Netgear Orbi 970 P2P Network Test

Netgear Orbi 970 P2P Test: WebRTC NAT and Orbi Insight Check

Netgear's Orbi 970 occupies the premium tier of the consumer mesh market as a Wi-Fi 7 (802.11be) system. Each node ships with a 10G WAN port and 2.5G LAN ports, supporting multi-gigabit ISP connections.¹ NETGEAR Armor and Smart Parental Controls features are subscription-gated, but the NAT Filtering toggle and standard port forwarding are available in the admin interface at orbilogin.com without an Insight subscription.

For P2P and WebRTC, the Orbi 970 uses cone NAT by default with UPnP available.² Basic port forwarding is accessible without a subscription through the Orbi web interface at orbilogin.com. The STUN probe on this page reveals the actual NAT type without requiring any subscription; the probe result reflects the router's current operating configuration.

Specifications¹

NAT type and UPnP on the Orbi 970

The Orbi 970 supports UPnP and basic port forwarding without an Orbi Insight subscription. Access these settings at orbilogin.com under Advanced > Advanced Setup > UPnP and Port Forwarding. The UPnP table shows active mappings from LAN devices. For gaming consoles and WebRTC browsers, UPnP provides automatic port negotiation.² The Orbi 970 ships with NAT filtering set to Secured by default, which provides address-dependent filtering similar to port-restricted cone NAT.³ The NAT Filtering toggle (Open vs. Secured) is available under Advanced > Setup > WAN Setup without an Insight subscription. Setting it to Open provides endpoint-independent filtering that approximates Full Cone NAT behavior for applications that need it.

How the Orbi 970 mesh topology affects NAT behavior

In an Orbi 970 mesh system, the primary gateway node connected to the ISP modem manages the WAN-facing NAT table, and all satellite nodes bridge their LAN traffic through the primary for WAN processing. From the perspective of any external peer, devices connected to satellite nodes appear behind the same public IP and the same NAT table as devices on the primary node. The Orbi 970 uses a dedicated wireless backhaul band separate from client-facing radios, which keeps inter-node latency low and prevents the mesh hop from adding meaningful jitter to P2P traffic. For the cleanest NAT and P2P measurements on this tool, connect the test device to the primary gateway node via a 2.5G LAN port; this eliminates both wireless jitter and backhaul overhead from the reading, producing the most accurate baseline for your ISP path.

A practical test to quantify the mesh overhead is to run the P2P tester from a device on the primary node, then move the same device to a satellite node and run it again. If the STUN probe returns identical external ports and the ICE candidate type is srflx in both cases, the mesh topology is not affecting the NAT behavior. Any difference in RTT between the two runs is the pure backhaul contribution. On the Orbi 970's dedicated 5 GHz or 6 GHz backhaul band, this overhead is typically under 1 ms for wired backhaul and 2 to 5 ms for wireless backhaul with good signal, making it negligible for most WebRTC applications.

WebRTC and P2P configuration on the Orbi 970

For WebRTC connections without an Orbi Insight subscription, enabling UPnP and configuring specific port forwarding rules covers most use cases. The Orbi 970's Traffic Meter under Advanced > Advanced Setup > Traffic Meter monitors total bandwidth consumption across all connected devices. While the meter does not break down traffic per application in real time, it helps identify when overall bandwidth saturation is affecting WebRTC jitter. Without Insight, standard port forwarding to a static IP provides the most reliable path for applications with known fixed ports. CapyToolkit's P2P tester runs over the same network path your WebRTC applications use, so the ICE candidate type and RTT you see here reflect the actual connectivity your video calls and gaming sessions will experience on the Orbi 970 without an Insight subscription.

Testing the Orbi 970 with this tool

Connect one browser to the Orbi network and a second to a remote connection. The STUN probe public IP should match the WAN IP shown on the Orbi web interface at orbilogin.com under Router Status. If Orbi Insight is active with content filtering, verify that the filter profile does not block UDP traffic to STUN port 3478 (the IANA-assigned default for STUN per RFC 8489) or port 19302 (used by Google's public STUN servers);⁴ filtering profiles that block "unknown" UDP can inadvertently prevent STUN from functioning. Disabling content filtering temporarily and retesting isolates whether Insight filtering blocks STUN from reaching the ICE candidate generation step.

Orbi 970 firmware management and subscription impact on updates

Netgear distributes firmware updates for the Orbi 970 through the orbilogin.com admin panel under Administration > Firmware Update. The admin panel checks for available firmware when the page loads and also supports triggering a manual check. Updating firmware is available without an Orbi Insight subscription; firmware releases are the same for all Orbi 970 owners regardless of subscription status. Insight subscribers gain cloud management features such as remote firmware scheduling and push notifications through the Insight Cloud Portal, but the firmware binaries themselves are not paywalled or released early to subscribers.

For P2P and WebRTC purposes, keeping firmware current at any subscription level is sufficient, because NAT behavior and UPnP reliability are addressed in general firmware releases rather than subscription-gated updates. Running the STUN probe in this tool after a firmware update confirms that the update did not change your router's NAT classification or disrupt the UPnP mappings your WebRTC applications depend on for direct connectivity.

Verifying NAT settings are intact after a firmware update

Firmware updates on Orbi systems occasionally reset advanced settings to factory defaults, particularly when the update includes significant routing engine changes. After any firmware update, verify UPnP is still enabled under Advanced > Advanced Setup > UPnP and that port forwarding rules under Advanced > Advanced Setup > Port Forwarding are intact. Running the STUN probe in this tool after the update confirms the NAT type is unchanged; consistent external ports before and after the update confirm the cone NAT configuration survived the firmware change.

IPv6 on the Netgear Orbi 970 for NAT-free P2P connectivity

IPv6 configuration on the Orbi 970 is available at orbilogin.com under Internet > IPv6.⁵ For ISPs providing IPv6 via DHCPv6 prefix delegation, select DHCPv6 and enable DHCP-PD to allow the Orbi to request an IPv6 prefix and distribute globally routable addresses to LAN devices. After enabling, the Orbi Status page under Router Status should show an active IPv6 WAN address and a delegated IPv6 LAN prefix alongside the standard IPv4 status information.

With IPv6 active, WebRTC ICE generates host candidates directly from the device's global IPv6 address. These candidates enable direct P2P connections between IPv6-capable peers without requiring IPv4 NAT traversal or TURN relay.⁶ The Orbi 970's Traffic Meter shows overall bandwidth usage but does not provide IPv6-specific breakdowns; for per-protocol analytics, a dedicated network monitoring tool at the gateway is required.

IPv6 behavior across Orbi 970 mesh satellite nodes

IPv6 prefix delegation applies to the entire Orbi mesh system. All satellite nodes bridge LAN traffic through the primary gateway node, which holds the IPv6 prefix and manages address assignment. Devices connected to satellite nodes receive global IPv6 addresses from the same delegated prefix as devices on the gateway node. No additional IPv6 configuration is required per satellite node; the IPv6 connectivity behavior for WebRTC and gaming is identical regardless of which Orbi mesh node the test device connects to.

A realistic same-LAN baseline for the Orbi 970

Close-range testing on the 6 GHz band measured an average latency of 2.8 ms, jitter of 0.4 ms, and packet loss of 0.02 percent, with a 99th-percentile worst case of 5.2 ms.⁷ Those figures give you a concrete same-LAN baseline for this tool rather than a vague "should be low" expectation. A reading that stays within that range on your own same-LAN test confirms the Orbi 970 itself is not the bottleneck; a reading that climbs well past it, especially on packet loss, points to wireless interference or a competing bulk transfer rather than a problem with the router's forwarding path.