NAT & Port ForwardingMedium Severity

PS5 NAT Type Fix: How to Change NAT Type 3 to Type 2 (Open)

Reviewed By: RouterVia Engineering Group
Last Reviewed: July 2026
Last Verified: July 2026
Compatibility: All standard modern router platforms

PS5 NAT Type 3 (Strict) blocks party invitations, disables voice chat, forces multiplayer through slow relay servers, and prevents you from hosting online sessions. This expert guide explains exactly why PS5 shows NAT Type 3 or the 'NAT Type Failed' error, and walks you through every fix — from enabling UPnP and configuring PSN port forwarding, to resolving Double NAT, bypassing CGNAT, and using DMZ — for all major router brands.

NAT Type Failed? Check for CGNAT First

If your PS5 shows 'NAT Type Failed' (not just Type 3), check your router's WAN IP immediately. If it starts with 100.64.x.x, your ISP is using Carrier-Grade NAT and no router setting will fix this. You must contact your ISP to request a public IP address before any other step.

Quick AI Response Summary

Fix PS5 NAT Type 3 in Under 5 Minutes

PS5 NAT Type 3 means your router is blocking inbound PlayStation Network ports. The fastest fix: log into your router and enable UPnP — this alone resolves NAT Type 3 for most setups. If UPnP fails, assign your PS5 a static IP and manually forward TCP 3478-3480 and UDP 3478-3479. If two routers are on your network (Double NAT), fix that first by enabling Bridge Mode on your ISP modem. If your router WAN IP starts with 100.64.x.x, call your ISP — that is CGNAT and no router setting will help.

Interactive PS5 NAT Diagnostic Tool

Analyze your router NAT configuration, detect PSN port availability, and receive a personalized PS5 fix workflow.

2. PS5 NAT Type Symptoms & Diagnosis Matrix

Use this matrix to identify your exact PS5 NAT problem and apply the fastest fix:

SymptomNAT StateSeverityFastest Fix
PS5 shows NAT Type 3 on network test.Strict — Type 3CriticalEnable UPnP or forward TCP/UDP 3478-3479 to PS5 static IP.
PS5 shows "NAT Type Failed" error.STUN BlockedCriticalCheck WAN IP for CGNAT (100.64.x.x). If Double NAT, enable Bridge Mode on ISP modem.
Cannot join friends' party or lobby.Type 3 or Type 2 vs Type 3CriticalForward PSN ports. Place PS5 in DMZ as escalation. Check friend's NAT type too.
Party Chat voice keeps cutting out or dropping.Type 3 or SIP ALGHighDisable SIP ALG in router firewall settings. Ensure UDP 3478-3479 are open.
PS5 Remote Play works locally but fails over internet.Remote Play Ports BlockedMediumForward UDP 9296, 9297, 9302 to PS5 static IP for Remote Play.
NAT Type 2 but matchmaking is slow or times out.Type 2 — Other IssueSeparate IssueCheck High Ping Fix guide — likely bufferbloat or ISP routing issue.

3. PS5 NAT Types Explained: What Type 1, 2, and 3 Really Mean

PlayStation uses a three-tier NAT classification system. Unlike Xbox (which uses Open/Moderate/Strict labels), PS5 uses numbered types. Here is exactly what each means at the network level:

NAT Type 1 — Open (Direct Connection)

Your PS5 has a direct public IP address. No NAT translation is occurring — the PS5 is connected straight to a standalone modem with no router in between. All inbound connections are allowed on all ports. This is the most permissive state but requires no router, which removes your home network's firewall protection. Not recommended for home setups — NAT Type 2 is equally capable for gaming.

NAT Type 2 — Moderate (Target State)

Your PS5 is behind a router, but the required PSN ports are open — either via UPnP dynamic mapping or static port forwarding rules. Inbound PSN connections on ports 3478-3479 are allowed. Your PS5 can connect to all other NAT Type 1 and 2 players, join any party, host lobbies, and use Party Chat without restrictions. This is the ideal target for all home networks.

