“NAT Type: Restricted” in Hytale means the game cannot currently establish its preferred direct inbound path to the computer hosting the world. It is usually a router, firewall, double-NAT, CGNAT, or managed-network problem—not proof that Hytale is offline or that your internet connection is slow. Start by saving Online Play again, enabling UPnP, allowing Hytale through the firewall, and rebooting the network. If the host is behind CGNAT or a network they do not control, use Tailscale, have another player host, or use a dedicated server.
Hytale’s official guidance is documented in Joining Friends. Hytale remains in Early Access, so networking labels and behavior may change.
What “NAT Type: Restricted” means
Network Address Translation (NAT) lets multiple devices in your home use one public internet address. Outbound connections are normally easy: your computer starts a connection and the router remembers where replies belong. Hosting is different. An outside player needs to reach your computer without first creating that connection, so the router must provide a usable mapping.
In Hytale, the Restricted label describes the connection path available for friend-hosted multiplayer. It does not measure download speed, and NAT labels are not universal across games. A restricted host may see one or more of these symptoms:
#1 Best Overall
- Blazing-fast WiFi 7 boosts tri-band throughput up to 12000 Mbps with 320 MHz channels of 6 GHz band, Multi-Link Operation (MLO) and 4K-QAM
- Powerful wired network capacity of up to 20G with one 2.5G WAN port and seven 2.5G LAN ports.
- High-performance quad-core 2.0GHz CPU with robust cooling, 2GB RAM and eight internal antennas providing up to 3000 sq. ft. of range.
- Smart Home Master makes it easy to set up functional subnetwork (up to 3 SSIDs) for IoT devices and VPNs
- ROG-exclusive Gaming Network streamlines Triple-Level Game Acceleration setup and connections through convenient SSIDs
- No share code appears.
- A code appears, but the friend receives a timeout or failed-connection message.
- The host sees No UPnP.
- An invitation is visible but the friend cannot enter the world.
- A self-hosted dedicated server works locally but cannot be reached from outside.
The warning matters most to the person hosting a local world. A player may join someone else successfully even when that player could not host. Hytale tries available direct connection candidates, and one may work despite the Restricted status. Share codes can include local, public-IP, and VPN addresses, so send them only to trusted people.
Fastest fix sequence
1. Confirm the correct host and refresh Online Play
Only troubleshoot the computer whose world has joining enabled.
- Load the single-player world.
- Press Esc and choose Online Play.
- Enable Allow Other Players to Join.
- Click Save, wait for the status and code, and send the new code privately.
The friend joins from Servers → Join via Code, pastes the code, enters any password, and selects Connect. Saving again requests a fresh UPnP mapping and code.
2. Restart the game and network equipment
Exit Hytale, restart the host computer, reboot the modem and router, then reopen Hytale. Toggle Online Play off and on and click Save again. This can recover an expired or failed UPnP lease.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems3. Enable UPnP
In the router administration page, enable UPnP, Universal Plug and Play, or automatic port mapping. Apply the change, restart the router if requested, reopen Hytale, and save Online Play again. UPnP asks a router to create a mapping; it cannot overcome another router, CGNAT, or a network administrator blocking inbound traffic.
4. Allow Hytale through the firewall
In Windows Firewall, allow the Hytale application on your trusted Private network. A Public rule may be needed in some configurations, but do not expose the game broadly on untrusted networks. Check third-party antivirus or endpoint-security software too. Do not disable the firewall permanently.
Rank #2
- Beyond-fast WiFi 7 (802.11be) with new 320MHz channels in the 6 GHz band and 4096-QAM significantly increases network capacity and throughput, with speeds of up to 30 Gbps
- Multi-link Operation links to multiple bands at the same time to ensure stable internet connections and efficient data transfers
- Cutting-edge external dual-feeding antennas boost coverage by providing high efficiency and significantly enhanced signal strength
- Maximized wired connectivity and flexibility with dual 10G ports and quad 2.5G ports
- Triple-Level Game Acceleration - The GT-BE98 Pro boosts your PC gaming traffic every step of the way, from your PC gaming port all the way to the game server.
