What Is CGNAT? Why You Might Share One Public IP
Carrier-grade NAT lets ISPs put hundreds of customers behind a single public IP address. Here is what CGNAT is, how to tell if you are behind it, and what it breaks.
If the public IP shown on our home page is shared with strangers, you are probably behind CGNAT — carrier-grade NAT. It is one of the main ways internet providers cope with the shortage of IPv4 addresses, and it quietly changes what your connection can and cannot do.
What CGNAT actually is
Normal home routers already use NAT (Network Address Translation) to share one public IP among all your devices. Carrier-grade NAT adds a second layer of the same trick at the provider's end: instead of giving each customer a unique public IP, the ISP places hundreds or thousands of subscribers behind a single shared public address. The provider's equipment keeps a giant translation table to route each connection back to the right customer.
To understand why this matters, it helps to know the difference between the address your router uses internally and the one the world sees — our guide on public versus private IP addresses explains that layering.
Why ISPs use it
There are only about 4.3 billion IPv4 addresses, and they ran out years ago. Rather than buy scarce, expensive address blocks for every new customer, providers use CGNAT to stretch a small pool across many users. Mobile carriers rely on it almost universally, and many fixed-line and fiber ISPs use it too. If you want the full story of how the addresses ran dry, see why the world ran out of IPv4 addresses.
How to tell if you are behind CGNAT
- Note the public IP shown on our home page.
- Log into your router and find its “WAN” or “Internet” IP address.
- Compare them. If the router's WAN IP is different from your public IP — and especially if it falls in the
100.64.0.0/10range reserved for shared address space — you are behind CGNAT.
If the two addresses match, you have a normal public IP. If the router shows a 100.64.x.x address while the world sees something else, a carrier NAT sits between you and the internet.
What CGNAT breaks
- Port forwarding. You cannot open a port to a shared public IP, so self-hosting a website, game server, or security camera becomes difficult or impossible.
- Remote access. Reaching your home network from outside — for a NAS, remote desktop, or VPN server — usually will not work without extra tricks.
- Some peer-to-peer apps and games may show “strict” or “moderate” NAT types and struggle to connect directly.
- Shared reputation. Because you share an IP with many others, one person's abuse can trigger CAPTCHAs or blocks that affect you too — a cousin of the wrong-location problem.
How to work around it
- Ask your ISP for a public IP. Some providers will move you off CGNAT or offer a static public IP, sometimes for a small fee.
- Enable IPv6. CGNAT is an IPv4 problem; IPv6 gives every device a real address, sidestepping it entirely. Check yours with our IPv6 test.
- Use a relay or tunnel service. Tools that create an outbound tunnel can expose a home service without needing an inbound port.
CGNAT vs regular NAT: what is actually different
Both do the same translation. What changes is who operates it and what you lose as a result.
| Who runs it | NAT: your own router, in your home. CGNAT: your ISP, in their network. |
| Who shares the address | NAT: only your own devices. CGNAT: hundreds or thousands of unrelated subscribers. |
| Address on the WAN side | NAT: a real public address. CGNAT: a shared-space address, usually in 100.64.0.0/10. |
| Port forwarding | NAT: you control it. CGNAT: you cannot — the port belongs to the carrier's shared address. |
| Layers of translation | NAT: one. CGNAT: two, which is why it is often called NAT444 (private → shared → public). |
| Reputation | NAT: your address, your behaviour. CGNAT: shared, so someone else's abuse can get you blocked. |
In short: home NAT hides your devices behind one address you still own. CGNAT hides you behind an address you do not own and cannot configure.
The CGNAT IP range: 100.64.0.0/10
CGNAT has its own dedicated address block, reserved by RFC 6598 as shared address space: 100.64.0.0/10. That covers every address from 100.64.0.0 to 100.127.255.255 — about 4.2 million addresses.
