'NAT failed' and party chat that drops: the router setting games actually need

Console and PC gaming keeps producing the same ritual: a voice chat that won't connect, a NAT type that reads Strict, and a thread of advice that either ignores the cause or tells you to DMZ your machine into the public internet. This desk's version in one page, because the fix is usually smaller than the lore and the non-fix is usually closer.

NAT, in the one paragraph that matters

Your router holds one public address and hands private ones to the devices inside, rewriting every outbound connection through that shared number and keeping a translation table so replies find their way back - which is why connections you start always work, and connections started to you never do: there's no table entry for a stranger to fit into. Game chat is the stranger: voice traffic arrives at your public address uninvited, and whether it gets in depends on how the router handles its entries. The Open/Moderate/Strict grade is mostly UDP behaviour - how long idle voice mappings survive and whether the device keeps them refreshed - and everything on this page follows from that single mechanism.

The tools, by risk, not by power

• UPnP is the console politely asking the router to open what it needs and close it after - the right tool for a gaming house with trusted firmware and a guest network apart; it is also every router-advertised "smart home friendly" trap, since malware asks with the same mouth. Turn it on knowingly, not by default.
• Port forwarding is the manual version for one known game and one device: the game lists the ports, you point them at the console's reserved address - the router's DHCP reservation (the printer guide's trick) keeps the target from wandering. Permanent, transparent, and safe enough for chat traffic; it cannot fix a title whose ports the ISP blocks outright.
• DMZ forwards everything unclaimed at one machine - it works the way a broken window works. The desk files it here only so the warning is on the same page: never on a PC; never without understanding the word "everything".

The ceiling no router setting beats: CGNAT

Check the router's WAN IP (its status page): if it starts 100.64-127 or otherwise falls in 10/8 or 172.16-31, your ISP has put you behind its own shared address - carrier-grade NAT - and your "public" port-forward lands on a wall inside the ISP's network. No setting on your box survives that; the voice traffic simply loses its relay negotiation and Strict is the honest weather report. The remedies are real but upstream: ask the ISP for a public IP or static IP tier (some grant it for a line-item's price, others only sell business), use platforms whose servers do the relaying anyway (Xbox and PlayStation ship relay fallbacks that mostly work - Moderate is not a death sentence), play on IPv6 where the ISP routes it end-to-end, and for PC-only houses, the wired option: a mobile-data game-day is the desk's unglamorous last rung.