CGNAT, Double NAT, and Strict NAT Explained: Why Your PS5 or Xbox Says “Strict” and How to Fix It

Sam Watanuki / Updated Jun 15, 2026 | Pub. Jun 15, 2026

Home - Blog - CGNAT, Double NAT, and Strict NAT Explained: Why Your PS5 or Xbox Says “Strict” and How to Fix It

Table of Contents

You open your PS5 or Xbox, run a network test, and see those two words… NAT Type: Strict (PlayStation) or NAT Type: 3 (Xbox). Suddenly, matchmaking takes forever, you can’t voice chat with most players, you can only join friends who also have Strict NAT, and hosting a game session is completely off the table. It’s so frustrating. And the fixes you find online often don’t work because they’re solving the wrong problem.

Because this isn’t a PlayStation or Xbox problem. It’s a networking problem, and it’s becoming more common as internet providers lean on a technique called CGNAT to stretch a dwindling supply of IP addresses. Understanding what’s actually causing your Strict NAT (and which of three different scenarios you’re in) is the only way to fix it for good.

[search_block]

What Is NAT Type, and Why Does It Matter for Gaming?

NAT stands for Network Address Translation, and your router does it constantly. Think of your router as a hotel front desk. All the devices in your home share one public address (the hotel’s street address), and the router keeps track of which room each piece of incoming data should go to. When you connect to an online game, the game server sends data back to your public IP, and your router figures out which device (your PS5, Xbox, or PC) actually asked for it.

Open NAT (Type 1 on PlayStation, Type 1 on Xbox) means the front desk lets anyone in easily. No restrictions or limitations. Moderate NAT (Type 2) means the desk checks a few things first, but most traffic gets through with minor hiccups. Strict NAT (Type 3) means the front desk turns away almost every visitor unless they were personally invited, and for gaming, that translates directly into the matchmaking and voice chat failures you’re already experiencing.

NAT Type	PlayStation Label	Xbox Label	Gaming Impact
Open	Type 1	Type 1	No restrictions — best experience
Moderate	Type 2	Type 2	Minor limitations, generally fine
Strict	Type 3	Type 3	Can’t host, limited matchmaking, voice chat issues

What Is Double NAT, and Why Does It Cause Strict NAT?

Double NAT happens when there are two “front desks" translating your traffic in series. The most common cause is that your ISP’s equipment (a modem/router combo called a gateway) is already doing NAT before your own router even sees the traffic. Add your router’s NAT on top, and you end up with two layers of address translation that gaming consoles can’t negotiate through [1].

This is fairly common. Many ISPs ship combination gateway devices that handle both the modem and router functions. If you plug your own router into that gateway, you’ve created Double NAT without realizing it.

What Is CGNAT? Why T-Mobile and Starlink Users Have It Worst

Carrier-Grade NAT (CGNAT) is Double NAT at the ISP level, before traffic ever reaches your home. Instead of giving you a real public IP address, your ISP puts thousands of customers behind a single public IP at their data center. Your home router gets a “private" WAN IP (typically in the 100.64.x.x range) rather than a true public IP, and you have zero control over what happens at that ISP-level layer.

Why is this happening now? It goes back to 2011, when IANA, which is the organization that manages global IP addresses, exhausted its entire pool of IPv4 addresses [2]. With only 4.3 billion IPv4 addresses ever available, and billions of internet-connected devices coming online every year, ISPs have had to stretch those addresses further and further. CGNAT is their solution, and it’s becoming more common, especially among 5G home internet providers and satellite services where dedicated IPs are expensive to provision at scale.

CGNAT is invisible for basic web browsing and streaming. For gaming, VPNs, and hosting anything from home, it breaks everything, because the ISP’s NAT layer can’t direct unsolicited inbound traffic (like a game server trying to reach you) to the right customer.

Which major internet providers use CGNAT?

Provider	CGNAT?	Notes
T-Mobile 5G Home Internet	Yes	Standard plan customers are behind CGNAT; a dedicated public IP costs extra [3]
Starlink (Residential)	Yes	All residential customers behind CGNAT by default; public IP requires a higher-tier plan [4]
Verizon 5G Home Internet	Partial	Varies by market
Xfinity (cable)	Sometimes	Increasingly common on lower-tier plans
Spectrum (cable)	Rarely	Typically provides public IPv4
AT&T Fiber	No	Customers typically receive a public IPv4
Verizon Fios	No	Public IPv4 provided
Google Fiber	No	Public IPv4 provided
Cox	Occasionally	Varies by market and plan tier

Note: CGNAT deployment is actively expanding. Verify your specific plan with your provider.

T-Mobile CGNAT specifically affects standard Home Internet plan subscribers, getting a real public IP requires upgrading or making a specific request, and even then it may cost extra [3]. Starlink NAT type issues are permanent at the residential tier, and the default IPv4 configuration uses CGNAT and does not allow inbound traffic [4].

How to Tell If Your ISP Is Using CGNAT

Before you try any fix, figure out which problem you actually have. The diagnostic takes about two minutes:

Go to whatismyip.com [5] or Google “what is my IP" and note the public IP shown.
Log into your router’s admin panel (usually 192.168.1.1 or 192.168.0.1) and find the WAN IP address.
Compare the two. If they match, you have a genuine public IP. If your router’s WAN IP starts with 100.64, 10., or 172.16–172.31, your ISP is using CGNAT. If it starts with 192.168, you have Double NAT from the ISP’s own gateway.
Run a network test from your console. PlayStation and Xbox both show the NAT type after a connection test.