5. Try the other player as host
If one network is restricted and the other works, switching hosts is often the quickest solution. Move or copy a world only with backups and compatible versions; save files may be large or sensitive.
Find the underlying cause
Double NAT: two routers are routing
Common examples include an ISP gateway plus a personal router, a mesh system behind a gateway, or a travel router behind home Wi-Fi. UPnP may appear enabled on your router while the upstream device still blocks the path.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Put the ISP gateway in bridge or modem-only mode.
- Put the personal router in access-point mode.
- Connect the host directly to the primary router.
- If both routers must route, configure UPnP or forwarding on both; this is more error-prone.
A router WAN address that is private rather than publicly reachable is a strong clue. Hytale recommends enabling UPnP on all routers or connecting the computer to the main router.
CGNAT: the ISP shares one public IPv4 address
Carrier-grade NAT (CGNAT) places another translation layer between your router and the internet. Local port forwarding can be perfectly configured and still fail because the ISP does not send unsolicited inbound traffic to your connection.
Compare the router’s WAN/Internet address with the public address shown by an external IP-checking service. A mismatch can indicate CGNAT, an upstream router, or another translation layer. Hytale also suggests:
tracert -d 8.8.8.8Private addresses in early hops are a diagnostic clue, not proof; network layouts vary. Ask the ISP whether a public IPv4 address, static address, inbound service, or usable IPv6 is available. Otherwise use Tailscale, let a friend host, or use a dedicated server.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐑𝐞𝐚𝐝𝐲 𝐖𝐢-𝐅𝐢 𝟕 - Designed with the latest Wi-Fi 7 technology, featuring Multi-Link Operation (MLO), Multi-RUs, and 4K-QAM. Achieve optimized performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, and Samsung Galaxy S24 Ultra.
- 𝟔-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝐰𝐢𝐭𝐡 𝟔.𝟓 𝐆𝐛𝐩𝐬 𝐓𝐨𝐭𝐚𝐥 𝐁𝐚𝐧𝐝𝐰𝐢𝐝𝐭𝐡 - Achieve full speeds of up to 5764 Mbps on the 5GHz band and 688 Mbps on the 2.4 GHz band with 6 streams. Enjoy seamless 4K/8K streaming, AR/VR gaming, and incredibly fast downloads/uploads.
- 𝐖𝐢𝐝𝐞 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐰𝐢𝐭𝐡 𝐒𝐭𝐫𝐨𝐧𝐠 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐨𝐧 - Get up to 2,400 sq. ft. max coverage for up to 90 devices at a time. 6x high performance antennas and Beamforming technology, ensures reliable connections for remote workers, gamers, students, and more.
- 𝐔𝐥𝐭𝐫𝐚-𝐅𝐚𝐬𝐭 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐖𝐢𝐫𝐞𝐝 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 - 1x 2.5 Gbps WAN/LAN port, 1x 2.5 Gbps LAN port and 3x 1 Gbps LAN ports offer high-speed data transmissions.³ Integrate with a multi-gig modem for gigplus internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Managed networks and cellular connections
School, workplace, hotel, apartment, and mobile-hotspot networks may block peer-to-peer traffic or deny router access. Do not bypass institutional rules. Ask the administrator, use an approved overlay, switch hosts, or choose managed hosting. Cellular broadband commonly uses CGNAT.
VPN and IPv6 complications
A conventional privacy VPN can alter routes, firewall profiles, or UDP/QUIC handling and make hosting harder; it is not a universal NAT fix. Tailscale is different: it creates an encrypted network between participating devices. Hytale also notes that a working IPv6 path at both ends may succeed when IPv4 UPnP fails, but every endpoint, router, firewall, and ISP must support it.
Manual port forwarding
Friend-hosted local world
Do not assume this uses UDP 5520. Hytale’s Joining Friends guide says the local-world port can vary by session and instructs you to use the port displayed in Online Play.
- Reserve a stable local IP for the host in the router’s DHCP settings.
- Open Hytale’s Online Play screen and note its displayed port.
- Create a router rule for UDP, using that port externally and internally, targeting the reserved host IP.
- Save the router rule, re-save Online Play, generate a new code, and test from a genuinely external connection.
