What Is CGNAT? How Carrier Grade NAT Affects Home Networks and Port Forwarding

CGNAT (Carrier Grade NAT) is a technology that allows internet providers to let multiple subscribers share a single public IPv4 address. For regular web browsing, streaming, or using apps, users typically won't notice any difference. Issues begin when you need to accept incoming connections from the internet: opening a port, running a home server, connecting directly to a NAS, or hosting a game server can become problematic.

What Makes CGNAT Different?

The main feature of CGNAT is that address translation happens not only on your home router but also within the provider's network. This means you don't control the external public IP directly, and standard port forwarding on your router no longer solves the problem.

What Is CGNAT and Why Do ISPs Use It?

CGNAT stands for Carrier Grade NAT - essentially NAT at the operator level. The logic is similar to the NAT in your home router, but instead of just handling a handful of devices in one household, it's used by ISPs to serve large numbers of subscribers at once.

Imagine a typical home network. Your computer, smartphone, TV, and gaming console all get local IPs like 192.168.1.x. The home router combines their traffic and sends it to the internet via a single external IPv4 address. Externally, all devices look like one user.

How Is Carrier Grade NAT Different From Regular NAT?

With regular NAT, your router receives a public IPv4 address directly from the ISP and handles all traffic translation itself. With CGNAT, there's an extra level of translation: your router gets an internal address from the provider's network, and the provider's equipment then combines traffic from many customers, sending it out through a shared public IPv4.

This creates a two-level structure. Your home router does the first translation, but the second happens at the provider's side. You can control the first, but not the second.

Why Don't You Notice CGNAT for Outgoing Connections?

When you open a website or app, the connection is initiated from your home network to the outside. The provider's equipment registers this request and routes the response back to you correctly. But for incoming connections - when someone tries to reach you from the internet - the provider's hardware doesn't know which customer should receive the request, and you can't set up such rules yourself.

Why Do Providers Use CGNAT?

The main driver behind the adoption of CGNAT is the shortage of IPv4 addresses. IPv4's 32-bit address space limits the number of unique addresses to about 4.3 billion, many of which are reserved or already allocated to organizations and ISPs. Meanwhile, the number of connected devices keeps growing, making it expensive or technically difficult for ISPs to give every customer a unique public IPv4.

CGNAT lets a single public address be used for multiple connections, distinguishing customers not only by IP but by TCP/UDP ports, creating separate translation records for each active session. This lets providers conserve their limited IPv4 pool and continue signing up new customers without assigning each one a unique address. For most users, this doesn't affect daily internet use - unless they need to accept incoming connections.

The long-term solution is IPv6, with its vastly larger address space. But since IPv4 is still widely used, CGNAT remains a crucial part of many ISPs' infrastructure.

How CGNAT Works: What Happens to Your Connection?

To understand why CGNAT blocks incoming connections, let's trace a typical request from your home computer to a website.

Without CGNAT:

• Device → Home router → Internet

Your computer might have a local IP like 192.168.1.10, and your router a public IPv4 (e.g., 203.0.113.25). When you access a site, the router swaps the local address for its own public one and keeps track of which device to send the response to.

With CGNAT:

• Device → Home router → ISP network → CGNAT → Internet

Your router first does its own address translation, then the packet enters the provider network, where another translation replaces your internal address with a shared public IPv4 used by many customers. For example, your router may get 100.70.15.24 from the provider, but websites will see a completely different IPv4 - the one CGNAT uses for outbound traffic.

The provider's equipment maintains a table of active connections, mapping internal IPs and ports to external ones so responses find their way back. This works seamlessly for outbound connections, because CGNAT "remembers" the request. For incoming connections where there's no table entry, the provider hardware can't determine which customer the packet is for.

Grey vs. Public IPs and CGNAT

A public ("white") IP is accessible from the global internet and can uniquely identify your connection. If your router has a public IPv4, you can set up rules for incoming connections yourself. A grey address is only used inside the provider's network and isn't directly routable from the internet.

CGNAT uses a special range:

• 100.64.0.0 - 100.127.255.255 (100.64.0.0/10)

If your WAN interface has an address in this range, it can't be used for direct internet connections. From outside, you'll appear under a different public IPv4 owned by the CGNAT gateway.

ISPs may also use standard private ranges:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

If your WAN address is in any of these ranges, there's an extra NAT above your router, though it's not always CGNAT specifically.

A practical sign of CGNAT is a mismatch between your router's WAN IP and the public IP shown by web services. This means your public address is farther upstream in the provider's network.

CGNAT is built on the same basic principles as home NAT, but operates on provider infrastructure and serves many customers at once. For a deeper explanation, check out our article NAT made simple: why online games and P2P don't work.

Why Port Forwarding, Games, and P2P Break With CGNAT

The main limitation of CGNAT is with incoming connections. As long as you initiate the connection (to a website, server, or online service), the provider's equipment sees the outgoing request and can return the response. But when someone tries to connect to your device from the internet, CGNAT doesn't know where to send the traffic.

Why Port Forwarding Doesn't Help

With a regular public IPv4, you can open a port on your home router and direct incoming traffic to a device in your network. For example, port 25565 for a Minecraft server or 443 for a web service. If your router has the public IP, internet requests reach it and are forwarded to the right device.

With CGNAT, this rule only works inside your home network. Incoming requests may never reach your router at all. The traffic first hits the provider's shared IPv4, behind which many customers reside, and you can't set forwarding rules on the provider's CGNAT gateway. No matter how perfectly you set up port forwarding, you only control the first NAT - the second, crucial one, is managed by your ISP.

