The problem NAT solves
Every device on the internet needs an address so that data knows where to go. There are not enough of the older style of public addresses for every phone, console and computer, so a typical home gets just one public address from its internet provider. Inside the home, your router hands out private addresses to each device.
Network address translation, or NAT, is the router’s way of connecting the two. When your console sends a message out, the router swaps in the home’s public address and remembers which device it came from. When a reply arrives, the router looks up that memory and passes the reply to the right device. This lets many devices share one public address, and it also acts as a rough barrier, since a router does not normally pass unrequested incoming traffic to anything inside.
Why that matters for games
Connecting to a server run by a company is usually easy. Your device starts the conversation, so the router expects the replies and lets them through.
Trouble starts when your device must be reached by another player’s device without having started the conversation. The other player’s router faces the same issue. Neither side opened the door, so each router may reject the other’s first message. This is a common difficulty when games use peer-to-peer connections or have one player act as host, and it is one of the reasons many studios prefer to run servers themselves.
To get around it, games and platforms often use helper techniques. A third machine can introduce both players and help each router create the memory it needs, a method often called hole punching. Whether it works depends on how each router behaves.
What the labels generally mean
Consoles and games often show a connection type, sometimes as a number and sometimes as a word. The names differ by platform, so check what your own system says, but the grouping is similar.
- Open. Your router lets in the traffic your game needs, or your device is reachable directly. You can usually connect to nearly anyone.
- Moderate. Your router allows some incoming connections but not all. You can usually join most players, but certain pairings fail, particularly with players who also have restricted setups.
- Strict. Your router blocks most unrequested incoming traffic. You may only be able to connect to players with open settings, and you may find it hard to host or join some lobbies.
The more detailed technical names, which are sometimes described in terms such as full cone, restricted cone and symmetric, describe how a router chooses to remember and filter traffic. The practical point is how well two particular routers get along. A strict setup paired with another strict setup is generally the hardest combination.
Why you might end up with a restrictive type
Several ordinary situations can cause it.
- Double NAT. If you have two routers in a row, such as a modem-router from your provider with your own router plugged into it, each does its own translation. Traffic has to get through both.
- Carrier-grade NAT. Some providers share a single public address among many customers. In that case there is another layer of translation beyond your control. Whether this applies to you is something your provider can tell you.
- Router settings. A strict firewall, disabled helper features, or a security mode can block more than needed.
- Mobile and some wireless connections. These often involve extra translation layers.
Common ways people try to improve it
These are general approaches, not guarantees, and the exact steps depend on your equipment.
- Use a wired connection. This is mainly for stability, but it also makes the setup easier to reason about.
- Enable automatic port mapping. Many routers have a feature, often named UPnP, that lets devices ask for what they need. It is convenient but also a security trade-off, so some people choose to leave it off.
- Forward ports manually. You tell the router which incoming traffic should go to your console or PC. The ports a game needs are normally listed in its support pages.
- Remove a second router. Putting the provider’s equipment into a bridge mode, or connecting directly to it, can end double NAT.
- Ask your provider. If the problem comes from shared addressing, they may offer an option.
Change router settings carefully. Opening ports exposes a device to more incoming traffic, and a mistake can reduce your security. Keep a note of what you change so you can undo it.
What NAT type does not tell you
A restrictive type limits who you can connect to, but it does not describe how good the connection is once made. It says little about delay, which is covered in ping time, or about dropped data, covered in packet loss. A player with a strict type can have an excellent connection to a game server and still be unable to join certain player-hosted lobbies.
Newer internet addressing, called IPv6, was designed with enough addresses for every device, which can reduce the need for NAT in some setups. Support differs among providers, routers and games, so it does not remove these problems for everyone.
For most players on modern dedicated-server games, none of this ever causes trouble. It tends to matter most for older games, party chat, and any game that uses direct connections between players.