NAT Types Explained: Open vs Moderate vs Strict (and How to Fix Strict NAT for Gaming)
Published 2026-08-18 · By NetAudioHub Editorial
Your console's NAT type — Open, Moderate, or Strict on PlayStation, Type 1/2/3 on Xbox — is not a speed or security score. It describes one thing: how easily another player's console can start a connection to yours through your router. Open lets everyone in, Moderate lets some through and is the healthy target for a home network, and Strict blocks nearly all unsolicited inbound connections, which is why you get stuck in matchmaking, lose party chat, and can only join Open players. The good news: Strict NAT is almost always a router-configuration problem, and the fix follows a fixed order — turn on UPnP first, rule out Double NAT second, and fall back to manual port forwarding or a console-only DMZ only if those come up empty. Here's what each type means and exactly how to open yours up without leaving your network exposed.
The verdict up front: your console's NAT type — Open, Moderate, or Strict on PlayStation, or Type 1, 2, or 3 on Xbox — is not a measure of speed or security. It describes one thing: how easily another player's console can start a connection to yours through your router. Open means anyone can reach you, so you host lobbies and join everyone. Moderate means some connections get through and it usually works with a few dropped hosts. Strict means your router blocks nearly every unsolicited inbound connection, which is why you get stuck in matchmaking, can't hear party chat, and can only join Open-NAT players. The good news is that Strict NAT is almost always a router-configuration problem, not a broken console. The fix follows a fixed order: turn on UPnP first, rule out Double NAT second, and only fall back to manual port forwarding if those two do not do it. Here is what each type means and exactly how to open yours up without leaving your network exposed.
What NAT Actually Does
NAT stands for Network Address Translation, and it is the reason a whole house full of devices can share one public internet address. Your ISP hands your router a single public IP. Every phone, laptop, and console behind it gets a private IP that only exists inside your home. When your console reaches out to a game server, your router rewrites the outgoing packet so it looks like it came from the public IP, remembers which internal device asked, and forwards the reply back to the right place. That rewriting is NAT, and every home router does it. It is not optional and it is not a bug — it is what makes a shared internet connection work. If you want the full picture of what your router, modem, and gateway each contribute here, our modem vs. router vs. gateway explainer breaks the roles apart.
The catch shows up with connections that start from outside your network. Online games are peer-heavy: your console does not just talk to a central server, it often needs to accept a direct connection from another player's console — that is how party chat, hosted lobbies, and low-latency matchmaking work. But your router has no forwarding rule for a connection it did not see you request first, so by default it drops those unsolicited inbound packets. How strictly it drops them is exactly what your console reports as your "NAT type."
The Three NAT Types
Both Xbox and PlayStation grade your connection into three buckets. The names differ but the meaning is identical:
| NAT type | PlayStation | Xbox | What it means | Typical result |
|---|---|---|---|---|
| Best | Open (Type 1) | Open | Console is directly reachable from the internet | Hosts lobbies, connects to everyone |
| Middle | Moderate (Type 2) | Moderate | Some inbound connections allowed via UPnP/port mapping | Works in most games, occasional host issues |
| Worst | Strict (Type 3) | Strict | Router blocks nearly all unsolicited inbound connections | Stuck matchmaking, no party chat, joins Open players only |
A couple of things are worth clearing up. First, PlayStation's "Type 1" (Open) is not actually ideal for most people — true Type 1 means the console is sitting directly on the public internet with no router firewall in front of it, which you only get in a DMZ or with the console plugged straight into the modem. For a normal home setup, Moderate/Type 2 is the realistic target and is perfectly fine. The problems people complain about are almost always Strict/Type 3.
Second, two players can only connect smoothly if their NAT types are compatible. Open talks to everyone. Moderate talks to Open and other Moderate. Strict can only talk to Open — two Strict players usually cannot connect to each other at all, which is why party chat with a friend can fail even when the game itself loads.
