Last updated: October 2026
TL;DR
CGNAT (Carrier-Grade NAT) is a method internet service providers use to share one public IPv4 address across many customers. Your ISP gives your router a private address from a shared pool, then translates your traffic to a public IP at its own network edge. The goal is to stretch a shrinking supply of IPv4 addresses.
- How to check: You’re behind CGNAT if your router’s WAN IP doesn’t match your public IP, or if it falls between an address from a shared pool
- IP range: CGNAT uses the 100.64.0.0/10 shared address space, which RFC 6598 reserved for carriers in 2012.
- What it breaks: CGNAT blocks unsolicited inbound connections, so port forwarding, hosting a server, and reaching cameras or a NAS remotely usually fail.
- Who uses it: Mobile and satellite ISPs use CGNAT by default, and a growing number of cable and fiber ISPs now use it too.
- How to work around it: Ask your ISP for a static or dedicated public IP, or use a reverse tunnel that connects outbound from your network.
- Security: CGNAT makes devices harder to reach as a side effect of address sharing. It isn’t a security feature and doesn’t replace a firewall.
Our Customer Support team hears about CGNAT more than almost any other networking term. It usually comes up when a camera, NAS, or game server suddenly stops working from outside the house. This guide covers what CGNAT is, how to tell if you’re behind it, and what to do when it gets in your way.
Jump to:
- CGNAT basics
- How CGNAT works
- How to check if you’re behind CGNAT
- CGNAT IP range
- CGNAT vs. NAT vs. double NAT vs. public IP
- Which ISPs use CGNAT
- FAQ
CGNAT Basics
CGNAT, also called CGN, or carrier-grade network address translation, is NAT that runs inside your ISP’s network instead of on your router. Mobile and satellite carriers have used it for years. A growing number of cable and fiber ISPs now use it too.
CGNAT shares one public IP across many subscribers. That incidentally makes it harder for outside traffic to reach a specific device, but it’s a side effect of address sharing, not a designed security feature. It doesn’t replace a firewall.
The reason CGNAT exists is simple math. As we covered in our post on IPv4 vs. IPv6, the world ran out of new IPv4 addresses years ago. IPv6 solves the shortage, but it isn’t backward compatible with IPv4, and upgrading network equipment is slow and expensive. CGNAT lets ISPs keep adding customers on IPv4 while that transition plays out.
How CGNAT Works
On a typical home network, your router performs NAT once. Every device in your house gets a private address, and the router translates them all to the single public IP address your ISP assigned you.
With CGNAT, your ISP adds a second translation step. Your router no longer receives a public IP. It gets an address from a shared private pool, and the ISP’s CGNAT equipment translates traffic from hundreds or thousands of customers into a much smaller set of public IPv4 addresses.
The ISP tracks each connection using Network Address and Port Translation (NAPT). Each customer gets a slice of the available ports on a shared public IP, so the carrier knows which return traffic belongs to which subscriber.
What CGNAT changes for you
Remote access. Outbound traffic works normally, but inbound connections have nowhere to land. The shared public IP belongs to many customers at once, so a request from outside can’t find your security camera, NAS, or remote desktop.
Latency. The extra translation layer can add a small amount of delay. Most people won’t notice, but real-time apps like gaming and video calls are the most sensitive to it.
Port forwarding. You can forward ports on your own router, but the ISP’s CGNAT layer sits in front of it and won’t pass that traffic through. Sharing an IP also means fewer ports per user, which can affect apps that need many simultaneous connections. Check what options your ISP offers before you troubleshoot your port forwarding setup.
How to Check If You’re Behind CGNAT
You can confirm CGNAT in about two minutes:
- Log in to your router’s admin panel and find the WAN or Internet IP address it lists.
- From any device on the same network, visit a site like whatismyipaddress.com and note the public IP it shows.
- Compare the two. If they don’t match, or the router’s WAN IP falls between 100.64.0.0 and 100.127.255.255, you’re behind CGNAT.
For IT generalists: run a traceroute to your own public IP. A hop in the 100.64.0.0/10 range strongly suggests CGNAT sits between you and the internet.
If you’re behind CGNAT and need inbound access, contact your ISP and ask about a static or dedicated public IP. If that isn’t an option, a tunnel can work around it. Here’s what a reverse tunnel is and how it gets around the problem.
