How do I fix strict NAT type on Xbox?

Strict NAT on Xbox almost always means your router is blocking the ports Xbox Live depends on, or you have two NAT devices stacked between your console and the internet. The fastest fix for most households is to log into your router, turn on UPnP, then retest at Settings > General > Network settings > Test NAT type. If you are still Strict after enabling UPnP, work through the fixes below in order — they are ranked from most to least common cause.

What strict NAT actually means

Xbox Live reports three NAT states: Open, Moderate, and Strict. Open means the console can reach any other player freely. Moderate means some hosts are unreachable. Strict is the worst state — you can only connect to players who have Open NAT, party invites frequently fail, and matchmaking queues time out. The test at Settings > General > Network settings > Test NAT type queries Microsoft's servers in real time and gives you an authoritative result for your current network state.

NAT (Network Address Translation) is how your router shares one public IP address among every device at home. A Strict result means the router is either not allowing the Xbox to negotiate outbound sessions on the required service ports, or something upstream is running a second layer of NAT before your router even sees the traffic.

Root causes, ranked by frequency

1. UPnP is disabled — the most common cause by far. UPnP lets the Xbox automatically request port mappings from the router. When it is off, the router does not know which device should receive Xbox Live traffic.
2. Static IP conflict or DHCP churn — if the Xbox's IP address changes between sessions, any manual port forwarding rules you created stop matching the console.
3. Double NAT — an ISP-supplied modem-router combo is running NAT, and your own Wi-Fi router is also running NAT. Both layers block the Xbox from negotiating an open connection.
4. Carrier-Grade NAT (CGNAT) — your ISP assigns you a shared IP in the 100.64.0.0/10 range. No setting on your own equipment can fix this; the block is upstream of your home entirely.
5. Firewall or DoS protection settings on the router — features labeled SPI Firewall, DoS Protection, or Gaming Mode on some routers interfere with UDP hole-punching, which Xbox Live depends on.

Identify your cause before changing anything

Find your router's WAN IP in its admin panel, then compare it to your actual public IP. On Windows, open a command prompt and run:

If the router's WAN IP starts with 10., 172.16 through 172.31, or 192.168., you have double NAT — skip straight to Fix 4. If it falls between 100.64.x.x and 100.127.x.x, you have CGNAT — skip to Fix 5. If the WAN IP looks like a normal public address, your problem is almost certainly UPnP or port forwarding. Start at Fix 1.

Fix 1: Enable UPnP on your router

UPnP (Universal Plug and Play) is the lowest-effort fix and resolves Strict NAT for the majority of home setups. When UPnP is active, the Xbox negotiates its own port mappings automatically every session. The exact menu path varies by brand:

• TP-Link (stock firmware): log in at tplinkwifi.net or your gateway address > Advanced > NAT Forwarding > UPnP > toggle Enable.
• NETGEAR Orbi / Nighthawk: orbilogin.com or routerlogin.net > Advanced > Advanced Setup > UPnP > check Turn UPnP On.
• ASUS: asusrouter.com or your gateway address > WAN > Basic Config > Enable UPnP > Yes.
• Linksys (Velop / classic): linksyssmartwifi.com > Router Settings > Administration > UPnP > Enabled.
• Xiaomi / Mi Router: miwifi.com > Advanced Settings > Network > UPnP > On.
• ISP-supplied gateways: menus vary by firmware and ISP. Look under Advanced, Firewall, or NAT for a UPnP toggle. If you cannot find it, check the device manual or ISP support site.

After enabling UPnP, do a full power cycle of the router — pull the power for 30 seconds. Some firmware versions do not start the UPnP daemon on a settings save alone; they require a full restart. Then run the NAT test on the Xbox. If it shows Open or Moderate, you are done.

OpenWrt / DD-WRT note: UPnP in OpenWrt is handled by the miniupnpd package. Install it under System > Software, then configure it at Services > UPnP. In DD-WRT, go to NAT/QoS > UPnP > Enable. Neither firmware enables UPnP by default.

