IP

CGNAT Check

Inbound connectivity toolkit

Toolkit

NAT Type Check

This page does not fake a browser-based NAT type test. Instead, it gives you a practical way to understand open, moderate, and strict NAT and connect that back to CGNAT, double NAT, UPnP, and port forwarding.

What NAT type means in plain English

NAT type is a simplified way of describing how easy it is for outside connections to reach you. Games, hosting tools, and remote access apps often collapse a complicated network path into labels like open, moderate, or strict.

Those labels are useful, but they do not tell you exactly where the problem is. A strict NAT result might come from CGNAT, a second router, missing forwards, local firewall rules, or a mix of several issues.

Open NAT

Your network is usually able to accept inbound or peer connections with fewer obstacles. That does not guarantee every port is open, but it is the least restrictive state.

Moderate NAT

Some connections work, but peer-to-peer sessions or hosting can still fail depending on the other side, the game or app, and the router setup.

Strict NAT

Inbound or peer connections are heavily limited. CGNAT, double NAT, missing forwards, or firewall filtering are common reasons.

Related factor

CGNAT

If your ISP shares a public IPv4 address across many customers, open NAT and inbound hosting can be much harder or impossible on standard IPv4.

Related factor

Double NAT

An ISP gateway in front of your own router can create two NAT layers, which often causes moderate or strict NAT symptoms.

Related factor

UPnP

UPnP can automatically open ports on some routers, but it cannot override ISP-level CGNAT or another upstream NAT layer.

Related factor

Port forwarding

Manual forwards can help if you have a public IPv4 and the rest of the path is clean, but they do not fix CGNAT by themselves.

What to check next

A practical decision path

  1. Check the router WAN IP and compare it with your public IP using the CGNAT Checker.
  2. Look for double NAT if you have both an ISP gateway and your own router.
  3. Confirm the game, console, or app actually documents which ports or protocols it needs.
  4. Review UPnP, manual port forwards, and local firewall rules together instead of changing them one by one at random.
  5. If you suspect ISP-level NAT, ask whether your plan can receive a public IPv4 or whether a different product tier changes the answer.

Practical options

Where strict or moderate NAT usually leads next

If games, hosting, or remote access keep showing moderate or strict NAT, start with the local network path and then move outward only if the basics look clean.

Prioritise local network cleanup

Work through bridge mode, access-point mode, forwarding through both routers, or removing a router that is not needed.

Solution

Fix the router and network path first

When CGNAT is not the strongest signal, the best next step is usually cleaning up double NAT, bridge mode, forwarding rules, and firewall settings.

What it may solve
It can solve many moderate or strict NAT issues caused by double NAT, wrong target IPs, wrong ports, or services that never listened correctly.
What it does not solve
It does not help if the ISP never gives you a usable public IPv4 path in the first place.
Cost
Free
Difficulty
Moderate
Public exposure
Sometimes
Security note
Avoid exposing insecure services while testing. Harden the target service before you leave it reachable from the internet.
Work through router checks

If the ISP path still looks restrictive

Once bridge mode, forwarding, and firewall checks look clean, compare the public IP path and then review broader workaround options cautiously.

Solution

Ask your ISP what is actually provisioned

This is usually the safest first step when you suspect CGNAT, shared IPv4, or plan-level inbound limitations.

What it may solve
It can confirm whether you are on CGNAT, whether a public IPv4 is available, and whether a static IPv4 or IPv6 option exists.
What it does not solve
It does not fix a misconfigured router, a local firewall issue, or a service that is not listening correctly.
Cost
Free
Difficulty
Low
Public exposure
No
Security note
No direct exposure risk by itself, but use the answer to avoid opening services blindly on incorrect assumptions.
Browse ISP guides
Solution

Use private remote access instead of exposing the service publicly

Overlay or mesh tools such as Tailscale Serve and similar private-access options can avoid public inbound exposure for many remote-access tasks.

What it may solve
It can help when you need trusted users to reach a service privately without opening it broadly on the public internet.
What it does not solve
It does not turn a private overlay into a public hosting solution for anonymous visitors or all multiplayer/game scenarios.
Cost
Free or paid
Difficulty
Moderate
Public exposure
No
Security note
Private overlays reduce public exposure, but access policies and device trust still need careful review.
See private-access options

Related toolkit pages

Keep narrowing down the cause

Tool

CGNAT Checker

Compare your WAN IP and public IP.

Open tool

Tool

Port Checker

See whether a TCP port appears reachable.

Open tool

Guide

Why port forwarding fails

Review the most common inbound connectivity blockers.

Read more

Support

FAQ

See practical answers about NAT type, WAN IP mismatches, and forwarding.

Read more

Guide

Router guides

Find your WAN IP and key router settings faster.

Read more

Guide

ISP pages

See cautious guidance for provider-specific troubleshooting.

Read more

Guide

Solutions

Compare the practical workaround paths once you know where the blockage is.

Read more

Informational only: NAT type labels are shorthand. They can point you in the right direction, but they do not replace checking the router WAN IP, public IP, forwarding rules, and ISP setup directly.