How to Check Your NAT Type on Windows 11 (And Fix Strict NAT)

You can check your NAT type on Windows 11 through the Xbox Console Companion app, a free online NAT checker such as natchecker.com, or your router’s own admin page. NAT, or Network Address Translation, is a router setting rather than a Windows feature, so Windows itself never generates a NAT rating on its own. Microsoft removed the one click NAT fix button, which means fixing a strict NAT type on Windows 11 now happens inside the router, most commonly by turning on UPnP. Three main NAT types exist: Open, Moderate, and Strict, and each one changes how easily your PC connects to other devices online.

How to Check Your NAT Type on Windows 11

Each method offers a different view of connectivity. A browser test reports the underlying network behavior it observes, while console labels summarize connectivity within each console ecosystem.

Check NAT Type with the Xbox Console Companion App

Use its Network tab to see the displayed result. Open the app from the Start menu and follow these steps to see the displayed result.

Search for Xbox Console Companion in the Start menu and open it.
Sign in with your Microsoft account.
Select the Settings icon in the bottom right corner.
Choose the Network tab.
Wait while the app connects and displays its NAT type.

Check NAT Type with an Online NAT Checker Tool

An online NAT checker such as natchecker.com measures observable network behavior in a browser without downloads, accounts, or device permissions. The test reports IPv4 NAT type, public IP address, NAT status, IPv6 availability, and external WebRTC/UDP connectivity, with a stated 20-second overall timeout.

Open a web browser on the Windows 11 PC you want to test.
Go to natchecker.com.
Let the page run its automatic check.
Read the reported NAT type, public IP address, NAT status, IPv6 availability, and WebRTC/UDP connectivity result once the scan finishes.

Check NAT Type Through Router Settings

Router settings can include a NAT type field, but a browser-based NAT test measures observable network behavior rather than inferring a result from those settings. Command Prompt gives you the router address you need before you open the router page.

Press Windows key + R, type cmd, and press Enter.
Type ipconfig and press Enter.
Note the Default Gateway address next to your active network adapter.
Enter that address into your browser to open the router’s admin page.
Look under Internet Settings or Firewall Settings for the NAT type field. Exact wording and menu location vary by router manufacturer.

Retest After Network Changes

Run the browser test again after every major networking change, including enabling UPnP, adding port-forwarding rules, rebooting the router, changing network topology, or trying a VPN. The result reflects the observed connection behavior at the time of the test.

What Open, Moderate, and Strict NAT Actually Mean

Open, Moderate, and Strict are console ecosystem labels rather than universal descriptions of every network behavior. NAT Checker instead categorizes observed behavior as Full Cone, Restricted Cone, Port-Restricted Cone, Symmetric, or Blocked NAT.

Full Cone NAT is the best result for direct peer connections and hosting games or services; Restricted Cone NAT is usually usable but can limit inbound peer connections; Port-Restricted Cone NAT is more restrictive because both the remote address and port matter; and Symmetric NAT is the most restrictive result and is a common cause of failed peer-to-peer connections.

NAT Type	Connectivity	Security	Best For	Issues
Open / Full Cone	Unrestricted	Low, no firewall	Gaming, peer to peer apps	Security vulnerabilities
Moderate / Restricted Cone	Most connections work	Medium	General use, gaming	Some inbound connections blocked
Strict / Symmetric	Restricted	High, maximum firewall	Security first networks	Lag, poor gaming, limited connectivity
Blocked / Failed	No external connectivity	Not applicable	None	Complete connectivity failure

NAT Checker’s comparison maps Full Cone NAT to PS5 Type 1, Xbox Open, and Switch Type A. Restricted Cone and Port-Restricted Cone NAT map to PS5 Type 2 and Xbox Moderate. Symmetric NAT maps to PS5 Type 3, Xbox Strict, and Switch Type C-D, while Blocked NAT maps to PS5 Strict or Unavailable, Xbox Type F, and Switch Type F. Console labels summarize platform connectivity, while the five observed categories describe underlying network behavior.