Fix 2: Give your Xbox a reserved IP address

Before you add manual port forwarding rules, lock the Xbox to a stable IP address using DHCP reservation at the router level. Do not set a static IP manually on the console — if the IP you pick falls inside the router's DHCP pool range, another device can claim the same address when the Xbox is offline, causing a conflict.

1. Find the Xbox's MAC address: Settings > General > Network settings > Advanced settings. Both wired and wireless MAC addresses are listed here.
2. Log into your router's admin panel. If you do not know the address, run ipconfig /all on Windows — the Default Gateway line is your router. On macOS use netstat -nr | grep default.
3. Find the DHCP reservation section. Common labels across firmware: Address Reservation, Static Leases, IP Binding, DHCP Reservation.
4. Add a new reservation: enter the Xbox MAC address and assign an IP outside the router's dynamic DHCP range. For example, if the router serves addresses from 192.168.1.100 to 192.168.1.200, assign the Xbox 192.168.1.50.
5. Save and fully reboot the Xbox (power off from the guide, not sleep mode). Confirm the assigned IP under Settings > General > Network settings > Advanced settings.

With a stable IP in place, any port forwarding rules you create will hit the correct device every time, even after a power cut or router restart.

Fix 3: Manual port forwarding for Xbox Live

If UPnP is on and NAT is still Strict, create manual port forwarding rules. Note: UPnP and manual port forwarding for the same device can produce conflicting mappings. If UPnP created entries automatically in a prior session, clear those stale entries from the UPnP status table before adding manual rules.

Microsoft's documented Xbox Live ports include the following. Always verify the current complete list on Microsoft's official Xbox support page before creating firewall rules, as platform updates occasionally add entries:

• UDP 88
• UDP 3074
• TCP 80
• TCP/UDP 53
• UDP 500
• UDP 3544
• UDP 4500

In your router's port forwarding section — usually under Advanced, NAT, Virtual Server, or Applications and Gaming — create one rule per port pointing to the reserved IP you assigned in Fix 2. Match the protocol exactly: UDP-only rules for UDP ports, TCP for TCP. Save, power-cycle the router, and run the Xbox NAT test again.

Fix 4: Eliminating double NAT

Double NAT occurs when two devices both run NAT between your Xbox and the internet — usually an ISP modem-router gateway left in its default routing mode, plus your own Wi-Fi router added behind it. Both layers of translation strip the inbound port mapping the Xbox needs.

Option A: Put the ISP gateway into bridge mode (preferred)

Bridge mode disables the ISP gateway's NAT and DHCP, turning it into a transparent modem. Only your router then performs NAT. Log into the ISP gateway — its IP is typically one hop before your router in a traceroute, or printed on the device label. Look for a setting called Bridge Mode, IP Passthrough, DMZ Mode, or Transparent Bridging. The label varies significantly by ISP and hardware generation. Some ISPs lock this setting and require a support call to enable it from their side.

After enabling bridge mode, your router's WAN IP should equal your real public IP. Verify:

Option B: DMZ on the ISP gateway

If bridge mode is unavailable, add your router's WAN IP (as seen by the ISP gateway) to the ISP gateway's DMZ. This forwards all unsolicited inbound traffic to your router, which can handle it normally. It is less architecturally clean than bridge mode but eliminates the double-NAT penalty for the Xbox without requiring an ISP call. Find DMZ under the gateway's Firewall or Advanced section and enter your router's WAN-facing IP address.

Fix 5: CGNAT — the ISP-level block

If your router's WAN IP falls in the 100.64.0.0/10 block (100.64.x.x through 100.127.x.x), your ISP is using Carrier-Grade NAT. You share a single public IP with dozens or hundreds of other customers. Port forwarding, UPnP, and bridge mode have no effect here — the NAT layer is entirely upstream of your home equipment.

