Home Networking

What Is CGNAT and How Can You Tell If Your ISP Uses It?

CGNAT is an ISP-operated layer of IPv4 address translation that lets multiple subscribers share public IPv4 addresses. You are probably behind it if your router’s WAN IPv4 is in the 100.64.0.0/10 range and does not match the public IPv4 seen online. A mismatch alone is not proof because a second router can produce the same result. Compare both addresses, inspect the range, and rule out home double NAT.

The practical test takes a few minutes and does not require special software. The important part is interpreting the result correctly.

Three home networks sharing one public IPv4 address through an ISP CGNAT gateway

What CGNAT does

CGNAT stands for carrier-grade network address translation. Your home router already translates the private addresses used by phones, computers, and smart devices into an address on its internet-facing interface. CGNAT adds another translator inside the ISP’s network.

A typical IPv4 path looks like this:

Device with a private IP
        |
Home router
        |
Shared or private WAN IP
        |
ISP carrier-grade NAT
        |
Public IPv4 address
        |
Internet

The IETF requirements for carrier-grade NAT define a CGN as an ISP-controlled function that shares the same IPv4 address among several subscribers. The term “carrier-grade” describes where the NAT sits. It does not promise a particular level of quality.

CGNAT exists mainly because the supply of unique IPv4 addresses is limited. It lets an ISP connect more customers without assigning a separate public IPv4 address to every line. IPv6 is the long-term answer to the address shortage, but many providers run IPv6 alongside CGNAT for IPv4 traffic.

CGNAT, home NAT, and double NAT are different

Network setup	Where translation happens	Who controls it	Can your router forward an inbound IPv4 port?
Normal home NAT with a public WAN IPv4	Once, at your router	You	Usually, if the service and firewall are configured correctly
Home double NAT	At two devices in your home, often a gateway and a second router	You, or you and your ISP for a managed gateway	Possible after configuring both devices or putting one in bridge or access point mode
CGNAT	At your router and again inside the ISP network	You control only the home router	Usually not, unless the ISP provides a mapping service or public address option

A router WAN address that differs from the address reported online proves that translation is happening upstream. It does not identify who owns that translator. Your modem or fiber gateway might still be routing, which creates home double NAT. If you are not sure which box is doing that job, identify your modem, router, or ONT before changing settings. The ISP might also be translating the connection.

How to tell if you are behind CGNAT

1. Find the router’s WAN IPv4 address

Sign in to the router or mesh app and open its Internet, WAN, Connection, or Status page. Look for WAN IP, Internet IP, or IPv4 address. Do not use the address shown on a phone or laptop, since that is normally a local address such as 192.168.1.25.

Write down the WAN IPv4 address. If the page shows only an IPv6 address, look for a separate IPv4 section.

2. Check the public IPv4 seen online

On a device connected to that router, search the web for “what is my IP” and use a result that identifies IPv4 specifically. A browser may prefer IPv6, so make sure you are comparing IPv4 with IPv4.

Temporarily disconnect any commercial VPN, work VPN, proxy, or privacy relay before testing. Those services intentionally change the public address seen by websites.

3. Compare the two addresses

What you see	What it probably means	What to do next
The router WAN IPv4 exactly matches the online public IPv4	Your router probably has a public IPv4 address	If an inbound service still fails, check its local firewall, listening address, and port-forward rule
The WAN IPv4 is between 100.64.0.0 and 100.127.255.255, and the addresses differ	Strong evidence of CGNAT	Ask the ISP whether the line uses CGNAT and whether a public IPv4 option is available
The WAN IPv4 starts with 10, 172.16 through 172.31, or 192.168, and the addresses differ	There is upstream NAT, but it may be home double NAT or ISP NAT	Check whether a modem, fiber gateway, or second router is also in router mode, then ask the ISP
The WAN IPv4 appears public, but it differs from the online IPv4	A VPN, stale status page, or less common provider translation may be involved	Turn off VPNs, refresh both readings, reconnect once, and ask the ISP if the mismatch remains

The range 100.64.0.0/10 is especially useful. RFC 6598 reserves it as Shared Address Space for service-provider networks. It is not globally reachable. The three familiar private ranges are separate: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, as listed in RFC 1918.

Some ISPs use an RFC 1918 address instead of 100.64.0.0/10 on the customer side of their NAT. That is why a 10.x.x.x WAN address is evidence of upstream NAT, not definitive proof of CGNAT.

4. Use traceroute only as supporting evidence

You can inspect the early path with tracert 1.1.1.1 in Windows or traceroute 1.1.1.1 in macOS and Linux. Extra private or shared-address hops after your router support the idea that another gateway exists upstream.

This is not a pass or fail test. Routers can hide hops or ignore the packets used by traceroute. An address visible in the path also does not tell you by itself whether a home gateway or the ISP owns it.

5. Ask the ISP a precise question

Contact support with both IPv4 addresses and ask:

Is my connection behind carrier-grade NAT for IPv4?
Can I opt out or receive a public dynamic IPv4 address?
Is a public IPv4 address included, paid, or available only on a business plan?
Does the service provide native IPv6 with inbound connectivity?

