What is NAT?
Network Address Translation is the reason a whole household can share one public IP address, and the reason a game console sometimes complains about your "NAT type". Here is what the router is doing, and how to work with it.
In this guide
NAT (Network Address Translation) is what your router does to let many devices with private addresses share one public IP address. It rewrites the source address and port of every outgoing connection to its own public address and a unique port, keeps a table of those mappings, and uses the table to send replies back to the right device. The side effect is that nothing on the internet can start a connection to a device behind NAT unless the router is told to allow it.
How NAT works
Your internet provider gives the router one public address, say 203.0.113.42. The router gives every device in the house a private address from a range that is not routable on the internet, such as 192.168.1.23. Private addresses are free and plentiful, but a packet carrying one as its source would never get a reply, because no router on the internet knows where 192.168.1.23 lives. NAT solves that at the boundary.
When the laptop opens a connection, the router replaces the source address 192.168.1.23 with 203.0.113.42 and replaces the source port, 51000, with one it picks, 40001. It writes the pair into a translation table. When the reply comes back addressed to 203.0.113.42:40001, the router looks up the table, rewrites the destination back to 192.168.1.23:51000 and delivers it. The phone doing the same thing gets port 40002. Thousands of connections can share one address this way, which is why the technique's full name is Network Address and Port Translation, usually shortened to NAT or PAT.
Everything downstream of this is a consequence of the table. Entries are created by outgoing traffic, so a packet arriving from the internet for a port that is not in the table has nowhere to go and is dropped. That makes NAT an accidental firewall: a printer or a camera behind a NAT router is not reachable from outside by default. It also means the public address belongs to the router, not to any device, which is why the CheckMyIP homepage shows the same address for every device in the house, while the local IP tool shows each device's own private one. Public vs private IP addresses covers the two sides in more detail.
NAT was introduced in 1994 as a stopgap against IPv4 address exhaustion, and it worked so well that it became permanent. The cost is that any application where two users need to connect directly to each other, which is most games, voice chat and peer-to-peer video, has to find a way through two NATs that were never meant to let connections in.
Test it now
Cloudflare edgeRead at the Cloudflare edge from this request. The homepage adds your provider, network type and the VPN, DNS and WebRTC checks.
Show detailsNAT types for gaming
Consoles and games test how your NAT behaves and summarize the result in a label. The labels differ by platform but describe the same spectrum, from "anyone can reach you" to "almost nobody can".
| Behavior | Xbox | PlayStation | Nintendo Switch | What it means in play |
|---|---|---|---|---|
| No NAT, or NAT with the console's ports open | Open | Type 1 (direct) or Type 2 with ports open | A | You can connect to anyone and host for anyone |
| Ordinary home NAT that reuses mappings predictably | Moderate | Type 2 | B | You connect to most players; hosting and voice chat sometimes fail with strict peers |
| NAT that makes a new mapping for every destination, or double NAT | Strict | Type 3 | C, D or F | You can only reach players with open NAT; matchmaking is slow and parties drop |
The behavior behind the labels is how the router reuses the port it assigned. A friendly router gives your console one external port and keeps it for every destination, so another player can be told "reach me at 203.0.113.42:40001" and succeed. A strict router assigns a different external port for each destination, so the port your console announced to the matchmaking server is useless to the other player. Carriers' and some ISPs' large NATs behave this way, and so do many older or cheaper routers.
Two cases are worth naming because no router setting fixes them. Double NAT: a router behind another router, each translating, which is common when an ISP modem-router is combined with your own router or a mesh system. The fix is to put the inner router in bridge or access-point mode, or to make the outer one bridge. Carrier-grade NAT: your provider puts your whole connection behind its own NAT, so you never had a public address to open. The NAT type test detects both, and What is CGNAT? covers your options when the provider is the problem.
NAT and port forwarding
Port forwarding is a permanent entry in the translation table, written by you rather than by outgoing traffic. A rule such as "TCP 25565 to 192.168.1.23" tells the router that anything arriving at its public address on port 25565 belongs to the laptop, with no prior outgoing connection needed. That is how you host a game server, reach a camera from your phone, or run a VPN into your home network.