NAT Type 3 — Strict (Broken State)

Your router's firewall is blocking inbound UDP traffic on the PSN STUN ports (3478-3479). The PS5 can connect to PSN for downloads, trophies, and account management, but cannot establish direct peer-to-peer connections with other players. You can only connect to NAT Type 1 peers. Cannot join parties hosted by Type 2 or 3 players, cannot use Party Chat reliably, and cannot host multiplayer sessions.

4. How PlayStation Network Uses Your NAT: The STUN Handshake

When your PS5 runs a network test, it performs a STUN (Session Traversal Utilities for NAT) handshake with PlayStation's STUN servers on UDP port 3478. This process works as follows:

[PSN NAT Type Detection — STUN Handshake Flow]
1. PS5 sends UDP packet to PSN STUN server at 103.6.161.103:3478.
↓ Router creates outbound conntrack entry for this socket.
2. PSN STUN server replies, noting the external IP:port mapping your router created.
↓ STUN server then tries to send a packet back on a different source port.
3. Under NAT Type 2: Router accepts the reply because it matches the outbound session. [NAT Type 2 Confirmed]
3. Under NAT Type 3: Router blocks the STUN reply because it uses a different source port than the original outbound packet. [NAT Type 3 — Packet Dropped]
3. Under NAT Failed: Router blocks the initial outbound UDP 3478 packet entirely, or the STUN reply never arrives. [NAT Type Failed]

This explains why simply "having internet access" doesn't guarantee good NAT — the STUN test specifically probes whether your router allows unrestricted inbound UDP on the ports PSN uses for peer connections.

5. Router Brand-Specific PS5 Port Forwarding Guides

Forward these PSN ports to your PS5's static IP: TCP: 80, 443, 3478, 3479, 3480 — UDP: 3478, 3479. Find the correct menu path for your router:

TP-Link (Archer / AX Series)

  1. Log into 192.168.0.1 or tplinkwifi.net.
  2. Go to Advanced > NAT Forwarding > Virtual Servers.
  3. Click Add. Enter Service Type (e.g. PSN-TCP), External Port (3478), Internal IP (PS5 static IP), Internal Port (3478), Protocol: TCP.
  4. Repeat for each port and protocol. Save all rules.

ASUS (RT-AX / ROG / ZenWiFi)

  1. Log into router.asus.com or 192.168.1.1.
  2. Go to WAN > Port Forwarding. Set Enable to Yes.
  3. Add rules: Service Name (PSN), Port Range (3478:3480), Local IP (PS5 IP), Local Port (3478), Protocol (TCP/UDP).
  4. Enable UPnP at WAN > Basic Config > Enable UPnP.

Netgear (Nighthawk / Orbi)

  1. Log into routerlogin.net or 192.168.1.1.
  2. Go to ADVANCED > Advanced Setup > Port Forwarding.
  3. Click Add Custom Service. Enter Name (PSN), Start/End Port (3478-3480), Protocol (TCP/UDP), Internal IP (PS5 IP).
  4. Save and repeat for UDP 3478-3479.

Huawei (HG / WS / AX)

  1. Log into 192.168.3.1 or 192.168.100.1.
  2. Go to Advanced > NAT > Port Mapping.
  3. Click New Port Mapping Rule. Set External Port (3478), Internal Host (PS5 IP), Internal Port (3478), Protocol (TCP). Repeat for each port.
  4. Enable UPnP at Advanced > UPnP.

ZTE (H / F Series)

  1. Log into 192.168.1.1.
  2. Go to Forward Rules > Port Mapping.
  3. Click New. Enter WAN Connection, Protocol (TCP/UDP), External Port (3478), Internal Server IP (PS5 IP), Internal Port (3478).
  4. Save and enable UPnP under Advanced Setup > UPnP.

Linksys (WRT / Velop)

  1. Log into 192.168.1.1 or the Linksys app.
  2. Go to Smart Wi-Fi Tools > Apps & Gaming > Port Range Forwarding.
  3. Enter Application (PSN), External Start (3478), End (3480), Protocol (Both), Device IP (PS5 IP). Enable.
  4. Repeat for UDP 3478-3479.