“Do I have a static IP?” is a different question. A dynamic public IPv4 can still accept inbound connections. It may need dynamic DNS if you want to reach it by a stable name.

Do not use a port test as your only CGNAT test

A closed port does not prove CGNAT. The same result occurs when no application is listening, the device firewall blocks the connection, the service is bound only to localhost, the port-forward rule points to the wrong device, or the router blocks unsolicited traffic.

If the router has a public WAN IPv4, verify the local service first:

Give the server device a reserved local address.
Confirm the application is running and listening on the expected port.
Allow the port through the device firewall.
Forward the correct protocol, TCP, UDP, or both, to the correct device.
Test from a different internet connection, such as mobile data, not from the same WiFi unless the router supports NAT loopback.

If the WAN address is shared or private, those home-router changes cannot create a mapping through an ISP gateway that you do not control.

What problems CGNAT can cause

Ordinary outbound activity usually works. Web browsing, streaming, software updates, and most cloud apps begin their connections from inside the home, so the CGN can track the replies.

The trouble is more likely when an unsolicited IPv4 connection must begin from outside:

Hosting a game server, website, media server, or home lab
Connecting directly to a security camera or network recorder
Using peer-to-peer software that needs predictable inbound mappings
Allowlisting a home connection by public IPv4 address
Playing a game that reports a strict or restricted NAT type

CGNAT does not automatically make WiFi slow. It sits upstream of the home network. Weak signal, poor node placement, and an overloaded wireless link are separate problems. If performance changes from room to room, investigate the local WiFi and the connection between mesh units before blaming CGNAT.

A provider gateway can become congested or mishandle an application, but a CGNAT address alone does not prove that it is causing a speed or latency problem.

Ways to work around CGNAT

Ask for a public IPv4 address

This is the cleanest option when you need conventional port forwarding. Ask for a public dynamic IPv4 or an opt-out from CGNAT. A static address is useful when an allowlist requires an unchanging value, but it is not required for every hosted service.

Use IPv6 where both ends support it

A device with a globally routable IPv6 address does not need IPv4 CGNAT for IPv6 traffic. The remote network and application must also support IPv6. Keep the router firewall enabled and create only the inbound IPv6 rules the service needs. A public IPv6 address is reachability, not automatic permission through the firewall.

Use an overlay VPN for private remote access

An overlay network can connect your own devices without exposing a general public port. For example, Tailscale attempts NAT traversal and falls back to a relay when a direct connection is not possible. A relayed path can have lower throughput or higher latency than a direct path, but it is often suitable for administration and private access.

Use an outbound tunnel for a web service

For a web application or another supported service, an outbound connector can avoid the need for a public address at home. Cloudflare Tunnel uses outbound-only connections from a local connector to Cloudflare. It is not a universal replacement for every game protocol or peer-to-peer application, so choose it for a service it actually supports.

Use a server with a public address

Advanced users can place a relay, VPN endpoint, or reverse proxy on a virtual private server with a public IP. This adds cost and security work. You are responsible for updates, authentication, firewall rules, and the traffic path between the server and home.

Changes that do not remove CGNAT

Adding another port-forward rule to the home router
Putting a device in the home router’s DMZ
Turning on UPnP only at the home router
Changing DNS servers
Buying a faster router or adding more mesh units

Those settings can affect your side of the connection. They cannot reconfigure the ISP’s translator. If WiFi coverage is the separate problem, change placement based on testing instead of assuming that more mesh nodes will fix an upstream address limitation.

CGNAT questions answered

Is 100.64.0.0/10 a private IP range?

It is Shared Address Space, not one of the three RFC 1918 private ranges. It is intended for service-provider networks and is not globally reachable. A WAN address from 100.64.0.0 through 100.127.255.255 is strong evidence that the provider is using CGNAT.

Is CGNAT the same as a dynamic IP address?

No. Dynamic describes whether an address can change. Public describes whether the address is globally routable and assigned to your connection. You can have a dynamic public address, or you can sit behind CGNAT while the shared public address also changes.

Does CGNAT improve security or privacy?

It blocks ordinary unsolicited IPv4 connections as a side effect of address translation, but it is not a replacement for a firewall, device updates, or secure authentication. Subscribers also share public IPv4 addresses, so public-IP reputation and rate limits can sometimes affect people who did not create the original traffic.

Can port forwarding work through CGNAT?

Not through your home router alone. The ISP would also need to provide a mapping at its CGN, assign a public IPv4 address, or offer another supported service. RFC 6888 calls for subscriber control over mappings through a protocol such as PCP, but availability to residential customers depends on the provider.

Can a new router fix CGNAT?

No. A new router can fix home double NAT if it replaces or bridges one of the routing devices. It cannot remove NAT that runs inside the ISP’s network. Confirm which kind of upstream NAT you have before buying hardware.