How to Fix Strict NAT: Three Scenarios

Scenario A — Double NAT from an ISP Gateway (No CGNAT)

If your router’s WAN IP matches your public IP but starts with 192.168, your ISP’s gateway is doing NAT before your router. The fix is to put the ISP gateway into bridge mode or IP passthrough, which disables its NAT function and passes the real public IP directly to your own router. Look for this option in the gateway’s admin panel under “Bridge Mode," “DMZ," or “IP Passthrough."

If your ISP locks the gateway settings, place your console directly in the gateway’s DMZ instead. This opens all ports to that one device and virtually guarantees Open NAT, which can be an acceptable trade-off for a dedicated gaming console that isn’t storing sensitive files.

Scenario B — CGNAT from the ISP

This is the harder case. Your options, in order of effectiveness:

Request a dedicated public IPv4 from your ISP. Many cable ISPs will provide one on request, sometimes free, sometimes $5–$15/month. Call and specifically say: “I need a dedicated public IPv4 address. I’m experiencing CGNAT-related NAT issues on my gaming console." For T-Mobile Home Internet customers, a public IP requires their premium plan tier. For Starlink residential customers, a public IPv4 is available on Local and Global Priority service plans, but not on standard residential.
Enable IPv6. If your ISP supports IPv6 (most do), enabling it on both your router and console achieves Open NAT for IPv6-capable game servers, even while IPv4 remains behind CGNAT. This is increasingly effective as more games adopt IPv6 natively.
Use a gaming VPN. Services like Mudfish or ExitLag route your traffic through a server with a real public IP. This removes the CGNAT restriction but adds some latency, which is a trade-off for competitive play.

Scenario C — Strict NAT with a Confirmed Public IP

If whatismyip.com and your router WAN IP match, but you’re still getting Strict NAT, the issue is probably on your own router, specifically UPnP or port forwarding.

What is port forwarding? It’s a setting that tells your router to send incoming traffic on a specific port directly to a specific device. Without it, your router has no way to know which device an incoming game connection is meant for, so it blocks it by default. Consoles use a protocol called UPnP to request these port assignments automatically, and if UPnP is disabled, they default to Strict. Start here:

Enable UPnP in your router’s admin panel (usually under Advanced or NAT/Firewall settings). Rerun the console’s network test.
If UPnP doesn’t resolve it, manually port forward: assign your console a static local IP via DHCP reservation, then forward the required ports. PS5 needs TCP 80, 443, 3478–3480 and UDP 3478–3479 [6]. Xbox Live needs TCP 3074 and UDP 88, 500, 3074, 3544, 4500 [7].
As a last resort, place the console in your router’s DMZ. This opens all ports and guarantees Open NAT.

Which Internet Provider Is Best for Gaming?

If you’re dealing with persistent Strict NAT and considering a provider switch, here’s how the main categories stack up: Fiber providers like AT&T Fiber, Verizon Fios, and Google Fiber are the best internet for gaming, with no CGNAT, true public IPs, and the lowest latency available. Cable providers like Spectrum and Cox typically provide public IPs with moderate latency. 5G home internet options like T-Mobile work for casual gaming but CGNAT is a limitation for competitive play. Starlink is workable in areas with no wired options, but the CGNAT situation at the residential tier isn’t going away.

Want to see what gaming-friendly internet providers are available at your address? Compare internet plans in your area and check internet prices for fiber, cable, and 5G options near you. The best internet in your area might be closer than you think. Use the tool below to compare internet providers and find the right fit.

[search_block]

Frequently Asked Questions

Does CGNAT affect all gaming, or just certain games? CGNAT causes Strict NAT, which primarily affects peer-to-peer connections — meaning online multiplayer, voice chat, and game hosting. Single-player games and games that route all traffic through dedicated servers (rather than connecting players directly) often work fine behind CGNAT. Competitive multiplayer, co-op hosting, and party voice chat are where you’ll feel it most.

Will a gaming router fix Strict NAT caused by CGNAT?

No. A high-end gaming router can optimize traffic prioritization and reduce latency, but it can’t resolve CGNAT — that happens at the ISP level before your router is even involved. The only fixes for CGNAT are getting a dedicated public IP from your provider, enabling IPv6, or using a gaming VPN tunnel.

How do I change my NAT type on PS5 or Xbox without calling my ISP?

If your ISP provides a real public IP (not CGNAT), you can change your NAT type to Open by enabling UPnP in your router’s admin panel, or by manually port forwarding the required ports and assigning your console a static local IP. If you’re behind CGNAT, these steps won’t help — you’ll need to address the ISP-level issue first.

Is Strict NAT a permanent problem with T-Mobile and Starlink?

Not necessarily. T-Mobile Home Internet customers can request or upgrade to get a dedicated public IP, which resolves Strict NAT entirely. For Starlink residential customers, the standard plan uses CGNAT with no option for a dedicated public IP — however, Local and Global Priority service plans include a public IPv4 option. IPv6 is also available on Starlink and, when enabled, provides Open NAT for games that support it.