Skip to content
ipaddress.si
Privacy2 min read

What is CGNAT (carrier-grade NAT)?

Why your provider may be sharing one public IPv4 address with hundreds of customers, how to tell, and what it breaks.

By ipaddress.si

Carrier-grade NAT (CGNAT, also called large-scale NAT) is network address translation performed by your internet provider, on top of the NAT your own router already does. It lets many customers share a single public IPv4 address.

Why providers use it

IPv4 addresses ran out years ago and now cost real money on the transfer market. A provider with a million customers but far fewer IPv4 addresses has two options: deploy IPv6, and share IPv4 addresses among customers for the services that still need them. CGNAT is the second part.

How it works

  1. Your devices use private addresses (e.g. 192.168.1.x).
  2. Your router translates them to its WAN address — but under CGNAT that address comes from the shared address space 100.64.0.0/10 (RFC 6598), not a public one.
  3. The provider’s CGNAT gateway translates again, to a public address shared by many customers, assigning each a range of ports.

How to tell if you’re behind CGNAT

Open your router’s status page and find its WAN or internet IP address.

  • If it’s in 100.64.0.0 – 100.127.255.255, or in a private range, you are behind CGNAT.
  • If it matches the IPv4 address shown on the homepage, you have your own public address.

Mobile connections are almost always behind CGNAT for IPv4.

What it breaks

  • Inbound connections: port forwarding doesn’t work, so hosting a game server, a home NAS or remote access to cameras fails without a workaround.
  • Peer-to-peer: some games, voice and file-sharing apps work less well.
  • Reputation: if another customer sharing your address misbehaves, you may see more CAPTCHAs or blocks.
  • Logging: identifying a user requires the provider to log ports and timestamps, not just addresses.

What helps

  • IPv6: with IPv6, your devices have their own global addresses and CGNAT doesn’t apply. Most services you use already support it.
  • Ask your provider: many ISPs will give you a public IPv4 address on request or for a small fee.
  • Tunnels: VPN or tunnelling services can provide inbound reachability.

Check whether your connection has IPv6 and what your public IPv4 address is on the homepage.

Related articles

  • IP addresses2 min read

    Public vs private IP addresses

    Why your laptop's address starts with 192.168 while websites see something else — and what that means for connectivity and privacy.

  • IP addresses2 min read

    IPv4 vs IPv6: what actually changes

    Address size is the headline, but the real differences are in how networks are numbered, how devices configure themselves, and what happens to NAT.