6. Complete PS5 Port Forwarding Reference Table

ServiceProtocolPort(s)Purpose
PSN — HTTPTCP80PSN store, firmware updates, trophy sync
PSN — HTTPSTCP443Encrypted PSN authentication and account management
PSN — STUN/TURNTCP + UDP3478NAT type detection, P2P session negotiation
PSN — STUN AltTCP + UDP3479Alternate STUN port for NAT traversal
PSN — VoiceTCP3480Party Chat and voice communication
Remote PlayUDP9296, 9297PS5 Remote Play video/audio stream
Remote Play — ControlUDP9302Remote Play controller input channel

7. DMZ Configuration — Guaranteed Open NAT for PS5

If manual port forwarding fails to resolve NAT Type 3, place your PS5 in the router's DMZ (Demilitarized Zone). The DMZ forwards all inbound internet traffic to the PS5, bypassing the router's NAT and firewall entirely. This guarantees NAT Type 2 (and in some cases Type 1 if combined with Bridge Mode on the ISP modem).

  1. Assign your PS5 a static IP via DHCP reservation in your router (e.g., 192.168.1.200).
  2. Log into your router admin panel and navigate to:
    • TP-Link: Advanced > NAT Forwarding > DMZ
    • ASUS: WAN > DMZ
    • Netgear: ADVANCED > WAN Setup > Default DMZ Server
    • Linksys: Security > DMZ
    • Huawei: Advanced > NAT > DMZ Host
  3. Enable DMZ and enter your PS5's static IP address as the DMZ host.
  4. Save the configuration and reboot your router.
  5. On your PS5, run Settings > Network > Test Internet Connection. NAT Type should now show Type 2.

DMZ vs Port Forwarding: DMZ opens every port to the PS5. Port forwarding opens specific ports only. DMZ is more reliable for resolving NAT Type 3 because it eliminates all possible port-blocking scenarios. It is safe for PS5 but never use DMZ on a Windows PC or NAS device.

8. Double NAT — Why Your PS5 Port Forwarding Isn't Working

If your port forwarding rules appear correct but your PS5 still shows NAT Type 3, Double NAT is the most likely cause. Double NAT occurs when both an ISP-supplied modem-router combo and your personal router are performing network address translation simultaneously.

To detect Double NAT: log into your personal router and check the WAN IP address shown on the status page. If it is a private IP (starting with 192.168., 10., or 172.16-31.), you have Double NAT. Your port forwarding rules on your personal router are useless because all inbound traffic is blocked upstream at the ISP gateway.

Fix Double NAT First

Enable Bridge Mode on your ISP gateway modem (disables its NAT and passes the public IP to your personal router), or set your personal router to Access Point (AP) Mode (disables its own NAT, letting the ISP gateway handle routing). See our Double NAT Detected fix guide for brand-specific steps.

9. CGNAT — When Your ISP Causes Permanent NAT Type 3

Carrier-Grade NAT (CGNAT) is deployed by ISPs on mobile broadband, fixed wireless, and some fiber/cable services to share a single public IPv4 address among multiple customers. Your router's WAN port receives a private IP in the 100.64.0.0/10 range (RFC 6598). Under CGNAT, all your PS5's outbound connection attempts are routed through the ISP's shared translation system, and no inbound connections are possible.

CGNAT Detection:

Check your router WAN IP. If it falls in any range below — CGNAT is confirmed:
→ 100.64.0.0 – 100.127.255.255 (RFC 6598 — definitive CGNAT)
→ 10.0.0.0 – 10.255.255.255 (some ISPs use this for CGNAT)
Cross-verify: run curl ifconfig.me on a PC and compare with the router WAN IP shown in admin panel. If different — CGNAT is active.

Solutions when behind CGNAT:

  • Request a public static IP from your ISP — typically available as a paid upgrade on residential plans.
  • Use a gaming VPN with dedicated IP and port forwarding — Mullvad, AirVPN, and ProtonVPN offer this; the VPN must run on the router for PS5 to benefit.
  • Enable IPv6 — if your ISP provides IPv6, your PS5 can establish direct IPv6 connections bypassing CGNAT entirely. Enable IPv6 on your router and PS5.

10. SIP ALG — The Hidden Cause of Party Chat Failures

SIP ALG (Application Layer Gateway) is a router feature that intercepts UDP packets it misidentifies as VoIP SIP signaling. PS5 Party Chat uses UDP on ports 3478-3479 — the same ports SIP commonly uses. When SIP ALG is enabled, it rewrites the payload of these packets, corrupting the STUN handshake and breaking Party Chat even when port forwarding is correctly configured.

