Every guide to fixing a Strict NAT type gives you the same three steps: enable UPnP, forward some ports, restart the router. For a lot of people that works, and the problem disappears.
For everyone else, those steps do nothing at all — and the guides go quiet. Search any NAT troubleshooting thread and you'll find the same comment, upvoted and unanswered: UPnP is already on and it's still Strict. People replace routers, upgrade broadband packages and buy new Ethernet cables chasing it.
The usual reason is that the fix was never available to you in the first place. Your router isn't the thing blocking the connection — your ISP is.
What NAT type is actually measuring
Network Address Translation lets many devices in your home share one public IP address. Your console has a private address on your LAN; the router rewrites outgoing packets so they appear to come from the public address, and remembers enough to send replies back.
That works perfectly for anything you initiate. It gets awkward for peer-to-peer multiplayer, where another player's console needs to open a connection to you. The router has to already know where to send that traffic.
Consoles report how much of a problem this is, using three different naming schemes for the same idea:
- Xbox: Open, Moderate, Strict
- PlayStation: Type 1, Type 2, Type 3
- Nintendo Switch: A, B, C, D, F
Roughly: the best tier means inbound connections reach you directly; the middle tier means your router is cooperating via UPnP or forwarded ports; the worst means inbound connections aren't getting through and the game falls back to relays, or fails to match you at all.
Moderate and Type 2 are fine. This is worth saying plainly, because a lot of effort gets spent chasing Open for no practical benefit. Type 2 will match you into games, hold voice chat and let you party up. Chasing Type 1 from Type 2 is optimisation; getting off Strict is a real fix.
The part most guides miss
Here's the assumption underneath every "just forward the ports" article: that the public IP on your router is genuinely yours to control.
Increasingly, it isn't.
There are not enough IPv4 addresses left to give every customer their own. So ISPs put a second layer of NAT in their own network — carrier-grade NAT, or CGNAT — and share one public address between many households. Your router gets an address that looks public-ish but isn't routable from the internet.
When you forward a port on your router under CGNAT, you're opening a door in the wrong building. Traffic from the internet never reaches your router in the first place; it stops at the carrier's NAT, which has no idea it should be sending anything to you. UPnP has exactly the same problem: it asks your router to open a port, and your router can only do that on the address it controls.
CGNAT is most common on:
- 5G and 4G home broadband — almost universally
- Starlink — by default
- Budget and newer fibre providers, particularly where the network was built recently
- Student halls, shared housing and any managed building network
None of this is a fault. It's a sensible response to IPv4 exhaustion. But it does mean the standard advice cannot work, and no amount of router configuration will change that.
Confirming it in two minutes
You don't have to guess. Compare two numbers.
First, log into your router and find its WAN or Internet IP address — the address the ISP gave it, not the 192.168.x.x address it gives your devices.
Second, on any device on that network, visit a "what is my IP" site and note the public address.
Now compare:
- The two match → you have a normal public IP. Port forwarding can work, and your Strict NAT has a different cause. Skip to the next section.
- They differ → something between you and the internet is doing another layer of translation. That's CGNAT, or a double-NAT of your own making.
There's a stronger tell. If your router's WAN address falls in 100.64.0.0 – 100.127.255.255, that's the address range reserved specifically for carrier-grade NAT. Seeing an address in that block is close to conclusive.
A WAN address starting 10., 192.168. or 172.16–31. means your router is sitting behind another router — a double NAT. That one you can usually fix yourself, and it's worth ruling out first.
Double NAT: the version you can fix
If your ISP supplied a combined modem-router and you've added your own router behind it, you have two devices both doing NAT. Ports forwarded on the inner router are invisible to the outer one.
Two clean fixes:
- Put the ISP device into modem or bridge mode, so it stops routing and your router holds the public address. Best outcome where the ISP allows it.
- Forward the ports twice, or put your inner router in the ISP device's DMZ. Workable, uglier, and you're maintaining two sets of rules forever.
This is genuinely worth checking before you conclude you're on CGNAT, because the symptoms are identical and the fix is free.