How to Fix Strict NAT on Windows 11

Fixing Strict NAT on Windows 11 usually means changing router, ISP, or upstream-network conditions rather than a Windows setting, because NAT is performed by the router. Start with UPnP, then consider game-specific port forwarding, Double NAT, or CGNAT. Retest after every major networking change.

Enable UPnP on Your Router

UPnP can let gaming applications automatically request port forwarding. Sign in to the router’s admin page, enable UPnP, save the setting, and reboot the router or reconnect and restart the game before retesting.

Open your router’s admin panel using the Default Gateway address shown by ipconfig.
Look for UPnP under NAT, Advanced, Internet, Gaming, or LAN settings.
Turn on the UPnP toggle.
Save your changes.
Reboot the router or restart the game, then check your NAT type again.

Try Manual Port Forwarding

Port forwarding opens only the ports required by a game or application. Give the PC a stable LAN IP address first, then use the TCP, UDP, or protocol requirements supplied by the relevant game’s developer documentation.

Open your router’s admin panel and find the Port Forwarding section.
Add a new rule with the internal port and external port your application requires.
Choose the correct protocol, TCP, UDP, or both.
Save the rule and restart the router.

Network Discovery and NAT

Network Discovery lets your PC see and be seen by other devices on the same network. It does not change router NAT mappings or upstream inbound-connectivity behavior, so use router and network troubleshooting for a restrictive NAT result.

Check the router’s UPnP setting.
Use game-specific port forwarding if UPnP does not help.
Check for Double NAT if router changes have no effect.

Use DMZ Mode as a Short Diagnostic Test

DMZ can expose more traffic to a selected PC, making it less secure than targeted port forwarding. Reserve a stable LAN IP address, set that address as the DMZ host, test, and do not leave DMZ enabled unnecessarily.

Find your PC’s local IP address using ipconfig in Command Prompt.
Open the router’s DMZ settings, usually under Advanced or Security.
Enter your PC’s local IP address as the DMZ host.
Save the change and test the connection.

Set a Static IP Address First

A stable LAN IP address is needed before port forwarding or placing a PC in a DMZ. Configure it using the current IPv4 address, subnet mask, and default gateway from ipconfig, making sure the selected address fits your local network and avoids conflicts with other devices.

Find Your Current Network Values

Command Prompt shows the values needed before switching to a static address. Run ipconfig and record the IPv4 address, subnet mask, and default gateway shown for your active adapter.

Enter the Static IP Settings

Enter the recorded network values through the Windows network settings.

Open Settings, then Network and Internet, then your active connection.
Select Hardware Properties or View additional properties, then select Edit next to IP assignment and choose Manual.
Turn on IPv4 and enter the address, subnet mask, and gateway you recorded.
Save the settings and reconnect to confirm the change worked.

Worked Example: Opening NAT on a Home Router

Here is what enabling UPnP looks like on a typical home router, using real menu names and numbers so you can follow along on your own network.

Press Windows key + R, type cmd, press Enter. The Default Gateway reads 192.168.1.1.
Open a browser, go to 192.168.1.1, and sign in with the router’s admin credentials.
Click Advanced, then NAT Forwarding or NAT, then LAN Setup.
Click Apply.
Reboot the router. Once it finishes restarting, check again.
Check the Network tab. A connection that read Strict before the change should now read Open.

What to Do if NAT Type Will Not Change

If UPnP and port forwarding do not fix a strict NAT type, the cause is often outside your router entirely, in carrier grade NAT or a second router on the same connection. Check for both before assuming your settings are wrong.

Check for CGNAT

CGNAT, or carrier grade NAT, happens when your internet provider shares one public IP address across multiple customers, which blocks router level fixes no matter what you change. Contact your internet provider and ask whether your account uses CGNAT and whether a dedicated public IP address is available, sometimes for an added fee.

