What Is CGNAT?

Learn how carrier-grade NAT shares public IPv4 addresses, why it affects port forwarding, and how to identify common CGNAT signs.

Carrier-grade NAT, often shortened to CGNAT, lets an internet provider place many customers behind shared public IPv4 addresses. It helps conserve limited IPv4 space but changes how inbound connections reach your network.

CGNAT is common on mobile, wireless, satellite, and some residential broadband services. Normal browsing usually works, while self-hosting, peer-to-peer connections, gaming, and remote access can require alternatives.

How CGNAT works

Your router receives an address that is not directly reachable from the public internet. The provider performs another layer of translation before traffic reaches the shared public IPv4 address.

Common CGNAT address range

The shared address space 100.64.0.0/10 is reserved for provider NAT, although providers may use other internal arrangements. A mismatch between your router WAN address and visible public IP is another clue.

Why port forwarding may fail

Your home router controls only the first NAT layer. The provider controls the upstream translation, so unsolicited inbound traffic cannot be forwarded to your device in the usual way.

Practical options

Ask the ISP for a public IPv4 address, use IPv6 when available, use a relay or tunnel service, or host the public endpoint on a cloud server.

Frequently Asked Questions

Is CGNAT bad?

It is efficient for providers and usually fine for browsing, but it can complicate inbound connections.

How can I check for CGNAT?

Compare the WAN address in your router with the public IP shown by an online checker and look for shared or private ranges.

Does IPv6 remove the need for CGNAT?

IPv6 provides much more address space, although firewall rules and provider design still control reachability.