How to Get Open NAT (Type 2) on PS5, Xbox & PC Without Using DMZ

Updated 2026-10-09 • By Marcus Vance, CCNA (Senior Network Engineer)

To get Open NAT on Xbox Series X/S and PC—or NAT Type 2 on PlayStation 5—without exposing your device in the router's unsafe DMZ, first verify your router's WAN port holds a public IPv4 address (no Double NAT or ISP CGNAT), assign a static DHCP reservation to your console, and either forward UDP 3074 / 3478–3479 or enable Secure UPnP restricted via ACL to your console's IP.

1. NAT Type 1 vs Type 2 vs Type 3 (And Why DMZ Is a Security Trap)

Console and PC games use UDP hole-punching and peer-to-peer coordination for party voice chat, lobby hosting, and low-latency matchmaking. Because Sony, Microsoft, and studios like Activision (Call of Duty) use different labels, here is what each NAT tier means at the packet level:

• PS5 NAT Type 1 / Xbox & PC Open (Direct Modem): The console holds a public WAN IPv4 address with zero router NAT in front of it, leaving your network without a gateway firewall.
• PS5 NAT Type 2 / Xbox & PC Open NAT (The Ideal Target): Your console sits safely behind your router's stateful NAT firewall, and inbound game traffic reaches your console via Full Cone NAT, Port Forwarding, or Secure UPnP.
• PS5 NAT Type 3 / Xbox & PC Strict NAT (Broken): Caused by Symmetric NAT, Double NAT, or ISP CGNAT. You can only matchmake with Open NAT hosts and suffer voice chat drops.

Warning: Never place your PC or PS5 IP in the router's DMZ—DMZ exposes every OS port on your machine to global internet scanners.

2. Step 1: Verify You Don't Have Double NAT or ISP CGNAT (100.64.x.x)

Before touching port forwarding, log into your router's administration status page and inspect the WAN IPv4 Address. If your router does not hold a routable public IPv4 address on its WAN port, every port forwarding rule you create will fail silently:

• RFC 1918 Private WAN IP (192.168.x.x, 10.x.x.x, or 172.16.x.x–172.31.x.x): You have Double NAT—your ISP modem-router gateway in front of your router is also performing NAT. Fix this by enabling Bridge Mode or IP Passthrough on the ISP gateway (or switching your secondary mesh system to Access Point mode).
• RFC 6598 CGNAT WAN IP (100.64.0.0 to 100.127.255.255): Common on T-Mobile 5G Home Internet, Starlink Standard, and smaller regional fiber ISPs (like Metronet or Ezee Fiber). Because the ISP shares one public IPv4 across dozens of homes, inbound IPv4 ports are blocked upstream. To get Open NAT on a CGNAT fiber ISP, enable Native IPv6 on your router and console (Xbox Series X uses IPv6 natively to bypass IPv4 NAT) or lease a $5–$10/month Static Public IPv4 from your ISP.

3. Method A (Single Console): Static DHCP Lease + Manual Port Forwarding

If you have one PS5, Xbox Series X/S, or gaming PC on your network and prefer to keep UPnP disabled for maximum zero-trust security, manual Port Forwarding gives you permanent Open NAT / Type 2:

• Step 1 — Lock a Static DHCP Reservation: In your router under LAN → DHCP Server, bind your console's wired Ethernet MAC address to a fixed IP such as 192.168.1.210 so its internal address never changes after a reboot.
• Step 2 — Forward Exact Console Ports (WAN → 192.168.1.210):
  • Xbox Series X/S & Call of Duty (PC/Xbox): Forward UDP 3074 ( plus TCP 3074, UDP 88, UDP 500, UDP 3544, UDP 4500). Alternatively, in Xbox Settings → General → Network settings → Advanced settings → Alternate port selection, choose a clean manual port like UDP 51245 and forward only that single port!
  • PlayStation 5 (PSN + CoD): Forward TCP 1935, 3478–3480 and UDP 3074, 3478–3479.
• Step 3: Reboot the console completely (not Rest Mode) and run Test NAT Type in network settings.

4. Method B (Multiple Consoles): Secure UPnP ACLs & Full-Cone NAT

Why does manual port forwarding break when two PS5s, two Xboxes, or a PC and a console in the same house play Call of Duty, Halo, or Destiny 2 together? Because a router can only forward external port UDP 3074 to one internal IP address. Whoever boots the game second gets pushed into Moderate or Strict NAT and gets kicked from the party lobby.

