What Is CGNAT and How Can You Tell If Your ISP Uses It?
Carrier-Grade NAT (CGNAT) is a technology used by internet service providers to allow many customers to share a smaller number of public IPv4 addresses.
If your ISP uses CGNAT, the public IP address seen by websites may not be assigned directly to your router. Instead, your connection can pass through an additional layer of address translation inside the provider's network.
What does CGNAT mean?
CGNAT stands for Carrier-Grade Network Address Translation.
It is similar in concept to the NAT used by many home routers, but CGNAT is performed by the internet provider on a much larger scale.
A typical home network may already use NAT like this:
With CGNAT, another translation layer can exist inside the ISP:
Why do ISPs use CGNAT?
The main reason is the limited supply of IPv4 addresses.
IPv4 provides about 4.3 billion possible addresses, and many of those are reserved or unavailable for ordinary public assignment.
As internet usage expanded, providers needed ways to connect more customers without assigning a unique public IPv4 address to every subscriber.
CGNAT allows one public IPv4 address to be shared by multiple customers.
How is CGNAT different from normal NAT?
Normal home NAT usually happens inside your own router.
Your devices may use private addresses such as:
- 192.168.0.x
- 192.168.1.x
- 10.x.x.x
The router translates those local connections to the public address assigned by the ISP.
With CGNAT, the ISP adds another NAT layer between your router and the public internet.
What IP range is commonly used for CGNAT?
The address range specifically reserved for shared address space is:
This range covers addresses from:
100.64.0.0 to 100.127.255.255
If your router's WAN or internet-facing IPv4 address falls inside this range, that is a strong indication that your ISP may be using CGNAT.
Can CGNAT also use other private ranges?
Some provider networks may use other non-public address ranges internally.
For this reason, the most reliable check is not based on one address range alone.
Comparing your router's WAN address with the public IP address seen by an external service is often more useful.
How to check if your ISP uses CGNAT
One practical method is to compare:
- the IPv4 address shown on your router's WAN or Internet status page, and
- the public IPv4 address seen by a website.
You can check your public address using the IPScope Public IP Lookup .
Then compare it with the WAN address shown by your router.
What does it mean if the two IP addresses are different?
A difference can indicate that another NAT layer exists upstream.
CGNAT is one possible reason, but not the only one.
Other possibilities include:
- a VPN,
- a proxy,
- multiple routers using NAT,
- mobile network infrastructure,
- or another provider-managed gateway.
Step-by-step CGNAT check
- Open your router's administration interface.
- Find the WAN, Internet, or connection status page.
- Write down the IPv4 address assigned to the WAN interface.
- Open IPScope and check the public IPv4 address visible to the internet.
- Compare the two addresses.
If the router shows an address such as:
but IPScope shows a different public IPv4 address, CGNAT is very likely.
Where can I find the WAN IP on my router?
The exact menu depends on the router manufacturer.
Common names include:
- Internet Status,
- WAN Status,
- Connection Status,
- Network Status,
- or Broadband Status.
If you need help accessing the router itself, read: How to Find Your Router IP Address on Windows, Mac, Android, and iPhone .
Does CGNAT affect internet browsing?
For ordinary web browsing, streaming, and many applications, CGNAT may be largely invisible to the user.
Outbound connections can normally pass through CGNAT in much the same way they pass through a home NAT router.
The main limitations appear when an application requires unsolicited inbound connections from the public internet.
Why does CGNAT affect port forwarding?
Traditional port forwarding assumes that the public IP address belongs to your own router.
You can then tell the router:
Under CGNAT, your router may not own the actual public IPv4 address.
The ISP's CGNAT gateway is another device performing translation before traffic reaches your router.
Because you usually cannot configure that provider gateway, inbound traffic cannot simply be forwarded through it using your home router settings.
Does CGNAT prevent all inbound connections?
Not necessarily in every architecture, but traditional unsolicited inbound IPv4 connectivity is commonly restricted.
Providers may offer alternatives such as:
- a dedicated public IPv4 address,
- a static IPv4 option,
- business internet plans,
- IPv6 connectivity,
- or provider-specific port-mapping services.
Can online games be affected by CGNAT?
Yes, some online games and peer-to-peer applications can be affected.
Possible symptoms include:
- strict NAT status,
- difficulty hosting games,
- problems establishing peer-to-peer sessions,
- or reduced compatibility with some voice and multiplayer systems.
Modern applications often use relay servers or NAT traversal techniques, so the effect varies by service.
Can CGNAT affect remote access?
Yes.
Services that depend on direct inbound IPv4 connections can be difficult to reach through CGNAT.
Examples may include:
- self-hosted web servers,
- remote desktop services,
- home security systems,
- NAS devices,
- game servers,
- and some VPN server configurations.
Does CGNAT affect torrents and peer-to-peer applications?
It can.
Outbound peer-to-peer connections generally work, but accepting inbound connections may be limited.
This can reduce the number of peers able to connect directly to your device, depending on the application and its NAT traversal mechanisms.
Does CGNAT make the internet safer?
CGNAT can reduce direct unsolicited inbound IPv4 connectivity, but it should not be treated as a complete security system.