Disable SIP ALG immediately on any router used with a PS5:

  • TP-Link: Advanced > NAT Forwarding > ALG — disable SIP ALG.
  • ASUS: WAN > NAT Passthrough — set SIP Passthrough to Disabled.
  • Netgear: ADVANCED > Security > WAN Setup — disable SIP ALG.
  • Linksys: Security > Apps and Gaming — uncheck SIP.
  • Huawei: Advanced > NAT > ALG Settings — disable SIP ALG.

11. Complete PS5 Network Setup for NAT Type 2

Follow this complete step-by-step PS5 network configuration to establish optimal connection settings:

PS5 Manual Network Configuration

  1. Go to Settings > Network > Settings > Set Up Internet Connection.
  2. Select your connection type (Wi-Fi or LAN Cable). Choose your network.
  3. Press Options on your DualSense controller > Advanced Settings.
  4. Set IP Address Settings to Manual.
  5. Enter:
    • IP Address: e.g. 192.168.1.200 (outside your DHCP pool)
    • Subnet Mask: 255.255.255.0
    • Default Gateway: your router IP (e.g. 192.168.1.1)
  6. Set DNS Settings to Manual:
    • Primary DNS: 1.1.1.1 (Cloudflare)
    • Secondary DNS: 1.0.0.1
  7. Set MTU Settings to Automatic (or Manual 1500 for cable/fiber, 1492 for PPPoE).
  8. Set Proxy Server to Do Not Use.
  9. Save and test the connection. Go to Settings > Network > Connection Status > Test Internet Connection.

12. Verify Your Fix: Reading the PS5 Network Test Results

Test Result FieldGood ResultProblem if Bad
Internet ConnectionConnectedCheck DNS, cable, and router WAN status
NAT TypeType 2Type 3 = open PSN ports. Failed = check CGNAT/Double NAT
PlayStation NetworkReachablePSN outage or ISP blocking port 443
Download SpeedNear line speedQoS too restrictive or Wi-Fi interference
Upload SpeedNear line speedUPnP blocking upload, or ISP throttling upload

Use our Port Checker tool to verify that ports 3478 and 3479 are externally reachable after configuring port forwarding or DMZ.

Related Guides

NAT Type Strict Fix

Full guide for Strict NAT on all platforms — UPnP, port forwarding, DMZ, CGNAT.

Double NAT Detected Fix

Resolve cascaded router translation blocking all inbound PSN traffic.

Port Forwarding Not Working

Fix UPnP conflicts, CGNAT restrictions, and stale NAT table entries.

High Ping Fix Guide

Reduce latency, eliminate bufferbloat, and optimize QoS for gaming.

Best Router Settings for Gaming

QoS, MTU, Wi-Fi band, and firewall optimization for low-latency gaming.

Best DNS for PS5

Benchmarked DNS resolvers for fastest PSN connection and game downloads.

Quick Fix Checklist

  • 1Run Settings > Network > Test Internet Connection and note the current NAT Type and any error.
  • 2Check router WAN IP — if private (192.168.x.x / 10.x.x.x / 100.64.x.x), fix Double NAT or CGNAT first.
  • 3Enable UPnP in router admin panel. Reboot router and PS5. Retest NAT.
  • 4Assign PS5 a static IP via DHCP reservation using its MAC address.
  • 5Forward TCP 80, 443, 3478-3480 and UDP 3478-3479 to PS5's static IP.
  • 6Disable SIP ALG under Firewall/ALG settings on your router.
  • 7If still Type 3 — place PS5 static IP in the router's DMZ for Open NAT.
  • 8If WAN IP is 100.64.x.x — contact ISP to remove CGNAT or request public IP.

Common Root Causes

UPnP Disabled or Conflicting

UPnP is off or another device has claimed the same PSN ports, leaving the PS5 unable to register dynamic port mappings.

Double NAT — ISP Gateway + Personal Router

Two NAT devices in series — ISP modem-router combo and personal router — block all inbound PSN traffic before it reaches the PS5.

