CGNAT (carrier-grade NAT) is a technique ISPs use to share a single public IPv4 address between many customers by performing network address translation inside the provider's network, not just in your home router. It saves scarce IPv4 addresses, but it means you have no public IPv4 address of your own, so port forwarding and hosting servers from home stop working.
If you have ever followed a port forwarding guide perfectly and still could not reach your game server, camera or home lab from outside, CGNAT is one of the most likely explanations. This guide explains how it works, how to check for it and what you can do about it.
Why CGNAT exists
IPv4 has only about 4.3 billion addresses (2 to the power of 32), and the regional internet registries ran out of freely available blocks during the 2010s. ISPs that keep adding customers need some way to connect them without buying ever more addresses on the transfer market. The long-term answer is IPv6, but until every website supports it, customers still need IPv4 connectivity. CGNAT stretches the provider's existing IPv4 pool by letting dozens or hundreds of subscribers share each public address.
How CGNAT works
A normal home connection already uses NAT once: your router translates your devices' private addresses, like 192.168.1.20, to the single public address the ISP gave the router. With CGNAT there is a second layer of translation, which is why the setup is sometimes called NAT444 (three IPv4 address realms joined by two NATs):
- Your laptop at
192.168.1.20sends a packet to a website. - Your home router translates it to its WAN address, which is not public. It is something like
100.72.15.9, from a special shared range. - A large NAT device in the ISP's network translates it again, to a genuinely public address such as
203.0.113.45, and assigns it a port from a range reserved for your connection. - The website sees
203.0.113.45. So do the websites visited by every other customer sharing that address.
Replies come back to the carrier NAT, which looks up its translation table and forwards each packet to the right customer. Connections you start work normally. Connections that start from the internet have nowhere to go, because the carrier NAT has no entry telling it which of its many customers should receive them.
The 100.64.0.0/10 shared address space
To avoid clashes with the private ranges customers use at home, RFC 6598 reserved a dedicated block for the link between customers and the carrier NAT: 100.64.0.0/10, covering 100.64.0.0 to 100.127.255.255 (4,194,304 addresses). It is called shared address space. Addresses in it are not routable on the public internet, and they should only appear inside an ISP's network.
Some providers use ordinary private ranges such as 10.0.0.0/8 for this purpose instead, so a CGNAT WAN address does not always start with 100..
Mobile networks and DS-Lite
Mobile carriers use CGNAT almost universally for IPv4. Many fixed-line ISPs that have moved to IPv6 use DS-Lite (Dual-Stack Lite, RFC 6333), where your router has a native IPv6 connection and tunnels IPv4 traffic to a carrier NAT. With DS-Lite, your IPv6 connectivity is fully public, but your IPv4 is shared in the same way as with NAT444.
How to tell if you are behind CGNAT
- Find your public IP. Open the ToolsForAnyone homepage and note the IPv4 address shown.
- Find your router's WAN IP. Log in to your router and look at the internet or WAN status page for the IPv4 address it received from the ISP.
- Compare. If the two match, you have your own public IPv4 address. If the router shows an address in
100.64.0.0/10, or a private range like10.x.x.x,172.16.x.x–172.31.x.xor192.168.x.x, something upstream is translating it, and that is almost always CGNAT. - Check the address type. Paste the router's WAN address into our IP type checker, which identifies shared, private and public ranges.
A traceroute can give a hint too. If the first hop after your router is in 100.64.0.0/10, you are probably behind a carrier NAT, although some ISPs use that range for internal routers as well, so treat it as a clue rather than proof.
What CGNAT breaks and what it does not
| Activity | Behind CGNAT |
|---|---|
| Browsing, streaming, email, video calls | Works normally |
| Port forwarding on your router | Has no effect from the internet; the carrier NAT drops inbound connections |
| Hosting a game server, website or Plex from home | Not reachable over IPv4 without a workaround |
| Peer-to-peer gaming and voice | Usually works through relays, but consoles may report a strict or moderate NAT type |
| Remote access to cameras or NAS by IP | Fails unless the device uses a cloud relay |
| Dynamic DNS | Points to the shared address, which does not reach you |
| IP reputation | Shared with other users; you may see more CAPTCHAs or inherit blocks caused by others |
You can confirm the port forwarding symptom with our open port checker. If a port is open on the router and a service is listening, but the checker still reports it closed, CGNAT is a strong suspect.
How to work around CGNAT
Ask your ISP for a public IPv4 address
This is the cleanest fix. Many ISPs will move you out of CGNAT on request, sometimes free, sometimes for a fee, and some only on business plans. Ask specifically for "a public IPv4 address" or "to be removed from CGNAT". A static IP add-on also solves it, because static addresses are always public.
Use IPv6
If your ISP provides IPv6, each device gets a globally routable address and there is no NAT. You can allow inbound connections by opening a port in the router's IPv6 firewall. The limitation is that the person connecting to you must also have IPv6.
Use an outbound tunnel or mesh VPN
Because CGNAT only blocks connections that start from outside, tools that open an outbound connection from your network can carry traffic back in. Options include mesh VPNs that connect your devices directly or through relays, reverse-proxy tunnel services for publishing web apps, and remote access features built into NAS and camera software.
Rent a server or VPN with port forwarding
A small virtual server with a public IP can act as a front door: your home machine keeps a VPN tunnel open to it, and the server forwards chosen ports down the tunnel. Some commercial VPN providers offer port forwarding as a feature, which achieves the same result.
UPnP and PCP
UPnP on your home router cannot open ports on the carrier's NAT. The Port Control Protocol (PCP, RFC 6887) was designed to let customers request mappings on a carrier NAT, but few consumer ISPs expose it, so do not count on it.
Frequently asked questions
Is CGNAT bad for gaming?
For playing online it is usually fine, because game services relay traffic or use NAT traversal. It matters if you want to host matches or a dedicated server, or if your console reports a strict NAT type that limits who you can join. Asking for a public IP or using IPv6 resolves it.
Does CGNAT make me anonymous?
Not really. Websites see an address shared by other customers, but your ISP logs which customer used which address and port at what time, so activity can still be attributed to you when the ISP is legally required to do so.
Is 100.64.0.0/10 a private IP range?
Not officially. RFC 1918 defines the private ranges; 100.64.0.0/10 is "shared address space" from RFC 6598, reserved for carrier networks. Like private addresses, it is not routable on the public internet, and you should not use it on your home network.
Will a VPN get me out of CGNAT?
A normal VPN changes your visible IP for outbound traffic but does not let inbound connections reach you. You need a VPN that offers port forwarding or a dedicated IP with open ports.