>What Is CGNAT: How to Tell If You Are Behind It and How to Get Around It

Introduction

You set up port forwarding for a Minecraft server, a Plex library or a camera, and nothing from outside gets through. The console says Strict NAT, and none of the usual fixes change it. The router's status page shows an internet address like 100.72.15.3. That is CGNAT, carrier-grade NAT: the internet provider shares one public IPv4 address between many customers, and your router never gets one of its own.

Below: what CGNAT is and why providers use it, how to check if you are behind CGNAT, what it breaks and what keeps working, whether it is bad for gaming or makes you safer, and how to bypass it, from asking for a public IP address to tunnels that need no open port at all.

What is CGNAT?

CGNAT (carrier-grade NAT) stands for carrier-grade network address translation. It is also written carrier grade NAT or CG-NAT, and called CGN. In plain terms, CGNAT means NAT done by the internet provider instead of your home router. Your router already does NAT (network address translation): it shares one address between every device in your home. CGNAT does the same one level up and shares one public IPv4 address between many homes.

Why internet providers use CGNAT

An IPv4 address is a 32-bit number, so there are about 4.3 billion of them, and they have run out. The central pool that IANA hands out to the regional registries was used up in February 2011, and the registries followed. ARIN, the registry for North America, ran out of free addresses in September 2015. A provider that adds customers today mostly has to buy IPv4 addresses from someone who has spare ones. IPv6 has room for everyone, but much of the internet still needs IPv4, so providers stretch the IPv4 addresses they have by sharing them through CGNAT.

How CGNAT works: two NATs in a row

Your router translates the private addresses of your devices, such as 192.168.1.10, to its own WAN address. Behind CGNAT, that WAN address is not public either. It comes from a range that only the provider's network uses, and the provider's CGNAT translates it a second time, to a public address that other customers use too. Each connection gets its own port on that address, which is how replies find the right home. Engineers call this NAT444: three address spaces (your home, the provider's network and the internet) and two translations.

Everything you start from inside works as before: browsing, streaming, downloads, and games that connect to a server. Trouble starts when something on the internet has to open the connection to you. The provider's NAT has no rule for it, so it drops the traffic before it ever reaches your router.

The CGNAT IP range: 100.64.0.0/10

RFC 6598, published in April 2012, set aside 100.64.0.0/10 for exactly this and named it "Shared Address Space". The range runs from 100.64.0.0 to 100.127.255.255, about 4.2 million addresses. Providers needed a range of their own because home networks already use the private ranges, 10.x.x.x and 192.168.x.x, and a home router may not work when the same range appears on both of its sides. Addresses from 100.64.0.0/10 are not routed on the public internet: the standard forbids passing them from one provider's network to another.

A WAN address in that range is the clearest sign of CGNAT, but not the only one. When the provider supplies and manages the router itself, RFC 6598 also allows a private range such as 10.x.x.x for the same job. DS-Lite, a setup some providers use on IPv6 lines, gives the router the address 192.0.0.2, carries IPv4 inside IPv6 to the provider and does the NAT there.

CGNAT vs NAT, double NAT and a public IP

The router's WAN address, the address it gets from the provider, tells these setups apart.

CGNAT vs static IP and dynamic IP

A static IP address is a public address that stays the same. A dynamic IP address changes now and then, but while you have it, it belongs to you alone. CGNAT is neither: the address websites see is not yours alone, and the provider can move you to another shared address.

Am I behind CGNAT? How to check

Compare your router's WAN IP with your public IP

Two addresses answer the question am I behind CGNAT. The first is the router's WAN IP address, which its status page shows under a name like WAN, Internet or Connection status. The second is your public IP address, the one websites see, which any "what is my IP" page shows. Read the WAN address first:

• From 100.64.0.0 to 100.127.255.255: you are behind CGNAT.
• The same as your public IP: no CGNAT. Your router holds a public address.
• A private IP address (10.x.x.x, 172.16.x.x to 172.31.x.x, 192.168.x.x): another NAT sits in front of your router. Often it is the provider's modem-router in your home, which is double NAT. If your router plugs straight into the provider's line with no other box in between, the NAT in front of it is the provider's.
• 192.0.0.2: DS-Lite, so the NAT runs at the provider.
• A public address that differs from your public IP: something past the router translates it again. It can be the provider, or a VPN on the device you checked from.

The NAT Type Test on packet.guru doubles as an online CGNAT check. Paste the router's WAN IP address into it and it names the case, comparing the address with the public IPv4 address the page sees. The check runs in the browser, and the address does not leave the page.

Traceroute as a second hint

When you cannot open the router's settings, traceroute gives a hint. It lists the routers your traffic passes on its way to a public address. The tool is called tracert in the Windows command prompt (cmd) and traceroute on macOS and Linux. The first hop is your own router. If the next hop or two have addresses from 100.64.0.0 to 100.127.255.255, you are very likely behind CGNAT. Traceroute shows only the hops that answer, though, so only the router's WAN address settles it.