What actually works when you're behind CGNAT
In rough order of how much we'd recommend them.
Ask your ISP for a public IPv4 address
Unglamorous, and usually the right answer. Many ISPs will move you off CGNAT on request. Some do it free, some charge a few pounds a month, some offer it only on business tariffs.
It's worth asking specifically for "a public IPv4 address" or "removal from CGNAT" — front-line support often won't recognise vaguer phrasing. Where it's available, this fixes the problem properly: port forwarding starts working, and you can stop thinking about it.
Use IPv6 where your console and game support it
IPv6 sidesteps the whole issue. There are enough addresses that every device can have its own, so there's no carrier NAT in the path and no ports to forward.
Support is genuinely mixed — it depends on your ISP, your router, your console and the individual game's netcode, and a game that supports IPv6 on one platform may not on another. Check whether your ISP provides IPv6, then whether it's enabled in your router, then what your console's network settings report. Where the whole chain lines up, it can quietly resolve a Strict NAT with no port forwarding at all.
Xbox is the platform where this matters most: its multiplayer stack leans on IPv6, using Teredo tunnelling to fake it over IPv4 networks. The "Teredo is unable to qualify" error is very often a CGNAT symptom wearing a different hat.
A VPN with port forwarding — with clear eyes about the trade
Most of the content you'll find on this topic is published by VPN companies, and the recommendation is always a VPN. It does work, in a specific sense: a VPN that offers port forwarding gives you a routable address at the VPN endpoint, and inbound connections reach you through the tunnel.
Be clear about what you're buying, though. A VPN does not fix your NAT type — it bypasses your ISP's NAT by routing you around it, and you pay for that in latency. Your traffic now travels to the VPN endpoint before it goes anywhere useful. If that endpoint is nearby and well-peered, the cost might be a handful of milliseconds. If it isn't, you'll have traded a matchmaking problem for a ping problem, which for competitive play is a bad swap.
If you try it, measure your ping to the same game servers before and after. Don't take the improvement on faith.
Accept Moderate, and check it's actually the problem
If you're already at Moderate or Type 2 and games are matching you, there may be nothing left to fix. Strict is worth effort; the last step from Moderate to Open usually isn't.
And if you're on Strict but your real complaint is lag rather than matchmaking, NAT type may be a red herring entirely. Latency spikes under load are usually bufferbloat, which is a completely separate problem with a completely different fix.
When it isn't CGNAT
If your router's WAN address does match your public IP and you're still Strict, the usual suspects are:
- UPnP disabled, or silently broken. Some routers offer it, accept the setting and don't act on it. Try a manual port forward to test.
- Symmetric NAT. Some routers assign a different outbound port per destination, which defeats the hole-punching most peer-to-peer games rely on. If your router exposes a NAT type or "full cone" setting, that's what it's referring to.
- A conflicting forward. Two devices claiming the same port; only one wins.
- A dynamic IP that moved. Forwards point at a LAN address your console no longer has. Set a DHCP reservation so it always gets the same one.
- Console-level ISP restrictions, occasionally, on managed or institutional networks.
On port forwarding and security
Worth saying, because it rarely is. Forwarding a port removes a layer of protection from whatever is behind it. For a games console that's low risk — consoles are locked down and there's little to attack.
Two things deserve more caution:
- DMZ exposes a device completely. Don't put a PC in it, and don't leave a console there once you've finished testing.
- UPnP lets any device on your network open ports without asking. Convenient, and it has a long history of vulnerabilities. If you're comfortable configuring forwards by hand, turning UPnP off and doing it manually is the tighter setup.
The short version
Enable UPnP first — it fixes a good share of cases in about a minute. If your NAT type doesn't move, stop configuring and start diagnosing: compare your router's WAN address to your public IP.
If they differ, you're behind CGNAT, no router setting will change it, and your realistic options are asking your ISP for a public IP, getting IPv6 working end to end, or routing around the problem through a VPN and accepting the latency.
Knowing which of those you're in beats another hour in the router admin page.