NAT Type Check: What Your Router Does to Outbound Connections

Run a local STUN probe to see the public address your router presents, whether translation is happening at all, and when the result should honestly say not measurable.

By Net Insight Published 2026-09-17 Updated 2026-09-17

What translation is, and why it exists

Home and office networks do not give every device a public address, because there are not enough. Instead the router holds one public address and rewrites outbound connections so that replies can be matched back to the device that started them. That rewriting is network address translation, and it is why a device inside a network can reach the internet while being unreachable from it.

The consequence follows directly from the mechanism. Translation was designed to allow conversations the inside starts, and it makes conversations the outside starts difficult, because there is no mapping until something inside creates one. Every consumer network optimises for the first case and treats the second as a problem to be worked around.

How this check works, stated plainly

The browser is asked to describe how it could be reached, using the same mechanism it uses to establish peer-to-peer connections. That produces a list of candidate addresses: addresses inside your own network, and — if a public server confirms the mapping — the address the outside world sees. The public address is obtained from a STUN server, which is a server whose only job is to tell a client what address and port its request appeared to come from.

Two servers are queried rather than one, which is what makes it possible to say anything about translation behaviour rather than only about the fact that translation exists. The probe runs in your browser and nothing about it is sent to this site. The report also states whether the browser withheld local addresses, which recent browsers do deliberately as a fingerprinting defence; that is a working privacy feature rather than a fault.

Reading the four outcomes

The outcomes are listed in order of how much they can be relied on, and the honest case comes first. When no public address is returned, nothing about translation can be concluded. The cause is usually that the network blocks the protocol the probe relies on, or that a proxy or browser extension intercepts the session. A restrictive translation is one possible reason and the tool does not present it as the only one.

When the public address matches one of the device’s own addresses, no translation is happening on that path. This is normal where a device holds a public address directly, such as on some mobile networks and on servers with a routed address.

When a public address appears while local addresses do not, translation is happening and its type is not observable from this test, because the browser withheld the half of the comparison that would reveal it. The report states that limitation rather than inferring a type from a single data point.

The ordinary case is that the two differ, which means translation is happening in the usual way. Distinguishing the behaviour that breaks peer-to-peer connections from the behaviour that does not requires the same session to appear with different public port numbers at different servers, and that is the reason two servers are queried.

Why this matters outside gaming

The stereotype is that restrictive translation is a gaming problem, and it is true that games and voice calls notice it first because they are the applications that try hardest to connect directly. The same characteristic appears anywhere two devices behind different networks attempt to speak without an intermediary.

Ordinary browsing never encounters it. A browser initiates connections outward, so translation is transparent and no configuration change will make browsing faster or more reliable. Anyone who has been told to change a router setting to fix slow web browsing has been given advice about the wrong layer.

Where the underlying address is the actual question, the family this connection used is reported by the IPv6 test, and the network that owns the address is reported by the ASN lookup.

What this test does not tell you

It does not test reachability from the internet. Whether a port is open depends on the router’s firewall and on the provider’s policy, and no probe initiated from inside the network can determine it. Testing that requires a connection from outside, which is a different kind of experiment.

It cannot be turned into a security verdict. Translation is not a firewall: it hides devices as a side effect of how it works, but it does not inspect traffic and it does not stop a device from making an outbound connection to anything. Calling a restrictive translation “secure” and a permissive one “insecure” is a category error.

It says nothing about whether your connection is being observed or filtered, and it does not identify your internet provider. The signals that describe how a network treats your traffic are covered by VPN and proxy detection explained, and the ownership question is answered separately by the IP purity check and the IP reputation check, each of which names its own source rather than presenting a composite verdict.

Keep this setup

Save the settings to your Sitefarm account. Uploaded files and generated results are not stored.

Questions worth asking

Why does the test sometimes report no public address at all?

Because the probe depends on UDP reaching a server outside your network. A network that blocks it, or a proxy or extension that intercepts the session, leaves nothing to report. That is a different finding from having restrictive translation, and the tool says so instead of guessing.

Does a strict NAT type break browsing?

No. Outbound browsing works through ordinary translation without difficulty, because your device initiates every connection. A restrictive translation affects inbound connections and peer-to-peer sessions, which is why it shows up in games and voice calls rather than in a browser.

What is symmetric NAT?

Translation that maps the same internal address and port to a different public port for each destination. A peer that learned one mapping cannot use it to reach you. It is why some networks work for peer-to-peer traffic and some do not.

Is this the same as the NAT type shown by a game console?

It is related but not identical. Console labels such as open, moderate and strict are that platform's summary of its own reachability test. This check reports what happened to a session with a public server, which is a narrower and more reproducible statement.

Does this test reveal my private addresses?

It runs entirely in your browser and sends nothing to this site. Modern browsers also replace local addresses in some candidate types with random names, which the report shows rather than silently treating as absent.