Netgear Nighthawk RS700S P2P Network Test

Netgear Nighthawk RS700S P2P Test: WebRTC NAT and ICE Check

Netgear positions the Nighthawk RS700S as a Wi-Fi 7 (802.11be) triband router rated BE19000, equipped with a single 10G WAN port, a matching 10G LAN port, and four 1G LAN ports. What sets this router apart from competitors in the same price range is the breadth of its VPN configuration options: OpenVPN client and server are built in, and WireGuard is available for users who prefer a modern low-overhead tunnel protocol, all without requiring Netgear's Armor subscription for basic routing features.

On P2P and WebRTC connections, the RS700S uses restricted cone NAT by default, enabling ICE hole-punching to succeed. The STUN probe on this page will show a consistent external port across requests to different STUN servers, confirming cone NAT behavior.¹ Port forwarding rules configured in the Nighthawk admin panel or through UPnP requests improve P2P connectivity for specific applications and game consoles.

Specifications²

NAT type and UPnP on the Nighthawk RS700S

The RS700S uses a standard restricted cone NAT configuration. UPnP is disabled by default on some firmware versions and must be explicitly enabled in the Advanced > Advanced Setup > UPnP menu. With UPnP enabled, gaming consoles and WebRTC browsers can automatically negotiate port mappings for inbound connections. Without UPnP, configure specific port forwarding rules under Advanced > Advanced Setup > Port Forwarding for applications that require incoming connections. The Nighthawk admin panel exposes per-rule NAT entry configuration, allowing precise control over which internal IP receives traffic on each forwarded port. Running the STUN probe in this tool confirms whether the UPnP mappings are actually effective for external reachability, because the probe tests the same path a remote peer would use when establishing a direct WebRTC connection through your RS700S network.

What to do when the admin panel and probe results disagree

If the Nighthawk admin panel shows UPnP enabled but the STUN probe in this tool returns a symmetric NAT classification or shows different external ports per request, the router's UPnP implementation may be failing to renew mappings before they expire. This mismatch is common on RS700S firmware versions where the UPnP lease timer is set too aggressively. Disabling and re-enabling UPnP in the admin panel forces the router to rebuild its mapping table; if the probe then shows matching external ports, the UPnP renewal timer was the cause. If the mismatch persists, configure explicit port forwarding rules for the ports your WebRTC application uses rather than relying on UPnP's dynamic allocation.

A practical workaround when UPnP renewal is unreliable is to script a periodic UPnP refresh using the router's SOAP API. A simple cron job that calls the UPnP AddPortMapping action every 30 minutes keeps the mappings alive even when the router's internal renewal timer is broken. This approach is documented in the Netgear community forums for the RS700S specifically and avoids the need to manually disable and re-enable UPnP each time you notice the NAT type drift. CapyToolkit's STUN probe can serve as the validation step in such a script: if the probe shows consistent ports, the renewal succeeded; if it shows divergence, the script triggers the SOAP refresh.

WebRTC and P2P configuration on the RS700S

For reliable WebRTC direct connections, verify that UPnP is enabled or that required ports are forwarded. Netgear's Dynamic QoS feature can be enabled to prioritize real-time UDP traffic; set it to Gaming or Streaming mode to prevent bulk transfers from saturating the upload queue and delaying STUN responses. Furthermore, if you are testing through an OpenVPN tunnel configured on the RS700S, the VPN interface adds a second NAT layer between the LAN and the tunnel exit; disable VPN tunneling for the test device to measure the actual ISP-facing NAT behavior.³ CapyToolkit's P2P tester runs over the same network path your WebRTC applications use, so the ICE candidate type and RTT you see here reflect the actual connectivity your video calls and gaming sessions will experience on the RS700S after you apply these configuration changes.

