What is CGNAT (Carrier-Grade NAT)?
CGNAT — Carrier-Grade NAT — is when your provider shares a single public IPv4 address across hundreds of customers at once, instead of giving your router one of its own. It’s the industry’s patch for a shortage of IPv4 addresses, and it’s now the default on many mobile plans and a growing number of residential and fiber connections.
Why it exists: running out of IPv4
IPv4 has room for about 4.3 billion addresses total, and the regional registries that hand them out to providers ran dry years ago — there simply aren’t enough left to give every device, or even every household, its own. Meanwhile the number of connected phones, routers, and smart devices keeps climbing. IPv6 was designed to solve this permanently, since its address space is astronomically larger, but adoption has been slow and uneven across networks and devices. Until a connection is fully IPv6-capable end to end, ISPs bridge the gap with CGNAT: an extra layer of network address translation on top of the one your own router already does, letting one public address stand in for hundreds of separate customer connections at once — effectively a double NAT, with your ISP’s box outside your router’s.
Symptoms you might recognize
CGNAT tends to show up as a handful of specific annoyances rather than a broken connection. Port forwarding for a home server, security camera, or game host stops working, because incoming requests hit the ISP’s shared address first and it has no reliable way to know which of its hundreds of customers should receive them. Geolocation tools may show a city that isn’t yours at all, since the address they see belongs to the shared pool rather than to your specific line — sometimes a regional hub city hours away. Online games flag a “strict” or “moderate” NAT type and struggle with voice chat or peer-to-peer connections. Some websites that rate-limit or challenge suspicious traffic by IP start throwing CAPTCHAs at you, because they’re seeing requests from dozens of your ISP’s other customers mixed in with yours.
How to check if you’re behind it
Compare two numbers: the “WAN IP” or “Internet IP” shown in your router’s
admin page, and what the home page shows when you visit it from that
same connection. If they match, you have your own public address. If they
don’t, you’re behind CGNAT or another layer of provider-side NAT — your
router’s WAN address will typically fall in the 100.64.0.0/10 range, a
block reserved specifically for this, while the internet sees a completely
different, shared address further upstream.
Escaping it
The direct fix is asking your ISP for a static public IP add-on; many carry this exact CGNAT bypass as a paid option on both mobile and home plans, often listed as “public IP” rather than “static IP” even though it’s usually both — see our guide on static vs dynamic IPs for what that distinction actually buys you. Support agents don’t always recognize the term “CGNAT” by name, so it can help to describe the symptom directly — “I need port forwarding to work” or “I need a public IP for a server” — rather than asking for the mechanism. The longer-term fix is IPv6: because its address space is large enough for every device to have its own without rationing, ISPs generally don’t need to NAT it at all, so a connection with working IPv6 can be reachable directly for IPv6-capable peers even while its IPv4 side stays behind CGNAT — see our guide on IPv4 vs IPv6 for what that split actually means in practice and why it doesn’t help you reach IPv4-only services. Short of either, a VPN with a dedicated public endpoint gets you a stable, reachable address as a workaround, at the cost of routing your traffic through someone else’s server and trusting it with everything that passes through.