CGNAT in one paragraph

Your home router already uses NAT to let every device in the house share one public IP address. Carrier-grade NAT adds a second layer at the provider: instead of giving your router its own public IPv4 address, the provider gives it a private one and then shares a single public address among many customers. Your traffic is translated twice before it reaches the internet.

Providers use CGNAT because the world ran out of new IPv4 addresses years ago, and buying more is expensive. Mobile networks almost always use CGNAT, and many fibre, cable and fixed-wireless providers do as well, especially newer ones.

For browsing, streaming and most apps, CGNAT is invisible. The problems appear when something on the internet needs to connect into your home.

Signs you are behind CGNAT

Port forwarding rules on your router do nothing. Hosting a game server, Plex or a home camera from outside fails. Online games report a “strict” or “type 3” NAT. Some websites show more CAPTCHAs because many customers share your address and one of them may have triggered abuse filters.

You may also be blocked or rate-limited by services that ban an IP after suspicious activity, because the ban affects everyone on the same shared address.

  • Port forwarding has no effect.
  • Remote access to home devices fails.
  • Games report strict or moderate NAT.
  • Frequent CAPTCHAs or shared-IP blocks.

How to check if you are behind CGNAT

Compare two addresses. First, open your router’s admin page and find the WAN or Internet IP address. Second, open an IP lookup page and note the public IP shown there. If the two are the same, you have your own public IPv4 address. If they differ, there is another NAT layer between your router and the internet.

A WAN address in the range 100.64.0.0 to 100.127.255.255 is a clear sign: that block is reserved specifically for carrier-grade NAT. A WAN address starting with 10., 172.16 to 172.31 or 192.168 also means your router is behind another NAT, either the provider’s or a second router in your home.

A traceroute can confirm it. If one of the first hops after your router is a 100.64.x.x address, your traffic passes through the provider’s NAT.

Router WAN address versus public IP
Router WAN IP:      100.72.18.44     <- shared address space (CGNAT)
IP lookup result:   203.0.113.90
Result: behind carrier-grade NAT

How to work around CGNAT

The simplest fix is to ask your provider. Many will move you off CGNAT on request, sometimes for free and sometimes for a monthly fee for a static or public IPv4 address. Mention that you need port forwarding for gaming or remote access.

IPv6 is the long-term fix. If your provider supports it, every device can get a globally reachable IPv6 address, and incoming connections can work through the router’s IPv6 firewall rules instead of port forwarding. Check whether your connection already has IPv6.

Without help from the provider, use outbound-connection tools. Mesh VPN services, cloud tunnels and remote-access apps connect out to a relay or peer, so they work behind any NAT. A VPN provider that offers port forwarding is another option.

  1. Ask the provider for a public or static IPv4 address.
  2. Use IPv6 if available.
  3. Use a mesh VPN or cloud tunnel for remote access.
  4. Choose a VPN that supports port forwarding.

Does CGNAT make you more private?

Slightly, in one narrow sense. Because many customers share one public address, websites cannot tell from the IP alone which household a visit came from. But your provider keeps logs that map connections to customers, so CGNAT does not provide anonymity.

The trade-off is reputation: if someone else on your shared address misbehaves, you may see the same blocks and CAPTCHAs they triggered.

IP geolocation for CGNAT addresses often points to the provider’s regional gateway, which can be a different city from where you actually are.