Testing the RS700S with this tool

Connect one browser to the RS700S network and a second browser to a remote connection. The STUN probe's public IP should match the WAN IP shown on the Nighthawk admin panel's Internet Status page. If the ICE candidate type shows "relay" consistently despite the router using cone NAT, check whether the Netgear Armor security subscription is intercepting HTTPS traffic in a way that disrupts signaling. Disabling Armor temporarily and retesting isolates whether the security layer is interfering with the connection path. Running the STUN probe before and after a firmware update is the most reliable way to confirm the update did not change your router's NAT classification, because even minor firmware revisions can reset advanced NAT settings to their defaults on Netgear routers.

Firmware updates on the RS700S and verifying NAT behavior afterward

Netgear releases firmware updates for the Nighthawk RS700S through the router admin panel under Administration > Router Update. The current firmware version appears on the same page alongside a check for available updates. Netgear firmware changelogs document NAT behavior changes, UPnP fixes, and security patches; reading the release notes before updating confirms whether the update addresses a specific NAT or WebRTC connectivity issue you are troubleshooting. The RS700S firmware download page at support.netgear.com lists all available versions with individual changelogs.

Firmware updates occasionally reset advanced NAT and UPnP settings to factory defaults. After updating, verify that UPnP is still enabled under Advanced > Advanced Setup > UPnP and that any port forwarding rules are still present under Advanced > Advanced Setup > Port Forwarding. Dynamic QoS settings should also be checked to confirm they are still active at the same priority configuration you set before the update.

Confirming NAT type is unchanged after a firmware update

Running the STUN probe in this tool immediately after a firmware update confirms that the update did not change the router's NAT classification. Note whether the probe shows matching or different external ports across requests before the update. After updating, rerun the probe and compare. If the probe showed matching ports before the update but shows different ports afterward, the firmware changed the NAT type from cone to symmetric; contact Netgear support with the specific before and after firmware version numbers to document the regression.

IPv6 on the Nighthawk RS700S for NAT-free P2P connections

Enabling IPv6 on the RS700S provides each connected device with a globally routable IPv6 address, eliminating IPv4 NAT traversal for WebRTC connections between IPv6-capable peers. Access IPv6 settings in the admin panel under Internet > IPv6. For residential ISP connections, DHCPv6 with prefix delegation (DHCPv6-PD) is the most reliable mode; it requests an IPv6 prefix from the ISP and assigns globally routable addresses to LAN devices from that prefix. Confirm with your ISP that IPv6 is available on your plan before enabling it on the router.

With IPv6 active on both sides of a connection, WebRTC ICE generates host candidates directly from the device's global IPv6 address. These candidates are globally reachable without STUN or TURN involvement, because IPv6 addresses require no NAT translation. The ICE candidate type in this tool shows host for an IPv6 pair rather than srflx, indicating true end-to-end connectivity without any NAT traversal layer between the two peers.⁴

Verifying IPv6 address assignment before running the P2P test

Confirming your device holds IPv6 global versus link-local fe80:: addressing comes first: on Windows, running ipconfig and looking for an address starting with 2 confirms a globally routable assignment. On macOS, ifconfig en0 shows the same information. If the device received only a link-local IPv6 address starting with fe80::, the ISP is not providing IPv6 or prefix delegation is misconfigured on the router. Disable IPv6 if it is non-functional, because incomplete IPv6 configuration can delay ICE candidate gathering by several seconds.

A realistic same-LAN baseline for the RS700S

The model badge on the underside of this router actually reads RS700; "S" only marks the SKU that bundles a one-year Netgear Armor trial, and the hardware underneath is identical.⁵ That matters here because it lets you draw on the RS700's own published latency numbers as a same-LAN baseline. Independent testing measured client ping under 10 ms at close range, whether the network sat idle or carried competing traffic; moving further from the router pushed that figure to 12 to 16 ms.⁶ Use those figures as your reference range for this tool's same-LAN test. A reading that lands well outside them usually points to distance, wireless interference, or a saturated queue rather than a fault in the RS700S itself.