNAT) imposed by the ISP, do not expose such controls. CGNAT is symmetric and cannot be changed by the user.
A third error is assuming that the NAT type is a property of the device (e.g., the game console) rather than the network. The NAT type is determined by the router and the network path. Two devices on the same network will see the same NAT type, because they share the same public IP and the same NAT device.
How to Determine Your NAT Type
To determine the NAT type of a network, a device can send a packet to a known public server and observe the public IP and port assigned. Then a second packet is sent to a different server, and the public port is compared. If the port is the same, the NAT is likely cone-based; if it changes, it is symmetric. To test the restriction level, an external server can attempt to send a packet to the mapped port from a different IP or port and see if it arrives. This is the basis of STUN (Session Traversal Utilities for NAT) and TURN (Traversal Using Relays around NAT) protocols.
On Windows, the netstat command can show active connections and the local and foreign addresses, but it does not directly reveal the NAT type. Tools like stun-client or online STUN tests can provide the type, but they require an external server.
Practical Implications
- Gaming: Many games use peer-to-peer connections. A symmetric NAT will often fail to connect to another symmetric NAT. Games may fall back to a relay server, which adds latency.
- VoIP: SIP and RTP traffic often require direct media paths. Symmetric NAT can break these, causing one-way audio or call failures.
- File sharing: Peer-to-peer protocols like BitTorrent rely on incoming connections. A symmetric NAT limits the ability to receive connections from other peers, reducing download speeds.
What Can Be Done
If a symmetric NAT is causing connectivity problems, the options are limited:
- Enable UPnP (Universal Plug and Play) on the router. UPnP allows applications to request port mappings automatically. However, some routers disable UPnP for security reasons, and it may not work with symmetric NAT.
- Use a VPN. A VPN can bypass NAT by creating a virtual network interface with its own public IP, but this adds overhead and may not be suitable for gaming.
- Contact the ISP. If the ISP uses CGNAT, the user may be able to request a public IP address, often for an additional fee.
No software tweak on the device can change the NAT type if the router is symmetric. The NAT type is a property of the network, not the device.
Conclusion
The four NAT types differ in how they handle incoming packets relative to outgoing ones. Full cone is the most permissive, symmetric the most restrictive. The distinction only matters when two peers attempt a direct connection, because the NAT must accept an unsolicited packet from the other peer. Understanding the mechanism allows predicting whether a direct connection will succeed, without needing to test every combination.
Common questions
What is the difference between full cone and restricted cone NAT?
Full cone NAT allows any external host to send packets to a mapped public port once an internal device has sent a packet out. Restricted cone NAT only allows packets from the IP address that the internal device previously contacted. The source port does not matter for restricted cone.
Why does my game say 'strict NAT' and can I fix it?
Strict NAT usually corresponds to symmetric or port restricted cone NAT. It can be fixed by enabling UPnP on the router, using port forwarding, or requesting a public IP from your ISP if you are behind CGNAT. However, if the router is symmetric and does not support UPnP, the NAT type cannot be changed.
Is symmetric NAT better for security?
Yes, symmetric NAT is more secure because it only allows incoming packets from the exact destination that the internal device sent to. This prevents unsolicited connections. However, it makes peer-to-peer connections difficult, which is why it is often called 'strict' in gaming contexts.
How do I check my NAT type on Windows?
Windows does not have a built-in command to show NAT type. You can use a STUN client tool or an online STUN test. Alternatively, check your router's status page for the public IP and port, but the NAT type is not usually displayed. A simple test: open two different websites that show your public IP and port; if the port changes, you likely have symmetric NAT.
Can I change NAT type from symmetric to full cone?
Not directly. The NAT type is determined by your router and ISP. You can try enabling UPnP or using port forwarding, but these may not work with symmetric NAT. If your ISP uses CGNAT, you may need to request a public IP address. A VPN can also bypass NAT entirely, but it adds latency.
Read next
- ARP and MAC Addresses: Finding the Hardware How a host finds the MAC behind an IP, why ARP never leaves the local network, and how a stale cache entry produces a confusing partial outage.
- How DHCP Works: DORA, Leases, and Failure Modes Understand DHCP: the DORA exchange, lease lifecycle, renewal timing, and failure modes like exhausted scopes and conflicting servers.
- DNS Zones Explained: Zone vs Domain, Delegation, SOA Understand DNS zones: what a zone is, how it differs from a domain, delegation, SOA records, zone transfers, and forward/reverse zones.
- chkdsk, SFC and DISM: Which One to Run and When Three repair tools with three different jobs. Why DISM comes before SFC, what chkdsk actually checks, and when chkdsk can finish off a failing drive.
- Fix 'A required CD/DVD drive device driver is missing' During USB Install When Windows setup says a CD/DVD driver is missing but you're installing from USB, the real cause is usually USB port or media. Learn how to fix it.