How to use
- Click Start test. Results appear in about 5 seconds.
- Read the NAT type with its mapping and filtering behaviour; the IPv4 and IPv6 boxes show your public addresses and locations.
- Switch networks (Wi-Fi vs mobile data) or change router settings and click Test again to compare. Copy results pastes a summary you can send to your ISP or post in a forum.
Options explained
- NAT1–NAT4
- Common shorthand for the RFC 3489 types full cone, restricted cone, port-restricted cone and symmetric. The higher the number, the stricter the NAT and the harder direct connections become.
- Mapping
- Whether your router keeps the same public port when you talk to different servers. The same port means a cone NAT (NAT1–NAT3); a new port for every destination means symmetric (NAT4).
- Filtering
- Which incoming packets are let in. If packets from another port of a server you contacted get through, it is NAT1 or NAT2; if only the exact address and port you contacted can reply, it is NAT3.
- Used first when both work
- When a site has both IPv4 and IPv6 addresses, which one your browser actually used. With working IPv6, browsers usually prefer it.
NAT types at a glance
| Type | Also called | Mapping to different servers | Who can send packets in |
|---|---|---|---|
| NAT1 | Full cone | Same public port | Anyone |
| NAT2 | Restricted cone | Same public port | IPs you contacted (any port) |
| NAT3 | Port-restricted cone | Same public port | The exact IP and port you contacted |
| NAT4 | Symmetric | New port for each destination | The exact IP and port you contacted |
Which pairs can connect directly
Games, video calls and P2P apps first try to connect two devices directly (hole punching) and fall back to a relay server, which is slower, when that fails. As a rule:
| You \ Peer | NAT1 | NAT2 | NAT3 | NAT4 |
|---|---|---|---|---|
| NAT1 | ✓ | ✓ | ✓ | ✓ |
| NAT2 | ✓ | ✓ | ✓ | ✓ |
| NAT3 | ✓ | ✓ | ✓ | ✗ |
| NAT4 | ✓ | ✓ | ✗ | ✗ |
NAT4 loses out most: it can only connect directly to NAT1 and NAT2 peers.
How the test works
- Your browser asks several public STUN servers which public address and port they see.
- It then sends WebRTC connectivity checks to our server, which notes the public port it sees. If it matches step 1, your router uses one port for every destination (cone); if not, it is symmetric.
- Our server sends a check back from the port you contacted and another from a different port. If both arrive, it is NAT1/NAT2; if only the first arrives, it is NAT3.
Some routers allocate ports in ways that change over time, so two runs can occasionally differ. Run it a few times if in doubt.
The IPv6 checks
- Does IPv6 work? The test loads api6.ipify.org and ipv6.icanhazip.com, which only have IPv6 addresses. If either answers, your device has working IPv6, and the address and its location are shown.
- Which one is preferred? It loads api64.ipify.org, which has both, and shows which protocol the browser used.
- ff:fe in the middle of the address: such addresses are usually built from the network card’s MAC address and keep the same second half on every network, so they can identify the device. Windows, macOS and phones normally add temporary addresses for browsing; if you see this note, check your system’s IPv6 privacy setting.
To look up where any IP is located, use IP Lookup. To check whether a port on your server or router is reachable from the internet, use Open Port Checker.
Frequently asked questions
Why are NAT1 and NAT2 shown together?
Telling them apart needs packets from a second IP address, and the test server has only one public IP. For games and P2P both count as open.
My console or game shows a different NAT type.
Consoles and games use their own names (such as Open, Moderate and Strict on Xbox) and their own tests, so the results do not always line up. If the router forwards ports to the console, puts it in a DMZ or uses UPnP, the console can also get a better result than a browser on your computer.
How do I get from NAT3 or NAT4 to NAT1/NAT2?
Common fixes are putting the ISP modem in bridge mode so only your own router does NAT, turning on UPnP, or setting a DMZ or port forwarding for the console. If the router's WAN address starts with 100.64 to 100.127, your ISP adds another layer of NAT (carrier-grade NAT); ask for a public IP. Then test again.
Is the result accurate behind a proxy or VPN?
You get the result for the proxy or VPN exit. Many proxies do not carry UDP, which shows as UDP blocked. Turn the proxy off to test your own connection.
Which servers does the test contact?
Your browser sends UDP requests to our server and to the public STUN servers of Bilibili, Xiaomi and Cloudflare to find your mapped address, and asks ipify and icanhazip for your IPv6 address. No files are read and results are not saved; our server logs IP addresses only to prevent abuse.
Privacy
This tool needs our server: what you enter or upload is sent over HTTPS, processed and then discarded, never stored. Server access logs record IP addresses and request URLs, used only to prevent abuse.