Forwarding cannot defeat CGNAT. Do not use DMZ mode as a shortcut, and do not forward unrelated ports.
Dedicated server
Hytale’s server manual documents a default bind address of 0.0.0.0:5520 and QUIC over UDP; TCP forwarding is not required. A custom port is selected with --bind.
java -XX:AOTCache=HytaleServer.aot
-jar HytaleServer.jar
--assets Assets.zipjava -jar HytaleServer.jar
--assets Assets.zip
--bind 3500For the default port, the manual gives these firewall examples:
Rank #4
- Tri-band 2.4GHz + 5GHz + 6GHz; latest WiFi 6E supports 8-streams on tri-band simultaneously, up to 6.6Gbps speed
- AI QoS; satisfies all users' needs by automatically prioritizing data packets
- Powerful processor; 1.8 GHz quad core processor delivers ultra fast and reliable connections
- Mystic light; sync RGB light effects with mystic light compatible products
- Game accelerator; provides an uninterrupted WiFi connection for immersive gaming experiences
New-NetFirewallRule `
-DisplayName "Hytale Server" `
-Direction Inbound `
-Protocol UDP `
-LocalPort 5520 `
-Action Allowsudo iptables -A INPUT -p udp --dport 5520 -j ACCEPTsudo ufw allow 5520/udpSelf-hosted servers still need a public route, firewall rules, authentication, and matching versions. The current manual requires Java 25 and at least 4 GB RAM, and says the client and server must use the exact same protocol version.
Use Tailscale when forwarding is impossible
Tailscale can avoid inbound router forwarding by creating an encrypted overlay between the host and friends. It is especially useful with CGNAT, double NAT, cellular internet, or a router you cannot administer. Hytale describes it as free for personal use.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Install Tailscale on the host and each friend’s computer.
- Sign in and place all devices in the same Tailscale network.
- Confirm the devices can see one another.
- Restart Hytale if necessary.
- Save Online Play again and send the new code privately.
Tailscale does not change the router’s NAT label. Direct peer-to-peer connectivity may fail and use a relay, adding latency. Everyone must install and authenticate the software.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When a dedicated server is better
Choose a dedicated server when the world must remain online without the original host, several players will join, the host’s upload connection is weak, or you need administration, backups, moderation, and plugins. A hosted provider avoids your home router but introduces recurring fees and vendor maintenance; prices, locations, limits, and Hytale availability change, so check each provider’s current offer.
Hypixel Studios lists Launch Verified providers including Nitrado, Apex Hosting, GPORTAL, Shockbyte, and Dathost. Self-hosting can use existing hardware but requires ongoing Java, security, firewall, backup, bandwidth, and update management.
Troubleshooting checklist
- You are troubleshooting the actual world host.
- Online Play is enabled, saved, and has a newly generated code.
- UPnP is enabled on the router that actually routes traffic.
- Hytale and security software allow the required traffic.
- The host is not behind an unaddressed second router.
- The router WAN address is publicly reachable, or you have chosen an overlay/server alternative.
- Manual forwarding uses the displayed local-world UDP port, or UDP 5520 for the dedicated-server default.
- The test friend is outside the host’s LAN.
- A consumer VPN is not disrupting the route.
- Client and dedicated-server protocol versions match exactly.
For official procedures, see Hytale Joining Friends and the Hytale Server Manual.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteBest Value
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Frequently Asked Questions
Does Restricted NAT prevent Hytale multiplayer entirely?
No. It primarily warns about hosting reachability. Another connection candidate may work, and you may still join someone else’s world.
Is Hytale’s port always 5520?
No. A friend-hosted local world can use the port shown in Online Play. UDP 5520 is the documented default for a dedicated server.
Can port forwarding fix CGNAT?
No. CGNAT is an upstream ISP translation layer. Request a public address or use Tailscale, another host, or a dedicated server.
Should I disable my firewall?
No. Allow Hytale specifically on the appropriate network profile instead of leaving the firewall disabled.
Can a mobile hotspot host Hytale?
Often not directly because cellular providers commonly use CGNAT. Tailscale, a different host, or dedicated hosting is usually more practical.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
