What Is NAT? Network Address Translation Explained
NAT lets every device at home share one public IP address. Here is how it works, what NAT types mean in games and how to fix strict NAT.
NAT (Network Address Translation) is how your router lets every device in your home share one public IP address. It rewrites addresses on the way out and keeps track of which reply belongs to which device.
NAT lets every device in your home share one public IP address. Your router rewrites each device’s private address on the way out and matches the reply to the right device, which is why your phone can have a private address like 192.168.1.25 and still browse the internet.
NAT is why your phone can have the private address 192.168.1.25 and still browse the internet. It is also the reason games talk about Open or Strict NAT.
How NAT works
- Your laptop at 192.168.1.25 sends a request to a website.
- The router replaces the source with its public IP and a port number, and remembers the mapping.
- The website replies to the public IP and port.
- The router looks up the mapping and forwards the reply to 192.168.1.25.
The laptop-request step is the one I walk through first when NAT feels abstract.
NAT types in gaming
| Console label | Meaning | Effect |
|---|---|---|
| Open / Type 1 / NAT A | Direct or fully forwarded | Host and join anyone |
| Moderate / Type 2 / NAT B | Behind a router with UPnP or partial forwarding | Most matches work |
| Strict / Type 3 / NAT C | Incoming connections blocked | Trouble joining parties and hosting |
Fix strict NAT by turning on UPnP, forwarding the game ports, or removing double NAT. The Strict row is the one I point at first when a game will not host.
NAT and port forwarding
Because NAT blocks unsolicited incoming traffic, servers at home need a rule that says “send traffic on this port to this device”. That is port forwarding. For me, the port-forwarding rule is the part that makes NAT click.
Double NAT and CGNAT
- Double NAT: two routers at home both doing NAT. Fix it with bridge or AP mode.
- CGNAT: your ISP does NAT for many customers. Your router WAN IP looks like 100.64.x.x. Ask the ISP for a public IP if you need incoming connections.
The 100.64 clue is the one I check first when CGNAT is suspected.
NAT, explained with one example
Your phone (192.168.1.20) opens a website. The request reaches the router, which swaps the private address for your public IP, notes which device asked, and sends it out. When the website replies to your public IP, the router checks its notes and passes the reply back to your phone.
That table of notes is the NAT table. It’s why many devices can share one public IP, and why outside devices can’t start a connection to your phone: there’s no note telling the router where to send it.
The notes-table picture is the one I use first when NAT needs explaining.
NAT types on Xbox, PlayStation and Switch
Consoles describe NAT in their own words, which adds to the confusion:
- Xbox: Open, Moderate or Strict. Open is what you want for parties and hosting.
- PlayStation: Type 1 (direct connection, rare at home), Type 2 (behind a router with UPnP or forwarding, ideal), Type 3 (strict).
- Nintendo Switch: letters A to F. A and B are good, C is okay, D and F cause problems joining others.
If you see Strict, Type 3 or D/F, the usual fixes are turning on UPnP, setting up port forwarding for the console, and removing double NAT. The Type 3 fix is the one I start with when a console shows Strict.
Carrier-grade NAT and why your ISP uses it
IPv4 addresses ran out years ago, so some providers, especially mobile, 5G home and satellite services, put many customers behind a single public IP. That’s carrier-grade NAT (CGNAT). Your router’s WAN address will start with 100.64 to 100.127, or another private range.
Day to day you won’t notice it. But port forwarding won’t work from outside, and some games show strict NAT no matter what you do at home. Asking your provider for a public IP (sometimes free, sometimes paid), using IPv6, or using a relay service are the ways around it.
The public-IP ask is the step I mention first when CGNAT blocks a game.
See your router’s NAT and WAN address
- Log in to your router.
- Open the Status, Internet or WAN page.
- Look for the WAN, Internet or public IP address.
- Compare it with the address on our What Is My IP page.
- If they match, you have a direct public IP. If not, there’s another NAT layer above you (double NAT or CGNAT).
The compare-with-my-IP step is the check I run first on any WAN mystery.