CGNAT IP Range
CGNAT uses a dedicated block of addresses called the shared address space: 100.64.0.0/10, which covers 100.64.0.0 through 100.127.255.255. RFC 6598 reserved this range in 2012 specifically for carrier-grade NAT.
Before RFC 6598, some ISPs used the same private ranges customers use at home (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16). That caused address collisions between the ISP’s network and the customer’s LAN. A separate range avoids those conflicts and makes CGNAT easy to spot. If your router’s WAN address starts with 100.64 through 100.127, that’s your answer.
CGNAT vs. NAT vs. Double NAT vs. Public IP
| Standard (home) NAT | CGNAT | Double NAT | Public IP | |
|---|---|---|---|---|
| Who controls it | You, via your router | Your ISP | Either (any two stacked NAT layers) | N/A (no translation) |
| Devices sharing the public IP | Your household only | Many unrelated subscribers | Varies by setup | Just yours |
| Port forwarding possible? | Yes | Usually not, without ISP help | Yes, if you can configure both layers | Yes |
CGNAT and double NAT overlap, but they aren’t synonyms. NAT444, a common CGNAT deployment, is technically both: your router does one layer of NAT, and the carrier does the other. That overlap is behind most of the confusion between the two terms.
Which ISPs Use CGNAT
| Provider type | Typically uses CGNAT? | Notes |
|---|---|---|
| Mobile carriers (e.g., T-Mobile Home Internet) | Yes, standard | A long-standing, near-universal practice |
| Satellite (e.g., Starlink) | Yes, standard | Shared IPv4 pools are the norm |
| Cable and fiber (e.g., Spectrum, Xfinity, Google Fiber, AT&T) | Many ISPs and expanding | Most cable and fiber plans still include a public IP. That’s shifting: Charter/Spectrum has rolled out MAP-T, a related shared-address scheme, on parts of its network, and UK fiber ISP Community Fibre began defaulting new customers to CGNAT in April 2026. |
If your plan uses CGNAT, ask your ISP whether a static or dedicated public IP is available. Many providers offer one for a monthly fee.
Reach Your Devices From Behind CGNAT
If your ISP won’t give you a public IP, port forwarding won’t help, and a hostname alone won’t either, because it still points to an IP you share with other customers. No-IP Public Tunnels may be the answer that uses the outbound approach covered above. A small client on a Windows PC inside your network connects out to No-IP, and you reach your device through a browser URL. You don’t forward any ports or change any router settings.
CGNAT FAQ
Is CGNAT the same as double NAT?
No. Double NAT is any setup with two stacked NAT layers, such as a second router plugged into an ISP gateway. CGNAT specifically means the outer layer is managed by your carrier. NAT444, a common CGNAT setup, happens to be both, which is why the terms often get mixed up.
Is CGNAT bad?
Not inherently. CGNAT is how most ISPs stretch a limited supply of IPv4 addresses, and for browsing, streaming, and email you won’t notice it. It becomes a problem when you need to host a server, forward a port, or reach a device on your network remotely.
Does CGNAT affect gaming or streaming?
Rarely for casual play or streaming, since those connections start from your side. CGNAT can interfere with peer-to-peer connections, hosting a match, and console NAT type, which may show as “Strict” or “Type 3.” Some VPN and torrent setups that rely on inbound connections run into the same limits.
Can I forward a port if I’m behind CGNAT?
Not through your router alone. The shared public IP belongs to many customers, so standard port forwarding won’t reach your device. Your options are asking your ISP for a public IP or using remote access without port forwarding. Our port forwarding guide covers the standard setup.
How do I get around CGNAT?
Ask your ISP for a static or dedicated public IP, which is the most direct fix. If that isn’t available or costs too much, use a service that tunnels around CGNAT. A tunnel opens an outbound connection, so nothing needs to reach your network from outside. Learn how reverse tunnels bypass CGNAT.
Which ISPs use CGNAT?
Most mobile and satellite carriers use CGNAT by default, including T-Mobile Home Internet and Starlink. A growing share of cable and fiber providers use it too, or use related shared-address schemes like MAP-T. See the ISP table above for details, and ask your provider directly if you’re unsure.