Get One Month of Starlink FreeSPECIAL OFFER: GET A FREE MONTH OF STARLINK >
Modern gaming setup with a console controller on a desk

Starlink NAT Type on PlayStation and Xbox: Diagnose Strict or Moderate Multiplayer

Tips & Tricks

Back to Tips & Tricks

Starlink can handle online gaming well, but a PlayStation or Xbox may still report a Strict, Moderate or Type 3 NAT. That warning is not always a Starlink fault, and changing random router settings can make the network less secure.

This guide helps you separate a local double-NAT problem from Starlink's provider-side CGNAT, improve the setup where you can, and choose a sensible next step when the upstream address cannot be changed at home.

Independent guide: Starlink Tips is not part of Starlink, Sony or Microsoft. Router menus, console software, Starlink hardware, plans and network behaviour can vary by model, country and software version.

The short answer

Work through the checks in this order:

  1. Test the console on Ethernet or a strong, nearby Wi-Fi connection.
  2. Confirm that only one device in your home is acting as the main router.
  3. If you use a second router, remove local double NAT by choosing access-point mode or Starlink bypass mode.
  4. Use UPnP only on the one router that manages the console network, and only if you accept its security trade-off.
  5. If the router's WAN address is in the shared 100.64.0.0 to 100.127.255.255 range, you may be behind provider CGNAT. A port-forwarding rule on your own router cannot remove that upstream layer.
  6. Do not put the console in a permanent DMZ or forward a large block of ports just to change the label.

A console can still play online behind CGNAT. The practical symptom is usually a game or party-chat feature that cannot establish the preferred peer-to-peer path, rather than a complete loss of internet access.

Check the connection before changing NAT settings

NAT warnings can be caused or amplified by a weak local link, a busy network or an outage. Start with a clean test.

  • Open the Starlink app and check for active outages, obstruction warnings and equipment alerts.
  • If possible, connect the console by Ethernet. Otherwise test it close to the router on the strongest available Wi-Fi band.
  • Pause game downloads, cloud backups, streaming uploads and other large transfers.
  • Restart the console once, then run its built-in network test.
  • Test the same game or party feature twice. A single failed matchmaking attempt does not prove a NAT problem.
  • Note the console's NAT result, download and upload result, and whether the failure affects every game or only one service.

On PlayStation, the result is normally shown under Settings > Network > Connection Status after running Test Internet Connection. On Xbox, use Settings > General > Network settings, then Test NAT type or Test multiplayer connection. Menu names can move after console updates, so use the closest current label on your system.

Find out whether you have double NAT

Double NAT means that two routers are translating traffic inside your home. A common layout is:

Starlink dish -> Starlink router -> third-party router -> console

It is easy to create this layout accidentally when adding a mesh system, gaming router or firewall appliance.

Look at the WAN, Internet or external IPv4 address on the third-party router:

  • An address such as 192.168.x.x, 10.x.x.x or 172.16.x.x through 172.31.x.x usually means the router is receiving a private address from another router.
  • An address in 100.64.0.0 through 100.127.255.255 commonly indicates a provider-shared CGNAT range.
  • Compare the router's WAN address with the public IPv4 shown by an external IP-check service. A mismatch is a clue that another translation layer exists, although VPNs, privacy relays and other gateways can also change the result.

If the console is connected directly to a single Starlink router, there may be no local double NAT to remove. If you have a second router, decide which device should own Wi-Fi, DHCP, firewall rules and routing before you change anything.

Fix local double NAT

Choose one of these layouts. Do not combine them.

Option 1: Keep the Starlink router in charge

This is the simplest arrangement.

  1. Connect the console directly to the Starlink-managed network.
  2. Put the second device into Access Point, Bridge or equivalent mode if you still need it for extra Wi-Fi coverage.
  3. Leave DHCP and routing enabled on the Starlink router.
  4. Restart the console and run its network test again.

The exact cable and port used by access-point mode depend on the equipment. Follow the manufacturer's current instructions rather than guessing.

Option 2: Let your own router manage the home network

Use this when you need advanced firewall, mesh, VPN or traffic-management features on your own router.

  1. Confirm that your Starlink kit provides the wired connection your router needs. Some kits require an Ethernet Adapter; others expose Ethernet elsewhere in the system.
  2. Connect the Starlink Ethernet path to the WAN port of your router.
  3. Enable Starlink Bypass Mode only when your kit and layout support it.
  4. Configure your router to obtain its WAN address automatically unless its documentation says otherwise.
  5. Put Wi-Fi, DHCP, firewall rules and device reservations on your own router.
  6. Reconnect the console to the new network, then test again.

Bypass mode can disable Starlink router Wi-Fi and change how the Starlink app reaches the hardware. Record your working settings first, and do not factory-reset the system as a first step.