1. Request a dedicated public IP from your ISP. Many providers offer this for a small monthly fee, sometimes listed as a static IP add-on or business IP option. This is the cleanest resolution and eliminates CGNAT for all devices on your network.
2. Use a VPN service that supports port forwarding. Some VPN providers allow you to reserve a port on their public IP and forward it to your device through the tunnel. The Xbox connects through the VPN, and the provider handles the public-facing port mapping. Expect a latency increase of 10–30 ms depending on server distance — test before committing to this as a permanent solution.
3. Enable IPv6 if your ISP supports it. IPv6 addresses are globally routable by design, so there is no NAT layer to worry about. If your ISP provides IPv6 and your router passes prefix delegation through to your LAN, the Xbox can reach Xbox Live over IPv6 entirely without NAT translation. Check Settings > General > Network settings > Advanced settings on the Xbox — an IPv6 address listed there means the console is already IPv6-capable on your network.

Verifying the fix with CLI tools

The Xbox's built-in NAT test is always the authoritative check for your situation. For deeper verification from a PC on the same network:

DNS failures on port 53 produce Xbox Live login errors that look identical to NAT problems in the dashboard. Use the DNS Lookup tool on this site to quickly confirm whether DNS resolution for Xbox Live domains is functioning correctly from outside your network.

Common misdiagnoses

• NAT was Open yesterday, now Strict. DHCP gave the Xbox a new IP address between sessions, so your port forwarding rules stopped matching. Fix: use DHCP reservation as described in Fix 2.
• UPnP is enabled but NAT is still Strict. Some routers need a full power cycle — not just a settings save — to start the UPnP daemon. Also check whether a secondary SPI Firewall or DoS Protection toggle on the same router is overriding UPnP.
• All ports are forwarded but nothing changed. You almost certainly have double NAT. The forwarding rules are landing on the outer device and never reaching your router. Run the traceroute check above to confirm.
• NAT shows Open but parties still fail. The problem is on another player's end, or the game is using a relay with capacity issues. Open NAT on your side is as good as it gets — there is nothing left to fix locally.
• Set a static IP manually on the Xbox itself. If that IP falls inside the router's DHCP pool, another device can grab the same address while the Xbox is powered off, causing an IP conflict on your LAN. Always reserve at the router level instead.

Preventing strict NAT from returning

1. Keep UPnP enabled permanently. Some router firmware resets all advanced settings after a firmware update — verify UPnP is still on after any router update.
2. Use DHCP reservation so the Xbox always receives the same IP automatically, with no manual intervention required after reboots or power cuts.
3. If you rely on manual port forwarding rules, document the reserved IP and rule set somewhere you can find it after a factory reset — routers sometimes reset to defaults during power surges.
4. When switching ISPs, run the traceroute check immediately to confirm the new connection is not behind CGNAT before spending time on UPnP or port forwarding.

IPv6, DoH, and what is changing in 2026

ISPs are accelerating IPv6 deployment in 2026 as a practical way to reduce CGNAT overhead. If your router has IPv6 prefix delegation (DHCP-PD) enabled and your ISP supports it, the Xbox can communicate with Xbox Live entirely over IPv6 — a globally routed path with no NAT translation at any layer. Check your router's IPv6 WAN settings and enable prefix delegation if available. The result on the Xbox is a native IPv6 address visible under Advanced network settings, and NAT type effectively becomes irrelevant for those sessions.

DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) are now common on mid-range routers and in Windows 11. These route DNS queries over TCP 443 or TCP 853 rather than UDP 53. Xbox Live itself does not use DoH, but some router-level DoH implementations intercept all DNS traffic in a way that silently breaks UDP port 53 for devices that do not support the encrypted variant. If NAT problems appeared shortly after you enabled a DoH setting on your router, disable it and retest. For a solid grounding on how DNS and NAT interact in home networks, the Cloudflare DNS reference covers resolver behavior and NAT traversal in accessible detail.