Why is my NAT type strict on PC?

Strict NAT on a PC usually means inbound peer connections cannot reliably reach your device. Common causes include disabled UPnP, blocked or missing port mappings, Windows Defender Firewall rules, CGNAT from the ISP, Double NAT at home, or Symmetric NAT behavior upstream.

Why does my game show Strict NAT when NATChecker reports Full Cone NAT?

The two tests check different parts of the connection. NATChecker measures the general NAT behavior of the network path used by your browser. A game may test a different UDP port, Windows Defender Firewall access, its own matchmaking or voice service, or a player-hosting path. If only one game reports Strict NAT, check that game's service status, firewall access, and official port requirements before changing the router again.

Can I change NAT type in Windows 11 settings or Command Prompt?

No. Windows 11 has no setting or command that changes the NAT rules on your router or your ISP's network. Changing the network profile, running ipconfig, or resetting the adapter may help local Windows networking, but it cannot remove CGNAT or change upstream NAT. Change the router or ISP setup instead, or use a VPN workaround when you cannot control them.

Can Windows Defender Firewall make a game show Strict NAT?

Yes. Windows Defender Firewall can block traffic that a game needs and make that game report Strict NAT, even though it does not change the NAT rules on your router. Allow the trusted game or its required ports through the firewall, keep the firewall enabled, and then test the game again.

Is it safe to put a Windows PC in the router's DMZ?

Use DMZ only as a short diagnostic test, not as a permanent setup for a general-purpose PC. It sends unsolicited incoming traffic to that PC and increases its exposure. Keep Windows Defender Firewall enabled, test the connection, and then remove the PC from DMZ. For regular use, prefer UPnP or forward only the ports you need.

Do I need port forwarding on PC, and which ports should I open?

Most PC games do not need manual port forwarding. It is mainly useful when you host a game, run a server, or a game needs incoming connections. If you do not know the port numbers, or the game uses many or changing ports, PureVPN's paid Port Forwarding add-on can open every incoming port through the VPN at supported locations, so you do not have to enter them one by one. Keep Windows Defender Firewall enabled and allow only the trusted game or server.

How can I fix Strict NAT without access to the router?

On a dorm, hotel, campus, workplace, hotspot, or CGNAT connection, you normally cannot change the upstream router yourself. If the network allows VPN connections, install PureVPN on the Windows PC, connect to a Port Forwarding-supported location, and choose Enable all ports in its paid add-on. Incoming connections then use the VPN path, so you do not need router access or a list of port numbers. This works around the restriction for this PC; it does not remove CGNAT or change the locked router, and each game may still report a different NAT result.

Is Moderate NAT good enough for PC gaming?

Usually, yes. If you can join matches, accept invitations, use voice chat, and host the sessions you need, stop changing settings. Try to improve the NAT only when a feature actually fails or when you need incoming connections that Moderate NAT does not allow.

Will Open NAT lower ping or improve FPS?

Yes for in-game lag in peer-to-peer games. Open NAT lets other players connect directly to you — the lowest-latency path — while a stricter NAT forces peer-to-peer traffic through relay servers and adds real delay to matches and voice chat. Ping to dedicated game servers stays the same either way; that depends on distance and ISP routing. FPS is the one thing Open NAT never changes, because NAT has no effect on frame rate or bandwidth. And if you fix NAT with a VPN, the VPN itself can add latency, so pick a nearby server and test.

Will I pay more if I buy through an affiliate link?

No. The price is the same for you. NAT Checker may receive a commission, which helps us keep the site and its free tools running.

Back to Blog

Guide

8 min readAug 20, 2026

How to Check and Change NAT Type on a Windows 11 PC

A complete PC NAT type change guide: test your NAT type first, try UPnP or DMZ, fix CGNAT or Double NAT, then choose a VPN workaround or FRP tunneling when normal fixes are blocked.

I put this guide together after testing NAT changes on my own Windows PC and home router. My hands-on testing was done in my country, so router pages and ISP policies may look different elsewhere. But the problems people describe in gaming and networking communities are usually the same: the NAT result does not change after router settings, the line is behind CGNAT, or two routers are creating Double NAT. That is why the method below focuses on the network path instead of random Windows tweaks.

How to Check NAT Type on a Windows 11 PC

Use NATChecker.com on the Windows PC and network where the connection problem occurs. NATChecker.com is a free NAT type checker used by more than 2,000 people every day and ranked #1 on Google for NAT checker searches. Although the tool launched in July 2025, it quickly outranked many older alternatives because the test is fast, accurate, and free.

NAT result	What it means	What to do next
Full Cone NAT	The best result for direct peer connections and hosting games or services.	Stop here unless a specific game or app still has its own connection issue.
Restricted Cone NAT	Usually usable, but inbound peer connections can still be limited.	Continue with UPnP or DMZ if P2P, hosting, or matchmaking still has problems.
Port Restricted Cone NAT	More restrictive because the remote address and port both matter.	Continue with router-side changes and upstream NAT checks.
Symmetric NAT	The most restrictive result and a common cause of failed P2P connections.	Continue through every step in this guide, especially CGNAT and Double NAT checks.

