What your NAT type means
Your router, or your mobile carrier, shares one public IP address between many devices. For each connection it picks a public port, and that pairing is the mapping. What matters for games, calls and peer-to-peer apps is whether the mapping stays the same when your device talks to someone new.
- Port stays the same (endpoint-independent mapping, the old "cone NAT"): every server sees the same public address and port, so another player can reach you on the address a game server saw. The IETF's best-practice rules for NATs make this a "MUST", because a NAT that fails it "will force the use of a UDP relay" (RFC 4787).
- Port changes (address-dependent mapping, the old "symmetric NAT"): each server sees a different port, or a different address. You can still play and call, but apps often have to relay traffic through a server, which can add delay.
- No UDP: neither server answered. The network may block UDP, or the browser may have WebRTC turned off.
The same RFC calls the old cone and symmetric names "the source of much confusion", so the result above uses both: the plain description first, the familiar name after it.
Open, Moderate and Strict on Xbox, Type 1 to 3 on PlayStation
Consoles use their own labels and run their own test. Microsoft defines Xbox's three this way: Open "can connect with any consoles regardless of their NAT settings", Moderate "can connect only with consoles that use Moderate or Open settings", and Strict "can connect only with consoles that use Open NAT settings" (Microsoft Learn). PlayStation shows Type 1, 2 or 3.
A console's test can also tell whether your router opens ports for it, which a browser can't see. So if your console and this page disagree, trust the console for that console, and use this page to tell whether the network itself is the problem.
How to fix a strict NAT
- Turn on UPnP in your router's settings. TP-Link explains that with it off, a console "cannot automatically negotiate the connections it needs for online play" and the most common result is a Strict NAT; "Re-enabling UPnP typically fixes it immediately" (TP-Link). To open the router's settings from an iPhone, see how to find your router's IP address.
- If you'd rather keep UPnP off, set up port forwarding for the console; TP-Link says it "achieves the same result".
- Restart the router and test again. On cellular data the NAT belongs to your carrier, so there's no router setting to change.
Will a VPN work on this network?
A VPN connects outward from your device, so it works through either kind of NAT. What can stop it is a network that blocks the traffic it uses. WireGuard runs over UDP only, and IKEv2 uses UDP ports 500 and 4500. OpenVPN can also run over TCP. If this test shows that UDP doesn't get out, WireGuard and IKEv2 probably won't connect either; try an OpenVPN option that uses TCP, if your VPN app has one.
UDP getting through to this test (port 3478) is a good sign, but a network can still block the ports a VPN uses. If your VPN won't connect,why your VPN is not connectingwalks through the checks. On a school or work network, follow its rules: some block VPNs on purpose.
Does a VPN change your NAT type?
While it's on, yes. With a VPN connected, this page sees the VPN server's network, so the result describes the VPN's NAT. Run the test with the VPN off to see your own router or carrier, then with it on to see what games and apps see through the VPN. The VPN test checks that your VPN changes your IP and doesn't leak it.
What a browser can and can't test
A page can see the public address and port each server reports for your browser, so it can tell whether the mapping changes. It can't test filtering, that is, which outside addresses your NAT lets back in: that needs a server that answers from a second address on request (RFC 5780), and browsers can't ask for that. It also can't see whether your router has opened ports with UPnP, or test the exact ports a game or VPN uses.
What happens when you run the test
Your browser asks two Cloudflare STUN servers (stun.cloudflare.com and turn.cloudflare.com, both on UDP port 3478) which public address it reaches them from, the same request it makes to set up a video call. The page also asks GeoJS, ipinfo.io and ipwho.is for your IP address and network, and ipify for your IPv4 and IPv6 addresses. Each sees your IP, as any website does. The result stays in this browser tab and isn't sent to us. For more about your address, see what is my IP.
Questions
What is my NAT type?
Run the test on this page. It shows whether your router or carrier keeps the same public port when your device talks to two different servers (endpoint-independent mapping, often called a cone NAT) or gives each server its own port (often called a symmetric NAT), and whether UDP gets out at all.
What is a symmetric NAT?
A NAT that gives your device a different public port, or even a different public address, for each server it talks to. Other people's devices can't reuse the address you got from one server to reach you, so games, calls and peer-to-peer apps often have to relay their traffic through a server instead.
Is a cone or a symmetric NAT better for gaming?
Endpoint-independent mapping (cone) is friendlier: the IETF's best-practice rules for NATs say every NAT must behave this way, because without it apps are forced to relay their traffic. A symmetric NAT still lets you play online, but direct connections to other players are harder.
Why does my Xbox or PlayStation show a different NAT type?
Consoles run their own test, which can also check whether your router opens ports for the console automatically (UPnP) or through port forwarding. A browser can't see that, so use this page as a guide and the console's own test as the final word for that console.
Does a VPN change my NAT type?
Yes, for as long as it's on. With a VPN connected, this test sees the VPN server's network, so the result describes the VPN's NAT, not your router's. Run it with the VPN off to see your own network.
Can I test my NAT type on iPhone?
Yes, in Safari or any other browser. On cellular data the NAT belongs to your carrier, so the result describes their network; on Wi-Fi it describes your router or the Wi-Fi network you're on.
Is it safe to run?
Yes. The page asks two Cloudflare STUN servers for the public address your browser uses for calls, and a few public services for your IP address and network. The result stays in this browser tab and isn't sent to us.