It exists because ISPs needed a range that was neither public nor one of the familiar private ranges. If carriers had used 192.168.0.0/16 or 10.0.0.0/8 for the carrier layer, it would have collided with the addresses customers already use inside their own homes, and the double translation would break. So a separate block was set aside specifically for the space between your router and the carrier's public address.
Practical consequences:
- If your router's WAN address starts with
100.64through100.127, you are behind CGNAT. This is the single most reliable indicator. - These addresses are not routable on the public internet, so nothing outside your ISP can reach them directly.
- Not every ISP uses this range — some use ordinary public addresses on the carrier layer, so a WAN address outside
100.64.0.0/10does not prove you are free of CGNAT. Comparing it against your actual public address, as described above, is the check that always works. - Do not confuse it with
100.64.0.0/10appearing inside a corporate network or a VPN client's virtual adapter — some software borrows the range for its own tunnels.
How CGNAT works, step by step
- Your laptop, on a private address like
192.168.1.20, opens a connection to a website. - Your home router performs the first translation, rewriting the source to its own WAN address — a shared-space address such as
100.71.4.9— and records the mapping. - The carrier's CGNAT device performs the second translation, rewriting the source again to a genuinely public address shared with many other subscribers, and assigns your connection a specific source port from a pool.
- The website replies to that public address and port. The carrier looks up the port in its translation table, forwards the packet to your router, which looks up its own table and delivers it to your laptop.
Everything works as long as you start the conversation. The mapping only exists because your outbound packet created it. An unsolicited inbound packet arriving at the carrier's public address has no table entry to match, so it is dropped — which is precisely why port forwarding and remote access break.
This is also why carriers limit how many simultaneous connections each subscriber may hold: a public IPv4 address has 65,535 ports, and modern browsers open dozens of connections per page. RFC 6888 sets out the requirements carriers are expected to follow, including logging translations and limiting per-subscriber port consumption.
CGNAT and gaming
Consoles report a NAT type, and CGNAT is the most common cause of a bad one. Peer-to-peer matchmaking works best when at least one player can accept an inbound connection; behind CGNAT neither side can, so the game must fall back to a relay server, which adds latency or fails to connect at all.
- Strict / Type 3 NAT is the typical symptom, and no amount of router configuration fixes it, because the blocking layer is upstream of your router.
- UPnP and NAT-PMP stop helping. They can open ports on your own router, but they have no authority over the carrier's translator.
- Party chat and hosting tend to fail before matchmaking does, since those need inbound connections most directly.
- IPv6 fixes it properly where the game supports it, because each console gets its own globally routable address with no translation at all. Check whether your connection has IPv6 with our IPv6 test.
Is CGNAT good or bad for privacy and security?
It cuts both ways, and the honest answer is that neither effect is large.
Mildly helpful: because your public address is shared with many strangers, it is a weaker identifier than a dedicated address. Anyone profiling you by IP alone sees a blur of subscribers rather than one household. Unsolicited inbound traffic — port scans, opportunistic exploit attempts — also cannot reach your devices, though a normal home router already blocks that.
Not actually protective: CGNAT is not privacy technology and should never be treated as one. Your ISP logs which subscriber held which port at which moment, so the mapping back to you exists and is retained. Websites identify you by cookies, logins, and browser fingerprinting far more precisely than by IP. If your goal is to hide your address, see how to hide your IP address.
Genuinely harmful: shared reputation. When another subscriber on your shared address sends spam or triggers abuse systems, the resulting CAPTCHAs, rate limits, or outright blocks land on you too — with no way to appeal, because the address is not yours. This shared-fate problem, along with the difficulty of attributing abuse to one subscriber, is documented in RFC 6269.
The bottom line
CGNAT is invisible for everyday browsing, streaming, and gaming — most people never notice it. It only becomes a problem when you need the internet to reach into your network. If that is you, confirm you are behind it by comparing your router's WAN IP to the address on our home page, then either ask your ISP for a public IP or lean on IPv6.