How to Check and Change NAT Type on PC and Windows 11
Quick Answer
Do not start by changing random Windows settings. NAT type is usually decided by your router and upstream network path. Follow this order:
Test NAT type first
Test your NAT type with NATChecker.com first. If the result is Full Cone, there is usually nothing to fix. Continue only for Restricted Cone, Port Restricted Cone, or Symmetric NAT.
Enable UPnP or DMZ on the router
UPnP is the first option. If it does not work, DMZ can be used for a dedicated PC after assigning that PC a stable LAN IP.
Check CGNAT or Double NAT
If router settings do not change the NAT result, the blocking point is often outside the Windows PC itself.
Retest after each change
Change one layer at a time, then run the NAT test again so you know which step actually changed the result.
Use FRP for specific ports if normal fixes are not possible
FRP can expose selected ports to the public internet through a server. It does not change the whole network NAT type.
I put this guide together after testing NAT changes on my own Windows PC and home router. My hands-on testing was done in my country, so router pages and ISP policies may look different elsewhere. But the problems people describe in gaming and networking communities are usually the same: the NAT result does not change after router settings, the line is behind CGNAT, or two routers are creating Double NAT. That is why the method below focuses on the network path instead of random Windows tweaks.
How to Check NAT type on PC / Windows 11?
Use NATChecker.com on the same Windows PC and the same network where the connection problem happens. NATChecker.com is a free NAT type checker used by more than 2,000 people every day and ranked #1 on Google for NAT checker searches. Although the tool was freshly released in July 2025, it quickly outranked many older alternatives because the test is fast, accurate, and free.
| NAT result | What it means | What to do next |
|---|---|---|
| Full Cone NAT | The best result for direct peer connections and hosting behavior. | Stop here unless a specific game or app still has its own connection issue. |
| Restricted Cone NAT | Usually usable, but inbound peer behavior can still be limited. | Continue with UPnP or DMZ if you need better P2P, hosting, or matchmaking behavior. |
| Port Restricted Cone NAT | More restrictive because the remote address and port both matter. | Continue with router-side changes and upstream NAT checks. |
| Symmetric NAT | The most restrictive result and a common cause of failed P2P connections. | Continue through every step in this guide, especially CGNAT and Double NAT checks. |
The goal is not to change settings blindly. The goal is to know whether your PC already has a high-grade NAT result or whether the network path needs to be changed.
How to Change NAT type on PC / Windows 11?
Step 1Enable UPnP or DMZ on Your Router
If your NAT type is not Full Cone, the first useful fix is usually on the router. Try UPnP first. If UPnP does not change the result, DMZ can be used as the next router-side test.
Option A: Enable UPnP
UPnP lets apps and games ask the router to create temporary mappings automatically.
- 1. Open your router admin page.
- 2. Find UPnP under NAT, Advanced, Internet, or Gaming settings.
- 3. Enable UPnP, save the setting, then restart the game or reconnect the PC.
- 4. Run the NAT test again and compare the result.
Option B: Try DMZ for the PC
DMZ forwards unsolicited inbound traffic to one LAN device. Use it only for the Windows PC you are testing.
- 1. Reserve a stable LAN IP for the Windows PC in the router.
- 2. Find the router's DMZ setting.
- 3. Set the Windows PC LAN IP as the DMZ host and save.
- 4. Retest NAT type from the same PC.
DMZ is useful for diagnosis, but it exposes more traffic to the selected PC than UPnP does. Use it only for the PC you are testing.
Port forwarding is worth using only when UPnP or DMZ can work on this network and you only want to expose specific ports. If both UPnP and DMZ do not change the NAT result, port forwarding is usually a waste of time, so do not keep tuning that option.
Step 2If NAT Does Not Change, Check CGNAT or Double NAT
If UPnP or DMZ does not change the NAT result, the router may not be the final device controlling inbound traffic. Check the upstream path.
Check for CGNAT
CGNAT means the ISP is sharing one public IPv4 address across many customers. If your line is behind CGNAT, local router settings cannot create direct inbound reachability. Contact the ISP and ask for a public IPv4 address or a static public IP option.
Open the CGNAT checker guideCheck for Double NAT
Double NAT happens when two devices are both routing, such as an ISP gateway plus your own router, a mesh router behind another router, or chained home routers. Reduce the network topology: use bridge mode, AP mode, or keep only one main NAT router.
Open the Double NAT guideStep 3Retest NAT Type After Each Change
Retest after every major change. This keeps the process clear and prevents you from changing multiple layers without knowing which one mattered.
- 1. Test the original NAT type.
- 2. Enable UPnP, then test again.
- 3. Try DMZ for the Windows PC, then test again.
- 4. Fix CGNAT or Double NAT if found, then test again.
Step 4Use FRP Tunneling for Specific Ports
If router settings, CGNAT changes, or topology changes are not possible, FRP tunneling is the final workaround. FRP lets a Windows PC expose selected ports through a server that has a public IP address.
Important distinction
FRP changes the reachability of specific ports, not the NAT type of the entire network. A normal NAT checker may still show the same NAT result, but the selected port can already behave like a publicly reachable port.
I have not published a dedicated FRP setup guide yet. For now, you can ask an AI assistant for an FRP configuration example based on your exact server, port, and protocol. If you want me to write a step-by-step FRP tutorial for NATChecker, send me a note at admin@natchecker.com. If enough readers ask for it, I will turn it into a separate guide.
Hosting a game server
Expose only the server port that outside players need to reach.
Publishing a service port
Forward one controlled TCP or UDP port instead of opening the whole PC.
Working around CGNAT
Use a public server as the reachable endpoint when the ISP cannot provide public IPv4.
FAQ
How do I get Open NAT type on PC?
To get Open NAT behavior on a PC, first confirm your current NAT type, then enable UPnP on the router. If UPnP does not work, try DMZ for the Windows PC after assigning it a stable LAN IP. If the result still does not change, the real blocker is usually CGNAT, Double NAT, or an upstream router you do not control.
Why is my NAT type strict on PC?
Strict NAT on PC usually means inbound peer connections cannot reach your device cleanly. Common causes include disabled UPnP, no working DMZ or port mapping, CGNAT from the ISP, Double NAT at home, or Symmetric NAT behavior upstream.
Read the full strict NAT guideWhat does Port Restricted NAT mean?
Port Restricted NAT means the router allows return traffic only from the specific remote IP address and remote port your PC contacted first. It is usually more restrictive than Restricted Cone NAT and can cause problems for P2P games, voice chat, hosting, and direct multiplayer sessions.
Why is my NAT still strict after enabling UPnP or DMZ?
If UPnP or DMZ does not change the NAT result, your router may not be the final NAT device. Check whether your ISP is using CGNAT, or whether your home network has Double NAT from an ISP gateway, mesh router, or chained routers.
Run the NAT Test
Start by checking your current NAT type from this Windows PC. If it is already Full Cone, you usually do not need the rest of the guide.