Check for Double NAT

Double NAT happens when two routers on the same network both perform NAT translation, often a modem and a separate Wi-Fi router working at the same time. Log into the first device, usually the modem or gateway supplied by your provider, and switch it to bridge mode or access point mode so only one router handles NAT duties.

Try a VPN or Tunneling Service

A VPN with port forwarding support, or a tunneling tool such as FRP (Fast Reverse Proxy), can route around a stubborn strict NAT type when router changes fail. This adds a layer of complexity, but it works without exposing your home network the way DMZ mode does.

Why Windows 11 Does Not Have a One Click NAT Fix

Windows 11 dropped the one click NAT fix button that Windows 10 included, and Microsoft’s own support forum confirms there is no direct replacement. NAT type has always been controlled by the router, not by Windows, so the old button most likely toggled network discovery and related settings rather than the router’s actual NAT configuration. Community guidance since the change points toward the Xbox support forums, VPN provider documentation, and router manufacturer manuals for detailed steps.

Is Changing NAT Type to Open Safe

Changing your NAT type to Open increases risk, since it removes firewall protection and leaves more ports exposed to the internet. Security minded users are usually better served by Moderate NAT or a VPN with port forwarding support than by switching straight to Open.

In 2003, in Kettering, I reinstalled Windows on the family desktop at 15 to fix a slow startup and wiped two years of family photos with no backup, a tidy reminder that more access can come with a bill. That is why I would start with Moderate NAT: it permits most connections while retaining some firewall protection, reserving Open for a specific problem that actually demands it.

Frequently Asked Questions

Does Windows 11 Have a Built-in NAT Type Checker?

Windows 11 has no dedicated command or menu that reports your full NAT type on its own. The closest built in tool is the netsh interface teredo show state command, which reports Teredo’s IPv6 tunneling status rather than the Open, Moderate, or Strict rating gaming services use. For an actual NAT type reading, use the Xbox Console Companion app or an online checker such as natchecker.com.

What NAT Type Is Best for Xbox Gaming?

Open NAT gives Xbox the most reliable connections for multiplayer and party chat, since it lets other players connect to you directly. Moderate NAT still works for most games but can block a few peer to peer connections, while Strict NAT causes the most lag and matchmaking trouble.

Can a VPN Fix Strict NAT?

A VPN can work around strict NAT if the service supports port forwarding, since it gives your traffic a new path that is not subject to your router’s original NAT rules. Surfshark and other providers recommend this approach as a safer alternative to opening your home router directly to the internet. Results vary by provider, so check that port forwarding is included before relying on it for gaming.

How Long Does a NAT Type Change Take to Apply?

Most router changes apply as soon as the router finishes rebooting, since NAT settings load fresh at startup. If your NAT type still looks wrong afterward, clear the cached network settings on the console or PC you are testing from, then check again.

Is DMZ Mode Risky to Use?

DMZ mode is riskier than UPnP or port forwarding because it removes the router’s firewall protection from whichever device you place in it. Treat it as a last resort for a single device, and turn it off again once you find a fix that does not require it.

Checking your NAT type only takes a few minutes with the Xbox app or an online checker, and fixing a strict result almost always starts with UPnP on your router. Keep Open NAT for the smoothest matchmaking, but weigh that convenience against the security tradeoff before you turn off your router’s firewall protections for good.

References

NAT Checker – Main Tool, NAT Checker
How to Check and Change NAT Type on a Windows 11 PC, NAT Checker
How to Change NAT Type in Windows 11/10, Kapilarya
How to Change NAT Type on PC: 5 Methods, Surfshark
How to Change NAT Type in Windows 11, Microsoft Q&A
Windows 11 Switching NAT Type to Open From Strict, Microsoft Q&A
How to Check NAT Type on Windows 11, Nerd’s Chalk

Sources read in September 2026.