Devices still need:
- software updates,
- strong passwords,
- secure router configuration,
- firewalls,
- and appropriate authentication.
Security should not depend on NAT alone.
Does CGNAT improve privacy?
Sharing a public IPv4 address means multiple subscribers may appear to use the same public address.
However, this does not provide anonymity.
ISPs can maintain translation and connection records, and websites can use many other signals such as:
- cookies,
- account logins,
- browser characteristics,
- device identifiers,
- and other tracking technologies.
For more context, read IP Privacy and Security .
Does CGNAT change your public IP?
The public IP visible to websites belongs to the provider's CGNAT-facing infrastructure.
That public address may change according to the provider's network design and address allocation policies.
It may also be shared simultaneously by multiple customers.
Can multiple customers really use the same public IPv4 address?
Yes.
NAT distinguishes connections using information including port numbers and connection state.
This allows many internal connections from different customers to share one public IPv4 address.
CGNAT and port numbers
Port numbers are essential to large-scale NAT because they help the translation system keep different connections separate.
To understand network ports in more detail, read: What Does a Port Number Mean? .
Can IPv6 solve the CGNAT problem?
IPv6 provides an enormous address space compared with IPv4.
A properly deployed IPv6 network can provide globally routable addresses without requiring IPv4-style address sharing for every connection.
However, IPv6 does not automatically mean that every inbound connection will be allowed.
Firewalls can still block unsolicited traffic, and network policies still apply.
Learn more in IPv4 vs IPv6 .
Can a connection use both CGNAT and IPv6?
Yes.
Many providers operate dual-stack or mixed networks where:
- IPv4 traffic passes through CGNAT,
- while IPv6 traffic uses native IPv6 connectivity.
In that situation, IPv4 inbound limitations may coexist with globally routable IPv6 addresses.
How can I get out of CGNAT?
The available options depend entirely on your ISP.
You can ask whether the provider offers:
- a public IPv4 address,
- a static IP option,
- a business connection,
- native IPv6,
- or another service intended for inbound connectivity.
Does a public IP have to be static?
No.
A public IP address can be either dynamic or static.
The important distinction for CGNAT is whether the public address is actually assigned to your connection rather than shared behind the provider's NAT system.
Learn more in Dynamic vs Static IP .
CGNAT vs double NAT
CGNAT and double NAT can produce similar symptoms, but they are not identical.
Double NAT often occurs when two routers on the user's own network both perform NAT.
For example:
CGNAT adds another NAT layer controlled by the ISP.
How can I distinguish CGNAT from double NAT?
Check the WAN address on the router connected directly to your ISP.
If that router receives a public IPv4 address that matches the public address seen by websites, CGNAT is less likely.
If the WAN address is private or in the shared 100.64.0.0/10 range while websites see a different public address, an upstream NAT layer exists.
Can a VPN bypass CGNAT?
A VPN can create an outbound tunnel through CGNAT, so ordinary VPN client use usually works.
Some VPN or tunneling services can also provide a reachable endpoint or port-forwarding feature.
However, simply connecting to a normal consumer VPN does not automatically give your home router a directly reachable public IPv4 address.
For more information about VPN addressing, read: VPN and IP Addresses .
Can CGNAT cause CAPTCHA or rate-limit problems?
It can contribute in some situations.
Because many users can share one public IPv4 address, a website may observe a large amount of traffic coming from that same address.
Depending on the site's security systems, this can occasionally contribute to:
- CAPTCHA challenges,
- temporary rate limits,
- or reputation-related restrictions.
Websites may also use many other signals, so CGNAT is not necessarily the cause of every such issue.
CGNAT FAQ
Is 100.64.x.x a public IP address?
The range 100.64.0.0/10 is shared address space reserved for service-provider NAT use. It is not ordinary globally routable public IPv4 space.
Can I port forward with CGNAT?
Traditional IPv4 port forwarding from the public internet usually does not work unless the ISP provides additional support or a public address.
Does CGNAT affect Wi-Fi?
CGNAT operates upstream in the provider's network and is separate from the Wi-Fi connection between your device and local router.
Can mobile networks use CGNAT?
Yes. Mobile networks commonly use large-scale NAT and shared addressing.
Can fiber internet use CGNAT?
Yes. The physical access technology does not determine whether an ISP uses CGNAT.
How do I know for certain whether I am behind CGNAT?
Comparing the router WAN address with the public address is a useful indication. For definitive confirmation, contact your ISP and ask whether your connection is assigned a public IPv4 address or uses CGNAT.
CGNAT allows an internet provider to share public IPv4 addresses among multiple customers. It usually does not interfere with ordinary web access, but it can prevent traditional inbound IPv4 connections and port forwarding. Comparing your router's WAN address with the public IPv4 address seen by IPScope is one useful way to determine whether an upstream NAT layer may be present.
Related IPScope guides
Learn the difference between local and internet-facing addresses in Public vs Private IP .
Learn whether an IP can change in Dynamic vs Static IP .
Understand how network ports work in What Does a Port Number Mean? .
Compare IPv4 with the much larger IPv6 address space in IPv4 vs IPv6 .
Or use the IPScope Public IP Lookup to check the public address currently visible from your connection.