Why You End Up With Strict NAT
Strict NAT is not random. It comes from one of a handful of configuration causes, roughly in order of how often they are the culprit:
- UPnP is turned off (or the game never got a port). Universal Plug and Play lets your console ask the router to open the ports it needs automatically. If UPnP is disabled, the console has no way to request an inbound path and lands on Strict.
- Double NAT. Your traffic is passing through two routers in series — commonly an ISP gateway in "router mode" with your own router behind it. The inner router can open its own ports, but the outer one still blocks everything, so the console stays Strict. This is common enough that it deserves its own check; see our Double NAT explained and how to fix it guide.
- Carrier-Grade NAT (CGNAT). Some ISPs — especially mobile, 5G home internet, and Starlink — put you behind their NAT and never give you a real public IP. You cannot port-forward your way out of this one; only the ISP can hand you a public or static IP.
- A restrictive router firewall or "gaming"/SPI setting that blocks inbound connections more aggressively than the console wants.
Notice that the first two causes are things you can fix yourself in about ten minutes, and they cover the large majority of cases. Only CGNAT genuinely requires a call to your ISP.
How to Fix Strict NAT — In Order
Work through these in sequence and stop as soon as your console reports Moderate or Open. Do not skip ahead to port forwarding or DMZ — those are the last resort, not the first move.
1. Turn on UPnP
Log into your router (usually 192.168.1.1 or 192.168.0.1 in a browser) and find the UPnP setting — it is normally under Advanced, NAT Forwarding, or WAN. Turn it on, save, and reboot both the router and the console. For most people this single step flips Strict to Moderate or Open, because the console can now request its own ports on demand. Leave UPnP on unless you have a specific reason not to; it is the intended mechanism for exactly this job.
2. Rule out Double NAT
If UPnP did not do it, check whether you have two routers. Compare the WAN/Internet IP shown in your router's status page against the address you get from a "what is my IP" lookup. If they do not match — or your router's WAN IP starts with 192.168.x.x, 10.x.x.x, or 100.64.x.x — you are behind a second router or CGNAT. The clean fix is to put your ISP's gateway into bridge mode so your own router does the routing, which collapses the two NATs into one. Our Double NAT guide walks through detecting it and the bridge-mode steps.
3. Manually forward the console's ports
If UPnP is off-limits on your network or unreliable, forward the specific ports each console needs to a fixed internal IP. First give the console a static/reserved IP in your router's DHCP settings so the forward keeps pointing at the right device, then add the port-forward rules. The exact ports differ by console and game, but the mechanism is identical for all of them — our step-by-step how to set up port forwarding on your router (safely) covers reserving the IP and forwarding ports without exposing the rest of your network.
4. DMZ — only if nothing else works
A DMZ places one device outside the router's firewall entirely, which forces Open NAT. It works, but it strips that device of the router's protection, so use it only for a console (never a PC or NAS) and only after the safer options have failed. If you do use it, point the DMZ at the console's reserved IP so it does not accidentally expose another device later.
What NAT Type Does Not Affect
It is worth saying plainly, because the forums are full of confusion: your NAT type does not change your download or upload speed, your ping to a server you are already connected to, or your general browsing. A Strict NAT console downloads game updates exactly as fast as an Open one. NAT type only governs whether other players' consoles can start a connection to you — which is why its symptoms are so specific: failed matchmaking, party-chat dropouts, "unable to host" errors, and being unable to join a friend's lobby. If your problem is lag or stutter during a match rather than getting into one, that is a bandwidth or prioritization issue, and our how to prioritize gaming traffic with QoS guide is the better place to start.
The Short Version
NAT type is a reachability grade, not a speed or security score. Aim for Moderate/Type 2 — it is the normal, healthy result for a home network behind a router, and it plays fine with almost everyone. Chase Open only if you host a lot of lobbies and understand the trade-off. If you are stuck on Strict, turn on UPnP first, check for Double NAT second, and reach for manual port forwarding or a console-only DMZ only if those two come up empty. The one case you cannot fix yourself is CGNAT, where the answer is a phone call to your ISP asking for a public IP. In every other scenario, Strict NAT is a setting waiting to be changed — not a wall.