To support multiple consoles simultaneously with Open NAT on every machine:

• Delete manual port forwards for 3074: Having both a static port forward on 3074 and UPnP enabled confuses the UPnP daemon.
• Enable UPnP in Secure Mode with an ACL: On routers running OPNsense, pfSense, OpenWrt, Asuswrt-Merlin, or Ubiquiti UniFi, enable UPnP / NAT-PMP with Secure Mode ON (so a device can only map ports to its own IP). In the UPnP Access Control List (ACL), add an Allow entry restricted strictly to your consoles' reserved IPs: e.g., allow 1024-65535 192.168.1.210/32 1024-65535 and allow 1024-65535 192.168.1.211/32 1024-65535, followed by a default deny 0-65535 0.0.0.0/0 0-65535 so IoT devices can never use UPnP.

Gaming Console NAT Types & Required Port Forwarding Reference

Open NAT (Type 2) Gaming Configuration Checklist

1. Confirmed the router's WAN IPv4 is a public IP address (not 192.168.x.x Double NAT or 100.64.x.x–100.127.x.x CGNAT).
2. Verified the console or gaming PC is NOT placed inside the router's DMZ.
3. Connected the PS5, Xbox Series X, or PC via Cat6 Ethernet (or dedicated 5 GHz / 6 GHz WiFi) and assigned a static DHCP reservation.
4. For a single console: forwarded UDP 3074 and UDP 3478–3479 (plus TCP 3074/3478–3480) to the console's reserved IP.
5. For multiple consoles: removed static 3074 port forwards and enabled Secure UPnP (ACL-restricted to console IPs only).
6. Enabled Native IPv6 on the router and restarted the console to verify Open NAT / NAT Type 2 inside both OS and in-game menus.

Frequently Asked Questions

Should I try to get NAT Type 1 instead of NAT Type 2 on my PS5?

No—NAT Type 2 is the exact goal on PlayStation 5 when using a router. NAT Type 2 has the exact same matchmaking, latency, and voice chat privileges as NAT Type 1, while keeping your PS5 protected behind your router's stateful firewall.

Why does my Xbox say 'Double NAT detected' even though I only have one router?

If you only have one router in your home and Xbox still reports 'Double NAT detected', either your ISP modem is actually a combo modem-router gateway that needs Bridge Mode / IP Passthrough enabled, or your ISP uses Carrier-Grade NAT (CGNAT in the 100.64.0.0/10 range). Check the WAN IP in your router's status page to confirm which one applies.

What is 'Full Cone NAT' on ASUS and Netgear routers, and should I enable it for gaming?

Full Cone NAT (RFC 3489 Endpoint-Independent Mapping) allows any external server to send UDP responses back through a port that your console has already opened outbound, whereas Symmetric NAT restricts replies to the single destination IP/port your console first contacted. Setting NAT Type from Symmetric to Full Cone on ASUS routers immediately fixes Nintendo Switch NAT Type D/F and Call of Duty Moderate NAT.

Why did my NAT type switch back to Moderate a few days after I forwarded ports?

If you forwarded ports to 192.168.1.150 without creating a static DHCP reservation (MAC-to-IP binding), your router's DHCP server likely assigned your console a different IP address (like 192.168.1.154) when its 24-hour lease expired. Lock the console's MAC address to a permanent IP in your router's DHCP reservation table.

Related Router Setup & Engineering Guides

• Verizon 5G Home Internet IP Passthrough & Bridge Mode Guide — Enable IP Passthrough (Bridge Mode) on your Verizon 5G Home Internet gateway (ASK-NCQ1338, ARC-XCI55AX, WNC-CR200A) at 192.168.1.1 to eliminate Double NAT.
• How to Set Up a Router — Set up a home or small office router from scratch: connect WAN/ONT cables, release ISP DHCP leases, configure WPA2/WPA3 WiFi, and harden admin access.
• DNS Settings on a Router — Configure router DNS settings using Cloudflare 1.1.1.1, Quad9 9.9.9.9, or Google 8.8.8.8. Understand WAN vs DHCP LAN DNS, DoH/DoT encryption, and DNS leaks.
• IPv6 Router Settings Explained — Configure IPv6 router settings for Comcast Xfinity, AT&T Fiber, and Verizon Fios. Set up Native DHCPv6-PD, SLAAC, /56 or /60 prefix delegation, and firewalls.