Overview

NAT Type 3 (Strict) on a gaming console connected to an Optical Network Terminal (ONT) typically means the console cannot receive inbound connections, which breaks party chat, matchmaking, and peer-to-peer multiplayer. The root cause is almost always a combination of carrier-grade NAT (CGNAT), double NAT behind the ONT/router, or missing UPnP/port-forwarding rules. This FAQ answers the highest-intent technical questions from network engineers and advanced home users who need a definitive, step-by-step fix.

Frequently Asked Questions

Q1: What is the fastest way to fix NAT Type 3 (Strict) on a gaming console connected to an ONT?

The fastest fix is to enable UPnP on the router behind the ONT and reboot the console; if that fails, assign a static IP to the console and place it in the router's DMZ. This eliminates the inbound port blocking that causes Strict NAT. If the ONT itself performs routing, bridge it and let your own router handle PPPoE and NAT.

Q2: Why does my ONT cause NAT Type 3 even when my router shows NAT Type 2?

A second layer of NAT inside the ONT creates double NAT, which forces the console into Strict NAT even if the downstream router reports Open or Moderate. The ONT is acting as a router, not a pure media converter, so both devices are translating addresses. Bridge the ONT or put the console's router in the ONT's DMZ to restore a single NAT layer.

Q3: Which ports must I forward on my router for NAT Type 2 (Open/Moderate) on PlayStation and Xbox?

For PlayStation, forward TCP 80, 443, 3478-3480 and UDP 3478-3479, 49152-65535; for Xbox, forward TCP 3074 and UDP 88, 500, 3074, 3544, 4500. These are the exact ports Sony and Microsoft use for P2P matchmaking and party chat. Forward them to the console's static IP and disable any conflicting UPnP mappings.

Q4: Does carrier-grade NAT (CGNAT) on the ONT uplink make NAT Type 3 unavoidable?

Yes, CGNAT on the ISP side makes NAT Type 3 unavoidable because you do not control the public IP address. You cannot port-forward through CGNAT, so the only fixes are requesting a public/static IP from your ISP or using a VPN with port forwarding. Check your ONT WAN IP: if it is in 100.64.0.0/10, you are behind CGNAT.

Q5: Should I use PPPoE passthrough or IPoE on the ONT to fix Strict NAT?

PPPoE passthrough is preferred when your ISP authenticates via PPPoE, because it lets your own router hold the public IP and manage NAT directly. IPoE (DHCP) passthrough works if the ISP uses DHCP and the ONT is fully bridged. In both cases the goal is the same: only one device performs NAT.

Q6: How do I verify that UPnP is actually working on my router after the ONT?

Check the router's UPnP mapping table while the console is running a network test; you should see temporary mappings for the console's IP on UDP 3074 or 3478-3479. If the table stays empty, UPnP is disabled, blocked by the ONT's firewall, or unsupported. Enable UPnP, disable the ONT firewall for the console's MAC, and retest.

Q7: What ONT configuration changes reduce NAT Type 3 without breaking VoIP or IPTV?

Set the ONT to bridge mode for the internet VLAN while leaving the VoIP and IPTV VLANs untouched, then run PPPoE or DHCP on your own router. This preserves triple-play services and removes the ONT's NAT layer. If the ISP locks bridge mode, use DMZ on the ONT pointing to your router's WAN IP instead.

Q8: Can a VPN or static public IP from my ISP permanently eliminate NAT Type 3?

Yes, a static public IP or a VPN with dedicated port forwarding permanently eliminates NAT Type 3 because the console gains a directly reachable public endpoint. A static IP from the ISP is the cleanest option; a VPN adds latency but works when CGNAT cannot be removed. After either change, re-run the console's network test to confirm NAT Type 2.