Option 3: Keep two routed networks on purpose

Two routed networks can be deliberate, but they make console discovery, UPnP, port forwarding and troubleshooting harder. If you keep this design:

  • Use different private address ranges on the two routers.
  • Keep the console and the router running UPnP on the same routed network where possible.
  • Document which router owns each rule.
  • Expect some games and party-chat systems to report a less favourable NAT result.
  • Avoid adding a third routing layer just to improve coverage.

For an ordinary home network, one main router plus access points is usually easier to operate.

Use UPnP carefully

UPnP lets a game or console request temporary port mappings from the router. It can improve convenience, but it also lets devices on that network ask for inbound mappings automatically.

If you choose to test it:

  1. Enable UPnP on the router that actually provides the console's gateway.
  2. Disable competing UPnP services on an upstream or second router where your layout allows.
  3. Restart the router and console.
  4. Run the console's NAT and multiplayer tests again.
  5. Remove stale mappings or turn UPnP off if you do not trust every device on the network.

UPnP cannot create an inbound path through Starlink provider CGNAT. It only changes mappings on the routers you control.

When port forwarding will not fix it

Traditional port forwarding needs an inbound path to your router. If the router's WAN address is in the shared 100.64.0.0/10 range and does not match the public address seen from the internet, Starlink or another upstream provider is translating traffic before it reaches your home.

In that situation:

  • A port-forwarding rule on the console router can be correct and still fail.
  • Forwarding the same port on two local routers does not remove provider CGNAT.
  • A port checker may report closed because the provider-side layer cannot deliver the request.
  • Changing DNS will not change the NAT path.
  • A permanent DMZ setting does not bypass provider CGNAT and exposes the console more broadly than necessary.

Some Starlink plans or service types may offer a public IPv4 option in some markets. Check the IP policy or plan details attached to your own account rather than relying on a setting described for another country. A public address may still be dynamic, and it is not a security feature by itself.

If you use a public IPv4 option, keep the router firewall enabled and test one service at a time. The console or game must still be listening correctly, and the game service may use more than one protocol.

What about IPv6 and VPNs?

IPv6 can provide a different path, but only when Starlink, your router, the console and the game all support it correctly. Keep the router firewall enabled and confirm that inbound traffic is filtered as intended. Do not disable the firewall just to make a test succeed.

A VPN is not an automatic NAT fix for gaming. Many consumer VPNs add latency or give the console an even less useful NAT result. Consider one only when the provider documents a suitable router setup, any required port-mapping feature is available to you, and you have measured the effect on the games you actually play.

For most households, fixing local double NAT and improving the console's local connection is the better first move. If the remaining issue is provider-side CGNAT, a public-IP option, IPv6 test or a supported gaming network service may be worth comparing, but each has trade-offs.

PlayStation and Xbox troubleshooting checklist

Use this short sequence after every network change:

  • Check the Starlink app for service or equipment alerts.
  • Test the console on Ethernet or close to the router.
  • Pause large downloads and uploads.
  • Confirm only one router is doing the main NAT and DHCP work.
  • Check the third-party router's WAN address.
  • Test UPnP on that one router, if you accept the risk.
  • Restart the Starlink system, router and console in that order.
  • Run the console's internet, NAT and multiplayer tests.
  • Try a second game or party-chat feature.
  • Check the game's service status before changing more settings.
  • Remove temporary rules that did not help.

If the console still reports Strict or Type 3 but online play works, treat the label as a limitation to monitor rather than a reason to expose the network. If a specific game cannot join friends, compare the result after removing local double NAT and then check that game's current support guidance.

Avoid these common mistakes

  • Do not forward every port to the console.
  • Do not leave the console in DMZ as a permanent solution.
  • Do not enable UPnP on several routers and assume the mappings will pass through cleanly.
  • Do not change router mode, DNS, Wi-Fi hardware and port rules all at once.
  • Do not factory-reset Starlink equipment before recording the current settings.
  • Do not assume a moderate or strict label proves that Starlink service is down.
  • Do not assume a public IP automatically makes peer-to-peer gaming safe.
  • Do not use a VPN without measuring latency, packet loss and the resulting NAT type.

Bottom line

Start by proving whether the problem is local. A second router in router mode can create double NAT, and that is often fixable with access-point mode or a supported Starlink bypass layout. If the WAN address remains in a provider-shared range, home port forwarding cannot remove Starlink's CGNAT. Keep the network simple, use UPnP cautiously, and choose a public-IP, IPv6 or gaming-service option only when the specific game needs it.

For background, see Starlink Double NAT: How to Diagnose It and Pick the Right Fix, Starlink CGNAT and Port Forwarding: Remote Access Options, Does Starlink Provide a Static IP? Public IP, CGNAT and Safe Alternatives and Starlink QoS: How to Prioritize Calls and Gaming on a Busy Network.

Get One Month of Starlink Free

Order through my referral link and activate your service. Your second month of Starlink service will be free. Current terms are shown at checkout.

Claim Your Free Month

Starlink Tips is independent and may receive a referral reward. Check the offer shown for your order.