Check Your NAT Type for Gaming and Video Calls

Check Your NAT Type for Gaming and Video Calls

Your NAT type controls whether direct connections succeed. When two peers try to connect via WebRTC, the ICE protocol tests whether each peer's router will allow the incoming connection, and the strictness of that test depends entirely on the NAT classification your router applies. Open NAT allows any incoming packet; restricted NAT allows only packets from known hosts; symmetric NAT assigns a new external port for every distinct destination, blocking most direct P2P connections without a relay server.¹

The STUN probe on this page discovers your NAT type automatically. Sending a binding request to a public STUN server, it reads back your public IP address and the external port the router assigned to that outbound connection, then compares multiple requests to determine whether the router uses the same port for different destinations, which is the defining characteristic of symmetric NAT.²

The four NAT types and what they mean for P2P

Full Cone NAT (Open) maps one internal IP:port to a single external port and accepts any incoming packet on that port regardless of the original source address or port. Restricted Cone NAT tightens that rule by accepting incoming packets only from IP addresses the internal host contacted first. Port Restricted Cone adds the source port check on top of the IP check, so both the address and port must match a prior outbound contact. Symmetric NAT, the strictest classification, assigns a different external port for every unique destination the host reaches.¹ Because the STUN server and the remote peer are always different destinations, a symmetric NAT prevents the peer from learning the correct external port, which is why direct P2P connections fail without a relay.

Why symmetric NAT forces traffic through TURN relay infrastructure

Consequently, symmetric NAT prevents direct WebRTC connections in the majority of cases because the peer never receives a stable external port it can advertise to the other side of the session.³ ICE therefore falls back to a TURN relay server, which acts as a public intermediary that both peers can reach regardless of their respective NAT strictness. Relaying adds latency and bandwidth cost, since every media packet travels through the relay rather than taking a direct path between the two endpoints. CapyToolkit's NAT test reveals the same classification your console reports, giving you a cross-platform reference before troubleshooting game connectivity.

Why gaming consoles use NAT type labels

Gaming networks use simplified NAT labels because their underlying technology (PSN, Xbox Live, Nintendo Switch Online) relies on direct peer-to-peer connections for multiplayer traffic. PlayStation uses NAT Type 1 (direct), Type 2 (router, open cone), and Type 3 (strict or symmetric). Xbox uses Open, Moderate, and Strict. All three platforms map their labels to the same underlying cone/symmetric distinction, even though the numbering and terminology differ between manufacturers. Building on this understanding, a router showing "NAT Type 3" on PlayStation will also show "relay" ICE candidates in this WebRTC tester, confirming the symmetric classification. The value of running the STUN probe in this tool is that it reveals the actual NAT behavior your console experiences, independent of how each manufacturer chooses to label it.

How NAT type affects matchmaking and peer connectivity in online games

Matchmaking systems in online games attempt to connect players with compatible NAT types to ensure successful peer-to-peer connections. Open NAT players can connect directly to any other NAT type. Moderate NAT players connect to Open and Moderate peers but may fail to connect with Strict NAT players. Strict NAT players can typically only connect with Open NAT peers, which limits the pool of potential opponents and can increase matchmaking times. Understanding your NAT type helps explain why you may experience failed game sessions or long wait times when playing with specific friends. CapyToolkit's NAT test reveals the same classification your console reports, giving you a cross-platform reference before troubleshooting game connectivity.

How to improve a strict or symmetric NAT

Enabling UPnP on your router lets devices negotiate port mappings automatically, often moving a strict NAT to restricted or open.⁴ Many gaming routers include UPnP enabled by default; check your router admin panel under WAN or NAT settings to confirm. Port forwarding specific game ports achieves the same result for known applications. For symmetric NAT behind carrier-grade NAT from your ISP, the only reliable fix is requesting a dedicated public IP from your ISP, as no router-side change can override the upstream NAT.⁵ Conversely, running a TURN relay server provides a fallback path for applications that support it.

Verifying NAT improvement after router configuration changes

Your router's admin panel report of "Open NAT" does not guarantee that direct WebRTC connections will succeed. The admin panel reflects the router's internal configuration, but the actual externally visible NAT behavior depends on how the router assigns external ports to outbound connections. Running the STUN probe in this tool before and after a configuration change is the only reliable confirmation that the change produced the expected result.

The STUN probe reveals cone NAT by sending binding requests to two different STUN server addresses and confirming that both responses contain the same external port.⁶ Matching ports across both requests confirm cone NAT; ICE hole-punching will succeed for most peer configurations. Different ports confirm symmetric NAT remains active regardless of what the admin panel reports.

What to do when the admin panel and probe results disagree

A mismatch between the router's reported NAT type and the STUN probe result typically indicates carrier-grade NAT upstream from the router. Your router is configured for Open NAT, but the ISP's CGNAT layer above it imposes symmetric port assignment on outbound connections. Contact your ISP and ask whether you are behind CGNAT; request a dedicated public IPv4 address or confirm IPv6 availability as the alternative path forward.

Carrier-grade NAT identification and resolution paths

Addresses in the 100.64.0.0/10 range (the IANA Shared Address Space defined in RFC 6598) reveal CGNAT directly.⁵ When the STUN probe returns an address starting with 100.64 or 100.65, your ISP is assigning you a shared internal address rather than a unique public IP. No router-side change, UPnP rule, or port forwarding configuration can fix symmetric NAT imposed by the ISP's upstream CGNAT infrastructure.

Two reliable resolution paths exist for CGNAT. Requesting a static public IPv4 address from your ISP removes the CGNAT layer entirely; many ISPs offer this as an optional paid upgrade. Enabling IPv6 bypasses IPv4 CGNAT because IPv6 allocates globally routable addresses directly to each device, with no NAT layer at the ISP.³ With IPv6 active, WebRTC ICE generates host candidates from the device's global IPv6 address, and direct connections succeed without STUN or TURN involvement.

Testing for CGNAT before contacting your ISP

Confirm CGNAT independently before calling support by comparing your router's WAN IP against the STUN-discovered address, which reveals your externally visible public IP without waiting on a support ticket. Open your router's admin panel and note the WAN IP your ISP assigned. If the two addresses differ, your router's WAN address is a CGNAT-internal address and the probe shows the real public IP shared with other customers. Matching addresses confirm a direct public IP with no upstream CGNAT.

Documenting the mismatch with a screenshot of both IP addresses gives your support ticket a concrete starting point instead of a vague latency complaint. Many ISPs will only escalate a CGNAT request after you show that the router WAN address and the STUN-discovered address genuinely differ. Running this comparison once before calling avoids the back-and-forth of first-line support asking you to reboot the router, which never resolves an upstream NAT layer.

When to use this

Run this test before troubleshooting multiplayer game connection errors, when WebRTC video calls refuse to connect, or when you need to confirm that a router configuration change moved your NAT type from strict to open.

Examples