Owen Bradley If your console reports a moderate or strict NAT type, you already know the symptoms: party chat that will not connect, matchmaking that takes forever, and hosting privileges that never come your way. Getting an open NAT type is not black magic, but it does require working through the layers in the right order, because each fix can be undone by the one above it. This guide walks through the reliable path, from the easy console-side toggles to static leases and manual port forwarding, and finishes with the one scenario where nothing on your end will help. Follow it in sequence and most households land on open in under half an hour in 2026.
What NAT Type Actually Means
NAT, or Network Address Translation, is how your router lets many devices share one public address. When your console wants a direct peer-to-peer connection with another player, the router has to know which internal machine should receive that incoming traffic. Open NAT means the console can accept those connections freely. Moderate means some traffic gets through but peer connections are limited. Strict means almost nothing inbound arrives unsolicited, so you can only connect to players with open NAT.
Sony labels these Type 1, Type 2 and Type 3, where Type 2 is the normal healthy state for a console behind a router and Type 1 usually means the console sits directly on the public internet. Xbox uses the words open, moderate and strict. In practice, aiming for open on Xbox or Type 2 on PlayStation is the realistic goal for a home network.
Before You Begin
- Router admin access — the gateway address and password, often printed on the underside label.
- Your console’s MAC address, found under network settings on both platforms.
- An Ethernet cable, ideal for testing because it removes wireless variables from the equation.
- Your ISP account details, in case you need to ask about a public address.
- About 30 minutes and a willingness to reboot the router two or three times.
Step-by-Step: Getting to Open NAT
-
Record your current state. Run the built-in connection test on the console and note the exact NAT result, the local IP address, and whether the test flags UPnP as unavailable. Take a photo of the screen. Without a baseline you will not know which change actually worked.
-
Count your routers. The single most common cause of strict NAT is double NAT, where an ISP gateway and your own router both perform translation. Look at the address your router reports on its WAN or internet page. If it starts with 192.168, 10., or 172.16 through 172.31, you are behind a second router. Fix this by putting the ISP box into bridge or modem-only mode, or by placing your own router in the gateway’s DMZ. This one change resolves a large share of cases on its own.
-
Enable UPnP and test. In the router’s advanced or NAT settings, turn on UPnP, save, and reboot the router. Then rerun the console connection test. UPnP lets the console request the ports it needs automatically, and when it works, you are finished. If your router offers both UPnP and NAT-PMP, enabling both is harmless.
-
Give the console a static DHCP lease. If UPnP is unavailable or you plan to forward ports manually, the console needs an address that never changes. In the router’s DHCP reservation table, bind the console’s MAC address to a fixed IP outside the automatic pool, for example 192.168.1.50. Reboot the console so it picks up the reservation, then confirm the new address in network settings.
-
Forward the required ports. Create port forwarding rules pointing at that reserved address. For Xbox, forward TCP 3074 and UDP 88, 500, 3074, 3544 and 4500. For PlayStation, forward TCP 1935, 3478 to 3480, and UDP 3478 to 3479. Enter each rule carefully, watching that you set the correct protocol, since a UDP rule entered as TCP silently does nothing. Save and reboot the router.
-
Retest and stop if open. Run the console test again. Many people reach open here. If the result is still moderate, continue, but first double-check that UPnP is now off, because UPnP and manual forwarding on the same ports can conflict and produce inconsistent results.
-
Try a DMZ as a diagnostic. Placing the console’s reserved IP in the router’s DMZ forwards all unsolicited inbound traffic to it. Use this as a test rather than a permanent setup. If DMZ produces open NAT, your port rules were wrong somewhere, so go back and correct them. If DMZ still yields moderate or strict, the restriction is upstream of your router and no local setting will change it.
-
Check for CGNAT. Compare the WAN address shown in your router to the public address a “what is my IP” site reports. If they differ, your ISP is using carrier-grade NAT and is sharing one public address among many customers. Nothing you configure at home can open NAT under CGNAT. Call the ISP and ask for a public or static IPv4 address; many will provide one on request or for a small monthly fee.