CGNAT — No Public IP Assigned

ISP assigns a shared private WAN IP (100.64.x.x range). No port forwarding is possible without a dedicated public IP.

SIP ALG Corrupting PSN UDP Packets

Router's SIP Application Layer Gateway intercepts PSN UDP traffic on port 3478, rewriting and corrupting the STUN handshake.

Dynamic DHCP IP — Stale Port Rules

PS5 received a new DHCP lease, making port forwarding rules point to a different device's IP address silently.

Firewall Blocking PSN STUN Port 3478

Router firewall explicitly blocking UDP 3478, preventing the PS5 from completing the NAT type determination handshake.

Step-by-Step Diagnostic Resolution Flow

  1. 1

    Run the PS5 Network Test and Record Your NAT Type

    From the PS5 home screen, go to Settings > Network > Connection Status > Test Internet Connection. Wait for the diagnostic to complete. Record the NAT Type shown (Type 1, 2, or 3) and any error message such as 'NAT Type Failed'. This baseline reading tells you exactly how severe the restriction is before making any changes. Also note your PS5's current IP address shown on the Connection Status page — you will need it for DHCP reservation.

    Expert Tip: Run this test every time you make a configuration change so you can measure improvement. The NAT type displayed here reflects your router's current state, not a cached value.
  2. 2

    Assign Your PS5 a Static IP via DHCP Reservation

    Before creating any port forwarding rules, you must lock your PS5 to a fixed private IP address. Log into your router admin panel and navigate to LAN > DHCP Server > Address Reservation (TP-Link), LAN > DHCP Server > Manually Assigned IP (ASUS), or LAN Setup > Address Reservation (Netgear). Add a new reservation using your PS5's MAC address (found at Settings > System > System Information on the PS5) and assign an IP outside the DHCP pool — for example, 192.168.1.200. This ensures your port forwarding rules always point to the correct device.

    Expert Tip: DHCP reservation is safer than setting a static IP manually on the PS5 itself, because the router still manages the lease and subnet configuration centrally.
  3. 3

    Enable UPnP on Your Router

    Log into your router admin panel. Navigate to Advanced > NAT Forwarding > UPnP (TP-Link), WAN > Basic Config > Enable UPnP (ASUS), ADVANCED > Advanced Setup > UPnP (Netgear), or Advanced > UPnP (Huawei). Enable UPnP and save the configuration. Restart your router. Then restart your PS5 and run Settings > Network > Test Internet Connection again. UPnP allows the PS5 to automatically negotiate port mappings with the router, which is sufficient to achieve NAT Type 2 on most home networks.

    Expert Tip: If two PlayStation consoles share your network and both request the same UPnP port (3478), only the first gets it. The second will remain Type 3. In this case, disable UPnP and use manual port forwarding with different port assignments for each console.
  4. 4

    Configure Manual Port Forwarding Rules for PSN

    If UPnP does not change your NAT type, create manual port forwarding rules in your router admin panel. Navigate to the port forwarding section (Virtual Servers on TP-Link, Port Forwarding on ASUS, Port Forwarding/Port Triggering on Netgear). Add the following rules, all pointing to your PS5's static IP: TCP ports 80, 443, 3478, 3479, 3480 and UDP ports 3478, 3479. Save the rules and run the PS5 network test again. NAT Type should change to Type 2.

    Expert Tip: Always set the protocol correctly — TCP ports and UDP ports are different rules. A rule configured as TCP only will not pass UDP game traffic, leaving NAT partially open.

When To Contact Your ISP

Contact your ISP if your router WAN IP is in the 100.64.0.0/10 CGNAT range, if they provide a locked gateway that cannot be put in Bridge Mode, or if the PS5 consistently shows 'NAT Type Failed' despite correct port forwarding rules. Request a dedicated public static IP or an upgrade to a business connection.

Expert Q&A & Troubleshooting Insights

What does PS5 NAT Type 3 (Strict) mean?

NAT Type 3 on PS5 means your router's firewall is blocking inbound UDP and TCP connections on the ports used by PlayStation Network. The PS5 can connect to PSN servers for downloads and account management, but cannot establish direct peer-to-peer connections with other players. This prevents you from joining friends' parties, hosting multiplayer sessions, and using Party Chat reliably.

