OpenWrt NAT type & Fullcone — P2P direct-connect in one click
P2P apps (game hosting, PT/PT, cloud sync, voice) fail when your router gives them a symmetric NAT. Fullcone NAT is the fix. NetSteer turns it on for the devices that need it — without DMZ-ing your whole network. As of 2026-11.
The four NAT types, worst to best
| Type | What it does | P2P result |
|---|---|---|
| Symmetric | New port per destination | Almost always blocked |
| Restricted cone | Same port per source, filtered by dest | Sometimes |
| Fullcone | One mapping for all destinations | Works (best) |
| Open (no NAT / CGNAT off) | Public IP, port open | Works (best) |
The catch: you need a public IP
No NAT trick beats carrier-grade NAT (CGNAT). If your ISP gives you a shared 100.64/8 or a 4G-style NAT, no router setting will make P2P work — you need a public IP from your ISP (or a VPN/exit with a public one). NetSteer's health check detects whether you are behind CGNAT and tells you before you waste time.
How NetSteer does it
Pick the device (game console, PT box, the laptop that syncs), and NetSteer creates a Fullcone equivalent mapping just for it — the "DMZ-type" option. ICE success rates go up, game hosting and P2P transfer rates climb, and the rest of your network is left alone. The firewall path must allow the port range; the one-key check verifies it.
See the SQM/CAKE and RPS/IRQ guides for the other two halves of the NetSteer story.
FAQ
What is a NAT type and why does it matter?
Your router maps the LAN address of a device to a public IP:port. The "type" (Fullcone, Restricted, Symmetric) describes how strictly it tracks flows. Symmetric NAT is the worst — it uses a different public port for every new destination, which breaks P2P and voice calls. Fullcone is the best — a single mapping works for any destination, so two devices can find each other.
How do I get Fullcone NAT on OpenWrt?
You need your ISP to hand you a real public IP (not behind CGNAT/carrier-grade NAT — common on 4G and some fibre plans). Then the router must create Fullcone mappings. NetSteer enables a Fullcone-equivalent (DMZ-type) mapping for selected devices so a game console or a PT box gets a clean public path without exposing the whole network.
Is Fullcone NAT the same as putting a device in a DMZ?
It is functionally close — a Fullcone mapping for a device is like a narrow DMZ: the whole port range for that device is forwarded, but only for that device. That is why NetSteer applies it to specific devices you pick, not the entire LAN.