On a phone or a mobile hotspot

On mobile data the phone is its own router. Android lists the phone's IP address in its status information. Compare that IPv4 address with the public IP a website shows. If they differ, the carrier translates your traffic. Mobile networks can share IPv4 addresses with CGNAT, or with the 464XLAT design of RFC 6877, which gives phones only an IPv6 address and translates their IPv4 traffic at the carrier, where many users again share one IPv4 address.

CGNAT advantages and disadvantages

Advantages of CGNAT

The main advantage goes to the provider. CGNAT lets it connect more customers to the IPv4 internet with the addresses it already has, instead of buying one for every home. For you, the gain is smaller: traffic from the internet that nobody inside asked for stops at the provider's NAT, so devices at home are harder to reach from outside, as the security section below explains. Everything you start from inside keeps working. The disadvantages show up when something has to reach you, or when other customers' behavior lands on the address you share.

CGNAT and port forwarding: hosting anything at home

Everything that waits for a connection from the internet stops working:

• a game server for friends. Minecraft's own server page mentions opening port 25565 for Java Edition so players outside your network can join.
• remote access to Plex or Jellyfin from outside the home
• cameras, a video recorder or a NAS you reach from your phone
• a VPN server at home, such as WireGuard, to reach your own network while away
• remote desktop and SSH into a home computer

That is why CGNAT port forwarding fails: port forwarding, UPnP and the DMZ all change rules on your own router, and the traffic from outside never reaches it. A protocol exists for asking the provider's NAT itself for a port: the Port Control Protocol (PCP, RFC 6887). The requirements for carrier-grade NATs, RFC 6888, say a CGNAT must give customers such a protocol and that it should be PCP. Whether your provider does is a question for its support.

Online games and NAT type

Matches that run on the game's own servers work behind CGNAT. What breaks are the parts that connect players directly: party and voice chat, hosting a lobby, and peer-to-peer matches. Consoles report this as Strict or Moderate NAT, and no console or router setting fixes it. Microsoft's Xbox support says that if the provider cannot give you a public IP address, you will have to change providers to fix the NAT. The NAT type guide explains what each NAT type means on Xbox, PlayStation and Switch.

Is CGNAT bad for gaming?

It depends on the game. A shooter with dedicated servers plays the same behind CGNAT. A game that matches players peer to peer, or a party chat that connects consoles directly, reaches fewer players, and you will rarely be picked as host. CGNAT adds one problem of its own: two players who leave through the same shared address can fail to connect to each other at all. RFC 6598 lists this among the services that carrier-grade NAT affects. Hosting your own server for friends needs one of the workarounds below.

One address for many homes: CAPTCHAs, blocks and the wrong location

Sites see the shared address, so everyone behind it shares its reputation. If another customer sends spam or runs a bot, a site that blocks or challenges that address hits you too. Google's help page for its "unusual traffic" message names other people on the same internet provider as one of the causes, and the CAPTCHA guide covers the other reasons sites decide you look like a bot. Limits per address work the same way: on a site that allows a set number of login attempts per IP, another customer's failed logins can lock you out before you try.

RFC 6269, the IETF's list of problems with shared addresses, also notes that a customer behind CGNAT appears wherever the provider's NAT sits, very often in a different city. IP Geolocation shows which location your address gives.

Limited ports per customer

Each connection through CGNAT takes a port on the shared address, and RFC 6888 requires a CGNAT to be able to limit how many ports each customer gets, so that one household cannot use them all up. The provider sets the limit. A program that opens a very large number of connections at once, such as a torrent client, can reach it, and new connections then fail until old ones close.

Does CGNAT affect latency, speed or a VPN?

Does CGNAT slow down your internet? It is not a speed limit. Translating an address is a quick table lookup, so the translation itself adds very little delay. Operators who tested CGNAT for RFC 7021 did see large file transfers and several video streams on one device slow down in their test network, though. Two more things can add lag: the provider's CGNAT may sit off the shortest path to a server, and a game that cannot connect two players directly may send their traffic through a relay server, which is a longer path. Connecting out to a VPN service works normally. Running a VPN server at home, to reach your own network from outside, does not.

Is CGNAT safe or more secure?

Is CGNAT more secure?

Traffic from the internet that nobody inside asked for stops at the provider's NAT, so devices in your home are harder to reach from outside. The provider's NAT does this as a side effect, and you have no say in what it lets through. Your router's WAN side faces the provider's network, shared with other customers, and the standards do not promise that the provider keeps customers apart there. Keep the router's remote administration off and its firmware updated, as you would with a public address.

Does CGNAT hide my IP address?

Not in any way you can rely on. Websites see a shared address, but the provider can match a public address, port and time to one customer. The CGNAT requirements describe that record for handling abuse, and RFC 6269 notes that a request to identify a customer behind a shared address has to name the port and the exact time as well. How complete those records are depends on the provider. Europol said in 2017 that with so many customers sharing one address, it had become technically impossible for providers to identify individual subscribers on request. Websites also tell visitors apart by much more than the address. Run the Privacy & Trust Index check to see what your browser gives away.

