Strict or moderate NAT on PC: UPnP, double NAT and CGNAT

"My friends can't join my lobby." "Party chat connects for everyone except me." "The game says NAT Type: Strict, and restarting the router changed nothing." All three can come from one mechanism: something between the internet and your PC lets your traffic out, but stops a connection that another player starts toward you.

What NAT does, and what the label grades

Your router has one IPv4 address on its internet side and gives your devices private ones. Network address translation (NAT) rewrites your packets on the way out and remembers each conversation so the replies find their way back. RFC 3022 spells out the consequence: in traditional NAT, sessions are "uni-directional, outbound from the private network", and a session started from outside gets in only through a mapping set up in advance for that host.

That is why joining a server works even with a bad label: your PC starts that conversation. The NAT type grades how well a conversation started by someone else gets through. Xbox Support defines the grades:

Open: you can play and host with people who have any NAT type.
Moderate: you might not be able to play with some people, and normally you won't be chosen to host.
Strict: you can only play with people whose NAT is Open, and you can't be chosen to host.
Unavailable: no party chat, and no multiplayer in some Xbox titles.

Microsoft's developer documentation states the same rule: Moderate connects only with Moderate or Open, Strict only with Open. By that rule, two Strict players cannot connect to each other.

When it matters, and when it barely does

The label matters when someone else has to reach you:

Peer-to-peer matches. Microsoft's Game Development Kit documentation tells developers that peer-to-peer games built on it "are still expected to provide their own public IP address and port discovery along with a NAT punching solution for clients that have moderate or strict NAT types".
Hosting. A lobby you host, or a listen or dedicated server on your PC, waits for others to connect. For dedicated or listen servers, Valve's Steam Support lists UDP 27015 as the default port for gameplay traffic.
Voice and party chat, which Xbox Support ties to the NAT type alongside multiplayer.

It barely matters when the game puts every match on its own servers or through a relay, because then your PC opens every connection itself. Valve's Steam Datagram Relay carries game traffic over Valve's backbone and relays, "for both peer-to-peer traffic and dedicated servers", and IP addresses "are never revealed". Counter-Strike 2's release notes, for one, tell connections "relayed over SDR" apart from "direct UDP connections to community servers" (Valve, 9 September 2024). A Strict label in some other app says little about a game that never needs anyone to reach you.

Where Windows shows it

On Windows 10, Settings > Gaming > Xbox Networking shows the NAT type and the server connectivity of the Xbox network. Teredo is unable to qualify there means your PC could not get a Teredo address. Teredo is the tunnelling protocol that select games, Forza Horizon 3 and 4 among them, use for multiplayer on the Xbox network (Xbox Support). The same screen has a Fix it button. Xbox Support documents that screen for Windows 10 only; its Windows 11 instructions for the same failure go to Settings > Network & internet > Advanced network settings > Network reset instead.

Teredo also needs the IP Helper service on Automatic and running, and the Windows firewall on with its default policy. Xbox Support adds that some apps that reconfigure Windows "to try to optimize performance" switch IP Helper off, some home routers block Teredo when they see IPv6 on their internet side, and some VPN clients block it while connected. Where a tool changed those settings, w0a's Xbox networking and IPv6 card on the Fix page returns the IP Helper service and the Teredo/IPv6 transition settings to their Windows defaults (how the card works).

Find out which NAT you are behind

Sign in to your router and note the WAN or Internet address on its status page.
Compare it with your public address, the one any "what is my IP" page shows.
If the two match, your router is the only translator, and UPnP or port forwarding on it can open the way.
If they don't, Xbox Support's verdict applies: "open NAT will not be possible under the current configuration." Look at the WAN address. In 10.x.x.x, 172.16.x.x to 172.31.x.x or 192.168.x.x, check first whether a second box of yours sits in front: a provider gateway plus your own router is double NAT. Between 100.64.0.0 and 100.127.255.255, it is the shared address space reserved for the link between a provider's carrier-grade NAT and your router (RFC 6598).

Fixes, by cause

UPnP on your own router

UPnP lets a game ask your router to accept traffic from outside, with nothing for you to type in. Xbox Support says that if your router supports it, "it's likely turned on by default", and suggests refreshing the router's NAT table: turn UPnP off, save, restart the router, then turn UPnP back on and save again. It also warns: "Don't combine port forwarding, UPnP, and perimeter network (also known as DMZ) settings."

Double NAT: bridge the gateway

With a provider gateway and your own router, "both devices may be performing NAT", and Xbox Support's fix is putting the gateway into bridge mode, so only your router translates. The steps depend on the gateway; its documentation or your provider has them.

Port forwarding, when you host

A forward sends one port straight to one device, so that device needs an address that does not change. Xbox Support's method: in the router's DHCP or LAN section, add the device's MAC address to the reserved list. Then forward only the ports and protocols the game's publisher lists, such as UDP 27015 in Valve's list for dedicated or listen servers. The perimeter network (DMZ) option goes much further: Xbox Support describes it as moving your device "to an area outside your network firewall".

Carrier-grade NAT: only your provider can change it

A carrier-grade NAT shares one IPv4 address among several subscribers, and RFC 6888 adds that it "is not managed by the subscribers": no setting on your router reaches it. A test report by CableLabs and two cable operators, published as RFC 7021, found in 2010 tests that "IPv6 transition technologies such as 6to4 and Teredo fail outright or are subject to severe service degradation" behind one. Xbox Support's advice is to ask your provider for a public IP address and, if it can't give you one, to change providers.

IPv6, where the game uses it

RFC 7021 calls IPv6 "the solution to the IPv4 depletion problem". The IETF's recommendations for home IPv6 routers (RFC 6092) expect NAT to be unlikely there, but keep its habit of admitting only traffic started from inside, and ask for a way for applications to open inbound flows, or a "transparent mode". So IPv6 helps only where your provider, your router and the game all use it; Microsoft's Game Development Kit documentation asks games to bind their multiplayer port to both IPv4 and IPv6. Leave Windows' IPv6 components at their defaults: among the causes of Teredo failures, Xbox Support lists Teredo switched off in the registry, by a program or by hand.

What does not change your NAT type

Windows network settings. TCP options and DNS don't touch the translation, which happens in your router or at your provider. Network tweaks covers what those boxes do.
Turning the firewall off. Xbox Support says Teredo needs the Windows firewall running with its default policy, and that with an inbound policy of "AllowInbound", Teredo cannot establish its IPsec connection.
A DMZ on top of UPnP or port forwarding. Xbox Support says not to combine them.
A VPN. Some VPN clients block Teredo, and some leave a firewall rule behind that keeps blocking it after they are uninstalled. Whether a VPN helps your ping is a separate question: can a VPN lower your ping?

Did this page help?

What was missing, or what did not work? We read every one of these.

If this page did not solve it, write to us — say which article you read, and we will fix the article.