What is CGNAT, and how do you know if you are behind it?

Your home router already performs network address translation: every device inside gets a private address such as 192.168.1.20, and the router rewrites outgoing packets so they all appear to come from its single public address. Replies come back to that public address, and the router remembers which device asked. One public address, one household.

Carrier-grade NAT (also called CGN, large-scale NAT or NAT444) adds the same trick one level up. The provider gives your router a private address instead of a public one, and a large translator in the provider's network shares each public address among hundreds or thousands of routers. Your traffic is translated twice: once by your router, once by the provider.

Providers do this because IPv4 addresses ran out. The regional registries allocated their last large blocks between 2011 and 2019, and an address now costs real money on the transfer market. Mobile networks have worked this way almost from the start; fixed-line providers, especially newer fiber, cable, satellite and wireless operators that never received large allocations, have adopted it over the past decade.

RFC 6598 reserved a block specifically for this purpose in 2012: 100.64.0.0/10, which runs from 100.64.0.0 to 100.127.255.255, about four million addresses. It is called Shared Address Space. It is not one of the familiar private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) because those are already in use inside customers' homes, and a provider handing out 192.168.1.x on the WAN side would collide with the routers using it on the LAN side.

So if your router's WAN or Internet address begins with 100.64 through 100.127, there is no doubt: you are behind CGNAT. Some providers use ordinary private ranges on the WAN side instead, so a WAN address starting with 10. or 172.16 to 172.31 means the same thing. Note that 100.64.0.0/10 is also used by some VPN and overlay products (Tailscale assigns addresses from it to its clients, for instance), which is unrelated to your provider.

Addresses outside those ranges on the WAN side do not prove you are free of CGNAT: a few providers translate from public-looking addresses too. That is why the comparison test below is the reliable one.

1. Open the homepage on any device at home and note the public IPv4 address it shows. That is the address the internet sees.
2. Log in to your router (the router IP guide has the steps) and open its status or Internet page. Note the WAN IP, Internet IP or IPv4 address it reports for its upstream side.
3. Compare. Same address: you hold a public IPv4 address and are not behind CGNAT. Different address: you are behind CGNAT, whatever the WAN range looks like.

Two shortcuts if you would rather not log in to the router. The NAT type test probes how your connection maps addresses and ports and reports carrier-grade NAT when it sees the signature of a second translation layer. And the port checker gives strong evidence: forward any port on your router to a device, test it, and if it still shows filtered, nothing from outside is reaching your router at all. The what is my ISP page confirms which provider's network the public address belongs to, which helps when you are on a reseller.

The honest answer is most of them, for at least some customers, and the list changes constantly. Some well-documented cases:

Providers rarely advertise CGNAT, and a provider that does not use it today may move you behind it after a network upgrade. The comparison test above is the only thing that tells you your own status.

• Port forwarding. A forwarding rule on your router says send incoming traffic on port 25565 to the Minecraft server. Under CGNAT, incoming traffic never reaches your router, because the provider's translator has no mapping for it. UPnP, which automates the same thing, fails the same way. The port forwarding guide explains what the rule does when it can work.
• Gaming NAT type. Consoles and PC games report strict or Type 3 NAT behind CGNAT no matter how the router is configured. The symptoms are empty lobbies, failed invites, missing voices in party chat and being unable to host. Two strict players cannot connect to each other at all.
• Hosting anything at home. Game servers, a Plex or Jellyfin server, a NAS, security cameras, a personal website, remote desktop: anything that waits for connections from outside is unreachable.
• Remote access and VPN servers. A VPN or WireGuard server on your router cannot be reached from the road.
• Shared reputation. You share your public address with strangers. One of them abusing a site gets the address rate-limited, captcha-walled or banned for everyone; the IP ban guide covers that side effect.
• Logs and allow-lists. Services that allow-list your address, from a work VPN to a bank's fraud system, see a shared, changing address instead of yours.

Everyday browsing, streaming, video calls and most multiplayer games that use a relay server are unaffected, which is why millions of people are behind CGNAT without noticing.

1. Use IPv6. Providers that run CGNAT almost always deliver a real IPv6 prefix, because IPv6 has no address shortage. Every device gets a public address again, and anything that supports IPv6 (most consoles and games, remote-desktop tools, many self-hosting apps) becomes reachable once you open the port in the router's IPv6 firewall. Check with the IPv6 test. The limitation: whoever is connecting to you also needs IPv6, which rules out some networks.
2. Ask for a public IPv4 address. Many providers will move you out of CGNAT on request, sometimes for a small monthly fee and sometimes free; business plans usually include it. Ask for a public address; a static one is a separate (and dearer) feature you may not need.
3. Use an overlay network. Tailscale, ZeroTier and similar tools connect your devices to each other through outbound connections and relays, so no inbound port is needed. Ideal for reaching your own NAS, cameras or desktop from anywhere; not for public hosting.
4. Use a tunnel service. Cloudflare Tunnel, ngrok and comparable services open an outbound connection from your server to a public endpoint they operate, and forward visitors through it. This is the standard answer for a website or a small game server behind CGNAT.
5. Rent a tiny public endpoint. A cheap VPS with a public address plus a WireGuard tunnel to your home gives you full control of a public IPv4 and every port on it, at the cost of running it yourself.
6. VPN providers with port forwarding. A few consumer VPNs offer a forwarded port on their exit address, which is enough for peer-to-peer apps and some game hosting.

What does not work: changing settings on your own router, DMZ mode, UPnP, or a different router. The translation you need to bypass is not in your house.