NAT type checker
Checks whether your connection is behind a Symmetric NAT or a Cone-type NAT, the same distinction behind a console’s Strict NAT warning.
What Symmetric vs. cone-type actually means
Every NAT type ultimately sorts into one of two practical buckets for gaming, calls, and peer-to-peer connections. Our port forwarding guide covers the full four-way breakdown consoles use.
| Result | What it means | Typical impact |
|---|---|---|
| Cone-type | Your router maps each internal port to the same external port for every destination | Good. Matches Open or Moderate on most consoles |
| Symmetric | Your router assigns a different external port per destination | Poor for peer-to-peer. Matches Strict, often needs a relay |
How this test actually works
The check asks two independent STUN servers what external address and port your connection maps to. If both report the same port, your NAT reuses one mapping across destinations, the signature of a cone-type NAT. If the ports differ, your NAT is Symmetric.
This is the same STUN mechanism, defined in RFC 8489, that video call apps use to find a connection path. It runs entirely in your browser. Nothing is sent to NetworkCheckr’s own servers.
Fixing a Symmetric NAT
A Symmetric result usually means port forwarding alone will not fix strict NAT warnings, since the external port keeps changing per destination. Two paths forward: ask your ISP whether you are behind CGNAT, since that alone can look like Symmetric NAT from this test, or move to a relay-based tool like Tailscale for the services that need reliable inbound access.
Frequently asked questions
Does this tool tell me Full Cone, Restricted, or Port Restricted specifically?
No. A browser can only reliably tell Symmetric NAT apart from the cone-type family using public STUN servers. Splitting cone-type further into Full, Restricted, and Port Restricted requires a cooperating two-endpoint test server that public STUN servers do not support.
Why did the test fail to detect anything?
A firewall or network policy is likely blocking outbound UDP or the STUN protocol entirely. This is common on some corporate and public Wi-Fi networks. Try again on your home network if possible.
Does this tool send my IP address anywhere?
The check itself talks directly to public STUN servers from your browser, the same way a video call app would. NetworkCheckr’s own server never sees the result.