PlayInfoBox

Home /Network /NAT Types Explained: Full Cone, Restricted, Symmetric

NAT Types Explained: Full Cone, Restricted, Symmetric

Being "behind NAT" means very different things depending on which type it is — and that difference can make or break a peer-to-peer connection.

Where the Full Cone / Symmetric Classification Comes From

This classic NAT classification comes from RFC 3489, the 2003 document that defined the STUN protocol, and was originally used to explain whether a peer-to-peer connection could get through. Full Cone, Restricted Cone, Port Restricted Cone, and Symmetric are the four categories it introduced. Once it became clear that real-world router and firewall behavior often did not fit neatly into just four buckets, RFC 4787 replaced this scheme in 2007 with more precise "mapping behavior" and "filtering behavior" criteria. Even so, the original four-category classification is still widely used today as an intuitive way to describe how open a NAT is.

Full Cone NAT

Once an internal device sends traffic out from a specific port, any external host can then send traffic back to that same public port and have it forwarded to the device — the most permissive of the four types, since the mapping is not restricted to the original destination. This makes peer-to-peer connections the easiest to establish, but it also leaves more room for an external party to reach a predictable open port, making it comparatively less secure.

Restricted Cone NAT

One step more restrictive than full cone: incoming packets are only allowed through if they come from an IP address the internal device has previously sent traffic to — but the port number is not checked. So a response from a different port on that same IP address will still get through.

Port Restricted Cone NAT

Even more restrictive: incoming packets are only allowed through if both the IP address and the port number match a destination the internal device previously sent traffic to. This is common in home routers, and it is typically what gaming consoles label as "Moderate" NAT type.

Symmetric NAT

Every time the internal device connects to a different destination, it gets assigned a different public port — making the port nearly impossible for an outside party to predict. Because a mapping learned from one peer cannot be reused for a connection to a different peer, STUN-based hole punching tends to fail. This offers the strongest security but the lowest success rate for peer-to-peer connections, and is typically what gaming consoles label as "Strict."

Why NAT Type Matters for P2P and Video Calls

WebRTC video calls, VoIP calls, and peer-to-peer game matchmaking generally use a STUN server to discover each side's public IP and port, then attempt a direct connection (hole punching). This works well when both sides are behind some form of cone NAT, but if even one side is behind symmetric NAT, the port the other side discovered will not actually be reusable, and the direct connection fails. In that case, the app falls back to relaying traffic through a TURN server, which adds latency and consumes the relay server's bandwidth.

Improving Your NAT Type

A "double NAT" situation — where your router sits behind another NAT, such as your ISP's modem — tends to produce a more restrictive NAT type. Switching the ISP-side equipment to bridge mode to collapse this down to a single NAT layer, then forwarding the necessary ports directly on your router (or enabling UPnP), can often shift the NAT type that consoles and calling apps detect toward something more open.

Mapping and filtering: the two questions behind every type

Each classic type is really the answer to two questions. Mapping asks whether the router reuses the same public port when your device talks to different destinations. Filtering asks which outside senders may reach that public port. Full cone, restricted cone, and port-restricted cone all reuse one mapping and differ only in filtering (anyone, same IP, or same IP and port). Symmetric NAT changes the mapping per destination. RFC 4787 describes these two behaviors separately, which is why modern documentation talks about "endpoint-independent mapping" instead of cone names.

Hole punching in four steps

Two peers first contact a STUN server to learn their public address and port. They swap that information through a signaling server. Each then sends a packet toward the other's public address, which creates an outbound mapping and, on most cone types, opens the filter for the reply. If both packets cross in time, the path opens in both directions and the call or match connects directly. Symmetric NAT breaks step one because the port seen by the STUN server is not the one used toward the peer.

ICE: trying everything in order

Real applications do not rely on one trick. The ICE framework gathers several candidate paths (local addresses, STUN-discovered addresses, and relay addresses on a TURN server), tests them in pairs, and uses the best one that works. This is why a video call usually connects even behind strict NAT, just sometimes through a relay with more delay. WebRTC, which powers most browser calls, uses ICE.

How console labels map to the classic types

Consoles simplify the picture. Xbox reports Open, Moderate, or Strict. PlayStation reports NAT Type 1 (directly connected), Type 2 (works with most), or Type 3 (the most restricted). These labels roughly track how reachable your console is for incoming connections, but they do not map one-to-one to the four classic names, and different games interpret them differently.

Carrier-grade NAT can make things worse

Many mobile networks and some home internet providers put customers behind carrier-grade NAT (CGNAT), meaning several households share one public address. You cannot forward ports on equipment you do not control, and the carrier's NAT is often symmetric or otherwise strict. If your NAT type is bad no matter what you change on your own router, ask the provider about a public address option or an IPv6 connection.

Curious how game consoles label NAT type?

The Open, Moderate, and Strict labels shown on consoles like the PS5 or Xbox are a simplified, user-friendly translation of the technical classification covered here — useful shorthand, but built on the same underlying concepts.

How this connects to VoIP calls

If you want to know more about how NAT type affects call connectivity, it is worth learning how VoIP's SIP and RTP protocols actually establish a connection.

What you can and cannot fix at home

Start by checking whether your router has a public address on its WAN side. If the address shown in the router settings differs from what an IP-lookup site shows, there is another NAT layer upstream, and nothing on your own router will change that. If it does match, enable UPnP or set a static port forward to the console or PC, give that device a fixed local address so the forward keeps working, and avoid putting it in a DMZ unless you understand the exposure. Keep the router firmware updated, since UPnP and port forwarding both widen what the outside can reach. Port forwarding for a game is a trade-off between convenience and risk, so open only the ports the game documents.

Why "strict" is not always a problem

NAT type matters for peer-to-peer features: voice chat, party systems, and games without dedicated servers. For browsing, streaming, downloads, and most games that connect to a company's servers, a strict NAT makes no practical difference. When players report lag only in peer-hosted matches, NAT type is a plausible cause; when every service is slow, look at bandwidth, Wi-Fi quality, and routing instead. The classic names also overstate precision, because many routers behave differently for UDP and TCP or change behavior under load.

Frequently Asked Questions

Is the full cone / symmetric classification still used today?

This four-category classification comes from the 2003 RFC 3489 document, later superseded in 2007 by RFC 4787's more precise "mapping and filtering behavior" criteria. Even so, the classic classification is still widely used in practice as an intuitive way to explain how open a NAT is.

How can I check my network's NAT type?

It is difficult for an average user to determine the exact type directly, but you can check the NAT status a gaming console or video-calling app reports on its own (Open, Moderate, Strict, etc.), or use an online STUN test tool to get a rough sense of how open your connection is.

Does a VPN change my NAT type?

It can. Traffic then exits from the VPN provider's NAT, so the type you see is the provider's, which may be better or worse than your home router. Some providers offer port forwarding for exactly this reason, others block it.

Will IPv6 fix NAT type problems?

Often it helps, because IPv6 devices can have globally reachable addresses without NAT. Home routers still run a stateful firewall by default, so you may need to allow the specific incoming traffic, but there is no port translation to defeat hole punching.

Is symmetric NAT more secure?

It is harder to reach from outside, which is a side effect and not a security feature. Real protection comes from a firewall, patched software, and sensible exposure of services, not from how a NAT assigns ports.