-
Enable IPv6 if your ISP supports it. Both consoles handle IPv6 well, and because IPv6 does not require translation, it frequently sidesteps NAT problems entirely, including some CGNAT situations. Turn IPv6 on in the router, reboot the console, and retest.
-
Lock in the result. Once open, back up the router configuration, note the reserved IP and port rules somewhere safe, and disable any old forwarding rules left over from earlier attempts. Stale rules pointing at addresses no longer in use are a frequent cause of the problem returning months later.
When the Router Is Holding You Back
Some routers have genuinely unreliable UPnP implementations that stop renewing leases after a few hours, so NAT reverts to moderate without warning. Others cap the number of forwarding rules, or reset them on firmware updates. If you have followed every step and the result keeps drifting, the firmware is the problem.
Console-focused hardware handles this far better. Our roundup of the best gaming routers covers models with dependable UPnP and clear rule management, while the best routers for port forwarding list focuses specifically on firmware that makes manual rules easy to create and keeps them intact. PlayStation owners can compare options in our best routers for PS5 guide, and Xbox players will find matched picks among the best gaming routers for Xbox One. If you want a deeper walkthrough of the forwarding process itself, including hosting your own game servers, see our dedicated article on port forwarding for gaming servers.
Safety Notes
Port forwarding and DMZ both open your network to inbound traffic, so treat them with respect. Forward only the specific ports the console needs rather than wide ranges, and never leave a PC or NAS in the DMZ. Consoles are relatively hardened targets, but a general-purpose computer exposed that way is a real risk.
Change the router’s admin password from the factory default before you enable anything inbound, and disable remote administration from the internet unless you genuinely need it. Finally, avoid the temptation to run a permanent DMZ just because it worked during testing; proper port rules achieve the same result with a fraction of the exposure.
Troubleshooting Persistent Moderate NAT
- Open at first, moderate later. Almost always a UPnP lease that expired or a DHCP address that changed. Add the static reservation.
- Two consoles, only one open. The same ports cannot be forwarded to two devices. Rely on UPnP for both instead of manual rules.
- Test passes but party chat fails. Check for a VPN, a third-party DNS filter, or router-level parental controls intercepting traffic.
- Rules disappear after a reboot. Failing router memory or a firmware bug; update firmware, then replace the unit if it recurs.
- Strict on Wi-Fi, open on Ethernet. Guest network or client isolation is enabled on the wireless band.
Mistakes That Waste an Afternoon
The biggest is skipping the double NAT check and spending an hour on port rules that can never work because a second router upstream discards the traffic first. Always verify the WAN address before touching anything else.
The second is leaving UPnP enabled alongside manual forwarding on the same ports, which produces results that change every reboot. Pick one method. The third is forgetting the static lease, so the console gets a new address on the next power cycle and every carefully entered rule now points at nothing. And finally, plenty of people never rerun the console test after each change, so they cannot tell which step delivered the improvement or which one broke it again.
Frequently Asked Questions
Is Type 2 on PlayStation the same as open?
Effectively yes for home use. Type 1 means the console is directly exposed to the internet, which is not necessary and not especially desirable. Type 2 gives you full matchmaking and party functionality.
Does UPnP make my network unsafe?
UPnP lets devices on your own network open ports without asking you, which is a real if modest risk. On a household network with trusted devices and current firmware it is a reasonable trade for the convenience. If you prefer control, use static leases and manual rules instead.
Can a mesh system cause strict NAT?
Mesh nodes running in router mode behind an existing gateway create double NAT. Set the mesh system to access point or bridge mode, or bridge the ISP box, and the problem usually clears immediately.
Will a VPN give me open NAT?
Some VPN services offer port forwarding that can help under CGNAT, but most add latency and many block gaming traffic outright. Ask your ISP for a public address before going down that road.
Final Thoughts
Open NAT comes down to three questions in order: is there a second router, does UPnP work, and is your public address really yours. Answer those honestly, add a static lease so nothing drifts, and forward only the ports the console actually needs. If your router keeps forgetting its own rules, that is a hardware verdict rather than a configuration puzzle, and moving to a model with solid gaming firmware will save you from repeating this process every few months.