What is the difference between PS5 NAT Type 1, 2, and 3?

NAT Type 1 (Open) means your PS5 has a direct connection to the internet without any router performing NAT — typically by connecting directly to a modem. NAT Type 2 (Moderate) means your PS5 is behind a router but the required PSN ports are open via UPnP or port forwarding. This is the ideal state for gaming. NAT Type 3 (Strict) means your router is blocking inbound ports, severely limiting peer-to-peer connections and multiplayer functionality.

What does 'PS5 NAT Type Failed' mean?

The 'NAT Type Failed' error on PS5 means the console successfully connected to the internet but could not complete the STUN (Session Traversal Utilities for NAT) handshake used to determine NAT type. This is almost always caused by Double NAT (two routers in series), an overly aggressive firewall blocking UDP on port 3478, or CGNAT at the ISP level. Check your router's WAN IP — if it is a private address (192.168.x.x, 10.x.x.x, or 100.64.x.x), your network has Double NAT or CGNAT.

What ports do I need to forward for PS5 to get NAT Type 2?

For PlayStation Network on PS5, forward the following ports to your PS5's static IP: TCP 80, TCP 443, TCP 3478, TCP 3479, TCP 3480, UDP 3478, UDP 3479. For PS5 Remote Play, also forward UDP 9296, UDP 9297, UDP 9302. After creating the rules, run Settings > Network > Test Internet Connection on your PS5 to confirm NAT Type 2.

Is it safe to put my PS5 in the DMZ?

Yes, placing a PS5 in the DMZ is safe in practice. The PS5 runs a closed operating system that does not expose vulnerable services like SMB file sharing, RDP, or web servers. The PS5's network stack only responds to traffic from PSN authentication servers and known game services. Keep your PS5 firmware updated while using DMZ. Never place a Windows PC or NAS in the DMZ without a software firewall.

Can I get PS5 NAT Type 1 through my router?

No. NAT Type 1 requires your PS5 to have a direct public IP address with no router performing network address translation. This is only possible by connecting the PS5 directly to a standalone modem (not a modem-router combo). Since this removes all router-level firewall protection for your other devices, NAT Type 2 is the practical target for all home setups. NAT Type 2 provides identical multiplayer connectivity to Type 1.

Why does PS5 Party Chat keep disconnecting even with NAT Type 2?

If your PS5 shows NAT Type 2 but Party Chat still disconnects, the issue is likely with another player in the lobby — if they have NAT Type 3, the P2P audio channel cannot be established from their side. Other causes include: SIP ALG enabled on your router (corrupting UDP audio packets), ISP-level deep packet inspection filtering VoIP-like UDP streams, or Wi-Fi interference causing packet loss on the audio stream. Disable SIP ALG in your router's Firewall or ALG settings and verify all party members' NAT types.

Does Double NAT cause PS5 NAT Type 3?

Yes. Double NAT is one of the most common causes of permanent NAT Type 3 on PS5. When two routers are active on your network (typically an ISP modem-router combo plus your personal router), port forwarding rules on your personal router are ignored because the ISP gateway blocks all inbound traffic first. You must enable Bridge Mode on the ISP gateway or set your personal router to Access Point (AP) Mode to eliminate the second NAT layer before port forwarding will work.

Can CGNAT prevent me from fixing PS5 NAT Type 3?

Yes. If your ISP uses Carrier-Grade NAT (CGNAT), your router's WAN IP will be in the 100.64.0.0 to 100.127.255.255 range. Under CGNAT, you share a public IP with hundreds of other customers and cannot receive unsolicited inbound connections. No router setting — UPnP, port forwarding, or DMZ — can fix NAT Type 3 under CGNAT. Contact your ISP and request a dedicated public IP address.

Will using a VPN fix PS5 NAT Type 3?

A gaming VPN with port forwarding (such as Mullvad, AirVPN, or ProtonVPN) can bypass CGNAT and provide Open NAT, but only if the VPN runs on your router or uses a dedicated PS5 VPN configuration. Most VPN services use Symmetric NAT at their endpoints, which is actually worse than Strict NAT for gaming. If you use a VPN, verify it supports port forwarding and uses a dedicated IP — otherwise the VPN will worsen your NAT situation.