CGNAT Issues in Online Games and P2P

Most modern games use central servers, so CGNAT rarely interferes with matchmaking, downloading updates, or playing on official servers. Problems arise in games or apps that need direct device-to-device connections - like some P2P systems, older multiplayer games, voice chat apps, or when a player hosts a session.

Here, you might see errors like Strict NAT, NAT Type 3, or closed NAT. While many services use NAT traversal or relay servers to help two clients connect even behind NAT, if both users have strict CGNAT, direct P2P may be impossible - forcing traffic through relays, which can increase latency or limit features.

Why CGNAT Blocks Home Servers

Limitations are most obvious if you want to host a service at home - like a Minecraft server, website, NAS, security camera system, FTP, remote desktop, etc., that needs to be accessible from the internet. Say your NAS has 192.168.1.20 and you set up port forwarding. Locally it works, but external attempts to connect via your provider's public IP fail because the request is stopped at the CGNAT gateway.

This is especially relevant for self-hosted storage. For more details on how these systems work and what they're used for, see our guide Home NAS server vs. the cloud: how to choose and set up your own storage.

CGNAT doesn't make home servers impossible - it just blocks the usual way of accessing them via public IPv4 and port forwarding. To connect externally, you'll need alternatives: a public IP from your provider, IPv6, or a tunnel through an external server.

How to Check if You're Behind CGNAT

You don't need special tools to check for CGNAT. The easiest way is to compare the IP your router receives from your provider (WAN IP) with the public IP you appear as on the internet.

Comparing WAN and External IPs

First, log into your router's web interface and find the WAN IP, Internet IP, or IPv4 Address. Then, use any online service to check your public IP.

If both addresses are the same, there's likely no CGNAT - you probably have a public IPv4. If they're different, your traffic passes through an additional NAT layer, a strong sign you're behind CGNAT.

For example:

• Router WAN IP: 100.72.18.5
• External IP: 198.51.100.42

This mismatch means your router doesn't have a public address directly; the ISP's equipment changes it before it goes out to the internet.

However, a difference alone doesn't always mean CGNAT - your provider could be using another NAT scheme. Check if the WAN address falls into one of these ranges:

• 100.64.0.0/10 (100.64.0.0 - 100.127.255.255) - the official CGNAT range
• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

If so, it's a clear sign of extra NAT in your connection. The test is even more reliable if multiple conditions are met: WAN IP differs from the external IP, is in a private or CGNAT range, and port forwarding doesn't work for external connections.

You can also contact your ISP's support to ask if you're assigned a public IPv4 or behind CGNAT, especially if their network setup is non-standard.

Check for CGNAT primarily if port forwarding fails, you can't connect to a home server, or your games always report strict NAT. If your public IPv4 is on the ISP's end, changing your router's settings won't help - the limitation is upstream.

How to Bypass CGNAT and Access Your Home Network

CGNAT can't be disabled via your home router, since the translation happens on the ISP's equipment. If you need direct remote access, you'll have to resolve it with your provider or use a workaround.

Get a Public IPv4 From Your Provider

The simplest option is to request a public IPv4 address from your ISP. The service may be called "white IP," "external IP," "public IPv4," or "static IP." Once assigned, CGNAT is typically disabled for your connection, and your router's WAN IP becomes publicly accessible, letting you use standard port forwarding again. A static address is best if you need your server always available at the same IP. A dynamic public IPv4 also works, though it may change; in that case, DDNS can map your domain to your current address.

Before ordering, confirm with your provider that you're getting a true public IPv4 - sometimes "static address" doesn't guarantee internet-wide accessibility.

Use IPv6

Another option is to use IPv6. Its address space is so large that providers don't need CGNAT. If your ISP offers full IPv6, your home device can get a globally routable address, allowing incoming connections without classic IPv4 NAT and port forwarding.

Be aware, though, that opening access isn't automatically safe. Routers typically use firewalls to block unwanted inbound connections, so you'll still need to set up access rules for your server. Also, the client connecting to your home server must support IPv6, so this isn't always a full replacement for a public IPv4.

For more on the differences between these protocols and why the internet is moving to IPv6, see our article IPv4 vs. IPv6: key differences and why the internet needs both.

Tunnels and Relay Servers

If you can't get a public IP, you can create an outgoing connection from your home network to a server with a public address. Since CGNAT generally doesn't block outgoing connections, this channel stays open for reverse access.

One approach is to use a VPS with a public IP: your home server maintains a tunnel to the VPS, and incoming connections hit the VPS first before being routed to your home. Similarly, reverse tunnels and specialized remote access services work by initiating the connection from inside your network, bypassing the need to open ports on the CGNAT gateway.

This is handy for NAS, game servers, control panels, smart home systems, and remote desktop. The traffic simply takes an alternative route via an available external point - CGNAT remains in place, but is sidestepped.

For most users, the order of solutions is simple: if your provider offers public IPv4 affordably, get it. If full IPv6 is available, use it for modern services. If neither is possible, use a tunnel through an external server or a specialized service.

Conclusion

CGNAT enables ISPs to serve many subscribers with a single public IPv4. For browsing, streaming, and most apps, you won't notice it - because connections start from your home and the operator's equipment routes replies back to you.

Limitations appear when you need inbound connections. Because of the extra NAT at the provider's end, typical port forwarding won't work, and some P2P services, games, or home servers can't accept connections directly from the internet.

If you want to host a NAS, game server, or other service at home, first check your router's WAN IP and compare it to your public IP. If you confirm you're behind CGNAT, the most direct fix is to get a public IPv4 from your provider. Alternatives include using IPv6 or tunneling through an external server.

CGNAT isn't a malfunction - it's a compromise that helps providers conserve scarce IPv4 addresses, but it also limits users who need full inbound access to their home networks.