The goal is not to change settings blindly. It is to learn whether your PC already has an open NAT result or whether the network path needs to change.

How to Change NAT Type on a Windows 11 PC

Step 1Enable UPnP or DMZ on Your Router

If your NAT type is not Full Cone, the first useful fix is usually on the router. Try UPnP first. If UPnP does not change the result, DMZ can be used as the next router-side test.

Option A: Enable UPnP

UPnP lets apps and games ask the router to create temporary mappings automatically.

1. Open your router admin page.
2. Find UPnP under NAT, Advanced, Internet, or Gaming settings.
3. Enable UPnP, save the setting, then restart the game or reconnect the PC.
4. Run the NAT test again and compare the result.

Option B: Try DMZ for the PC

DMZ forwards unsolicited inbound traffic to one LAN device. Use it only for the Windows PC you are testing.

1. Reserve a stable LAN IP for the Windows PC in the router.
2. Find the router's DMZ setting.
3. Set the Windows PC LAN IP as the DMZ host and save.
4. Retest NAT type from the same PC.

DMZ is useful for diagnosis, but it exposes more traffic to the selected PC than UPnP does. Use it only for the PC you are testing.

Port forwarding is worth using only when UPnP or DMZ can work on this network and you only want to expose specific ports. If neither UPnP nor DMZ changes the NAT result, port forwarding is usually a waste of time, so do not keep tuning that option.

Step 2If NAT Does Not Change, Check CGNAT or Double NAT

If UPnP or DMZ does not change the NAT result, the router may not be the final device controlling inbound traffic. Check the upstream path.

Check for CGNAT

CGNAT means the ISP is sharing one public IPv4 address across many customers. If your line is behind CGNAT, local router settings cannot create direct inbound reachability. Contact the ISP and ask for a public IPv4 address or a static public IP option.

Open the CGNAT checker guide

Check for Double NAT

Double NAT happens when two devices are both routing, such as an ISP gateway plus your own router, a mesh router behind another router, or chained home routers. Simplify the network: use bridge mode, AP mode, or keep only one main NAT router.

Open the Double NAT guide

Step 3Retest NAT Type After Each Change

Retest after every major change. This keeps the process clear and prevents you from changing multiple layers without knowing which one mattered.

1. Test the original NAT type.
2. Enable UPnP, then test again.
3. Try DMZ for the Windows PC, then test again.
4. Fix CGNAT or Double NAT if found, then test again.

Run the NAT test

Step 4Use a VPN or FRP Workaround

If you cannot change your router or get a public IP, use a VPN for the simplest app-based workaround, or FRP when you know the exact TCP or UDP ports and can manage a public server. A VPN uses the server’s NAT, so apps and games may see a different NAT type or different inbound connectivity through features such as Moderate NAT or port forwarding; your home router remains unchanged. FRP exposes selected ports through a public server rather than changing NAT type.

Choose a VPN That Supports Your NAT Setup

Not every VPN supports NAT improvement features or port forwarding. Our research confirmed that each provider's official documentation describes at least one of these features and publishes its refund or cancellation terms, so you can judge whether it fits your setup before buying.

Proton VPN

Best value for everyday players who want easier multiplayer with minimal setup.

Moderate NAT feature
Port Forwarding
Proton's ecosystem has more than 100 million users.
30-day money-back guarantee.

Choose Proton VPN

PureVPN

Get the best NAT type with All-Port Forwarding to minimize NAT-related connection problems during activities such as hosting games or services, joining games, or using other P2P features.

Improve NAT via port forwarding
All-Port Forwarding
PureVPN has more than 3 million users.
31-day money-back guarantee.

Choose PureVPN

Use FRP for Known Ports

FRP maps selected ports on a public server to a game server, web service, or other app on your Windows PC. It can work behind CGNAT or double NAT, but it requires a public-IP server and basic networking skills. Choose a server close to the users who will connect.

Vultr

Best for broad global coverage and a straightforward first FRP server.

32+ data center locations make it easier to place the server close to users.
$300 promotional credit for eligible new accounts, usable during the first 30 days.
Hourly billing keeps short FRP tests easy to control.

Choose Vultr

DMIT

Best for premium Asia-Pacific routes and latency-sensitive services.

Optimized routes across Hong Kong, Tokyo, and Los Angeles.
Premium network options for China and wider Asia-Pacific traffic.
Eligible orders can receive a full refund within 3 days with usage under 30GB, or a partial refund within 30 days.

Choose DMIT

FAQ

To get Open NAT behavior on a PC, first confirm your current NAT type, then enable UPnP on the router. If UPnP does not work, forward only the ports the game requires. Use DMZ only as a short diagnostic test after assigning the PC a stable LAN IP, then remove the PC from DMZ. If the result still does not change, the real blocker is usually CGNAT, Double NAT, or an upstream router you do not control.

Run the NAT Test

Start by checking your current NAT type from this Windows PC. If it is already Full Cone, you usually do not need the rest of the guide.

Share this article