How to bypass CGNAT

You can bypass CGNAT for gaming, a Plex server or a Minecraft server in three ways: a public IPv4 address from the provider, IPv6, or a tunnel that starts from inside.

Get rid of CGNAT: ask for a public IPv4 address

Only the provider can take you off CGNAT. Ask for a public IPv4 address. A static IP is a public address too, so a static IP from the provider also takes the line off CGNAT. Providers handle the request differently: some switch you over for free on request or from the account page, and some charge a monthly fee for a public or static address. Starlink offers a public IPv4 address on its Local Priority and Global Priority plans. If your provider cannot give you one, the remaining way out is a provider that can.

Use IPv6

IPv6 has enough addresses for every device to have its own, so there is no NAT to get past. Filtering stays, though: the IETF recommends that home routers drop incoming IPv6 connections that nobody inside started (RFC 6092), so you allow the port in the router's IPv6 firewall instead of forwarding it. Both your network and the people connecting need IPv6. Starlink, for one, supports native IPv6 on every plan, but its own routers have no firewall rules to change, so hosting over IPv6 there needs a third-party router. Not every game and console connects over IPv6, so it helps more with your own services than with NAT type.

A tunnel that starts from inside

Outgoing connections work behind CGNAT. So the way around it is to start the connection from inside, to a server that has a public address and passes incoming traffic back down that connection:

• Cloudflare Tunnel for websites and web apps. A small program at home, cloudflared, opens outbound-only connections to Cloudflare, and visitors reach your site through Cloudflare. Other services, such as SSH or remote desktop, need Cloudflare's software on the visitor's side too, and public UDP ports, which many game servers use, are not offered.
• Tailscale for your own devices. It joins your phone, laptop and home server into one private network. Devices connect directly when they can and through Tailscale's relay servers when they cannot, so you reach Plex, a NAS or remote desktop without opening a port. Its Funnel feature publishes a service to the whole internet, but only over TLS on three ports, so it is not for game servers.
• playit.gg for game servers, for example to host a Minecraft server behind CGNAT. It is a proxy that gives your server a public address with no port forwarding, with built-in support for popular games and custom TCP and UDP ports for the rest.
• A small rented server (VPS) with WireGuard. The home machine keeps a WireGuard tunnel open to a server with a public address, and that server forwards the ports. It works for any game or protocol, and you maintain it yourself.

Plex has its own fallback. When an app cannot reach your server directly, Plex relays the stream through its own servers, limited to 2 Mbps. For higher quality away from home, Plex points to a direct connection, which behind CGNAT means one of the ways above. Separately from CGNAT, since April 2025 Plex requires a Plex Pass, on the server owner's account or your own, or a Remote Watch Pass to play your own videos away from home.

What does not work

No router setting turns CGNAT off, because it does not run on your router. Port forwarding, UPnP, the DMZ, a factory reset and a new router all change your side of the line. A VPN on your computer gives you the VPN server's address for outgoing traffic and opens a port to you only if the VPN service offers port forwarding.

Which internet providers and carriers use CGNAT?

Starlink documents its CGNAT openly. Its support page states that the default IPv4 setup uses CGNAT with addresses from 100.64.0.0/10 and allows no inbound traffic, and that Starlink's own Wi-Fi routers do not support port forwarding or firewall rules. For inbound traffic Starlink points to a third-party router, plus a plan with the public IPv4 option for inbound IPv4. A tunnel works on any Starlink plan. Other providers use CGNAT on some lines or plans and not on others, and mobile networks can share addresses the same way. The router's WAN address answers the question for your line in a minute. If it shows CGNAT, ask the provider two things: can I get a public IPv4 address, and what does it cost?

FAQ

Should I have CGNAT on or off?

You cannot disable CGNAT yourself. It runs in the provider's network, not on your router, so there is no setting for it. Some providers turn it off on request or from the account page. If you need incoming connections, ask for a public IPv4 address. If you only browse, stream and play on servers, CGNAT does not get in the way.

Is a CGNAT IP address a public IP?

No. A CGNAT IP address from 100.64.0.0/10 is not reachable from the internet. Your public IP is the shared address the provider's NAT uses, and it is not yours alone.

Is CGNAT the same as double NAT?

Both put two NATs between your devices and the internet. Double NAT usually means both sit in your home, and bridge mode on the provider's box fixes it. With CGNAT the second NAT is in the provider's network, and only the provider can remove it. You can have both at once: a provider box that still routes, on a line behind CGNAT.

Why does my computer show a 100.x.x.x address?

If Tailscale is installed, it gives each of your devices an address from the same 100.64.0.0/10 range. That address belongs to Tailscale's private network, not to your provider, and says nothing about CGNAT. Check the router's WAN address instead.

Sources

• RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space (IETF)
• RFC 6269: Issues with IP Address Sharing (IETF)
• What IP address does Starlink provide? (Starlink Support)