What Is CGNAT? Why You Might Share One Public IP
Carrier-grade NAT lets ISPs put hundreds of customers behind a single public IP address. Here is what CGNAT is, how to tell if you are behind it, and what it breaks.
If the public IP shown on our home page is shared with strangers, you are probably behind CGNAT — carrier-grade NAT. It is one of the main ways internet providers cope with the shortage of IPv4 addresses, and it quietly changes what your connection can and cannot do.
What CGNAT actually is
Normal home routers already use NAT (Network Address Translation) to share one public IP among all your devices. Carrier-grade NAT adds a second layer of the same trick at the provider's end: instead of giving each customer a unique public IP, the ISP places hundreds or thousands of subscribers behind a single shared public address. The provider's equipment keeps a giant translation table to route each connection back to the right customer.
To understand why this matters, it helps to know the difference between the address your router uses internally and the one the world sees — our guide on public versus private IP addresses explains that layering.
Why ISPs use it
There are only about 4.3 billion IPv4 addresses, and they ran out years ago. Rather than buy scarce, expensive address blocks for every new customer, providers use CGNAT to stretch a small pool across many users. Mobile carriers rely on it almost universally, and many fixed-line and fiber ISPs use it too. If you want the full story of how the addresses ran dry, see why the world ran out of IPv4 addresses.
How to tell if you are behind CGNAT
- Note the public IP shown on our home page.
- Log into your router and find its “WAN” or “Internet” IP address.
- Compare them. If the router's WAN IP is different from your public IP — and especially if it falls in the
100.64.0.0/10range reserved for shared address space — you are behind CGNAT.
If the two addresses match, you have a normal public IP. If the router shows a 100.64.x.x address while the world sees something else, a carrier NAT sits between you and the internet.
What CGNAT breaks
- Port forwarding. You cannot open a port to a shared public IP, so self-hosting a website, game server, or security camera becomes difficult or impossible.
- Remote access. Reaching your home network from outside — for a NAS, remote desktop, or VPN server — usually will not work without extra tricks.
- Some peer-to-peer apps and games may show “strict” or “moderate” NAT types and struggle to connect directly.
- Shared reputation. Because you share an IP with many others, one person's abuse can trigger CAPTCHAs or blocks that affect you too — a cousin of the wrong-location problem.
How to work around it
- Ask your ISP for a public IP. Some providers will move you off CGNAT or offer a static public IP, sometimes for a small fee.
- Enable IPv6. CGNAT is an IPv4 problem; IPv6 gives every device a real address, sidestepping it entirely. Check yours with our IPv6 test.
- Use a relay or tunnel service. Tools that create an outbound tunnel can expose a home service without needing an inbound port.
The bottom line
CGNAT is invisible for everyday browsing, streaming, and gaming — most people never notice it. It only becomes a problem when you need the internet to reach into your network. If that is you, confirm you are behind it by comparing your router's WAN IP to the address on our home page, then either ask your ISP for a public IP or lean on IPv6.