- Give the device a fixed private address, either in the device's settings or with a DHCP reservation in the router, so the rule does not point at the wrong device after a reboot.
- In the router's admin page, find Port Forwarding, Virtual Server or NAT Forwarding, and add the port, the protocol (TCP, UDP or both) and the device's address. The common ports list has the numbers for most services and consoles.
- Allow the port through the device's own firewall.
- Test it with the port checker, which connects from the internet to your public address on that port. Open means the rule works; closed or filtered means something in steps 1 to 3 is wrong, or the provider is using CGNAT and the port never reaches your router.
Consoles usually skip the manual rule by using UPnP, a protocol that lets a device ask the router to open a port for it. Turning UPnP on in the router is the single most common fix for a strict NAT type; the trade-off is that any program on the network can open ports too. A DMZ setting forwards every unsolicited packet to one device and should be a last resort for a console only, never for a computer. The full setup, with router-specific menus, is in What is port forwarding?
One oddity to expect: reaching your own forwarded service by its public address from inside the network only works if the router supports hairpin NAT. Many do, some do not, and the symptom is a service that works from mobile data but not from your own Wi-Fi.
NAT, IPv6 and the future
IPv6 has enough addresses for every device to have a public one, so the address-sharing reason for NAT disappears. A dual-stack home network gives each device a global IPv6 address and the router simply routes it, with a firewall doing the "no unsolicited inbound" job that NAT did by accident. Games and voice chat that use IPv6 can connect peer to peer without any of the NAT type negotiation above, which is one reason consoles and services have been adding IPv6 support. The IPv6 test shows whether your connection has it.
NAT is not going away in IPv4, though, and it has gained a cousin: NAT64 translates between IPv6-only networks and the IPv4 internet, which is how phones on IPv6-only mobile networks still reach IPv4 sites. If you are on such a network, a lookup shows an IPv4 address that belongs to the carrier's translator, not to your phone; the What is my ISP page identifies whose it is.
Questions
What does NAT mean?
Network Address Translation: a router rewriting the addresses in packets as they pass between a private network and the internet, so that many devices with private addresses can share one public address. The router keeps a table of which internal device and port each outgoing connection came from and uses it to deliver the replies. Almost every home and office router does this.
Is NAT still used?
Yes, on practically every IPv4 network. Home routers, office firewalls, mobile carriers and cloud platforms all translate addresses, and many internet providers add a second layer with carrier-grade NAT because public IPv4 addresses are scarce. IPv6 removes the need for it, and dual-stack networks route IPv6 traffic without translation, but IPv4 traffic will pass through NAT for as long as IPv4 exists.
Should I have NAT on or off?
On, unless you know exactly why you are turning it off. With NAT off, the router stops translating, your devices' private addresses go nowhere, and the network loses internet access unless each device has a public address of its own. The only normal reason to disable it is a router placed behind another router, where bridge or access-point mode is the right setting rather than switching NAT off.
Which NAT type is best for gaming?
Open on Xbox, Type 1 or Type 2 on PlayStation, and A or B on Nintendo Switch. Those let other players connect to you directly, which matters for hosting, party chat and matchmaking speed. Moderate or Type 2 is fine for most play. Strict, Type 3 and Switch types C to F are the ones to fix, since they can only reach players whose own NAT is open.
How do I fix my NAT type?
In order: enable UPnP in the router and restart the console; if that fails, forward the console's ports to the console's fixed private address; if you have two routers, put one in bridge or access-point mode to remove double NAT. If the NAT type test shows carrier-grade NAT, none of those will help and you need a public address from your provider, or IPv6, or a VPN that offers port forwarding.
How do I find my NAT IP address?
There are two. The public one, the address NAT presents to the internet on behalf of every device, is on the CheckMyIP homepage. The private one, which the router assigned to the device you are using, is in your device's network settings or on the local IP page. A game or console asking for your "NAT IP" usually wants the public one, and a port-forwarding rule wants the private one.