What Is CGNAT? How to Tell If You Are Behind It

CGNAT, or carrier-grade NAT, means your internet provider shares one public IPv4 address between many customers. Browsing, streaming and email work as normal, but anything that needs the internet to reach you, such as port forwarding, hosting a game server or remote access to a camera, usually fails. The quickest check is to compare the WAN address in your router with the public IP shown on our IP checker. If they differ, you are probably behind CGNAT.

What is CGNAT?

CGNAT is a second layer of address sharing, run by your provider. At home, your router already uses NAT to put every device behind one address. With CGNAT, that address is not public either: the provider's equipment shares one public IPv4 address among several subscribers, which is how RFC 6888 defines a carrier-grade NAT. Providers do this because they do not have a public IPv4 address for every customer.

Outgoing connections are fine, because the provider's NAT remembers who started each one and sends the replies back. Incoming connections are the problem. When a packet arrives at the shared public address unasked, the provider has no way to know which of its customers it is for, so it is dropped.

What is 100.64.0.0/10?

100.64.0.0/10, the range from 100.64.0.0 to 100.127.255.255, is the address block set aside for CGNAT. RFC 6598 calls it Shared Address Space and reserves it for providers to number the link between their CGNAT equipment and your router. It is separate from the private ranges in RFC 1918, and packets using it must not cross from one provider's network to another. If your router's WAN address starts with 100.64 through 100.127, you are behind CGNAT.

How to tell if you are behind CGNAT

Open your router's admin page and find its WAN or Internet IP address. Our guide to finding your router's IP address shows how to get in.
Open the ipcomet home page and note your public IPv4 address.
Compare the two using the table below.

Router WAN address	What it means
Same as your public IP	No CGNAT. You have your own public IPv4 address.
Between 100.64.0.0 and 100.127.255.255	CGNAT. This is the shared address range from RFC 6598.
Private: 10.x.x.x, 172.16.x.x to 172.31.x.x, or 192.168.x.x	Double NAT. Either another router of yours sits in front, or your provider runs CGNAT with private addresses.
A different public address	Usually CGNAT or a provider proxy. Ask your provider.

A traceroute gives a second opinion. Run tracert 1.1.1.1 on Windows or traceroute 1.1.1.1 on a Mac. If one of the first hops after your router has an address between 100.64 and 100.127, your traffic passes through the provider's CGNAT.

What does CGNAT break?

RFC 7021 reports tests of common applications behind CGNAT. Web browsing, email, video streaming and video calls kept working. The problems clustered around anything that needs an incoming connection:

Servers inside the home, such as an FTP server, could not be reached.
Peer-to-peer apps that wait for incoming connections failed. BitTorrent could download but not seed.
Peer-to-peer gaming failed in some setups, including two players behind the same CGNAT address trying to connect to each other.
IP-based location and abuse tracking get harder, because many customers share one address.

That last point affects you too. If someone else on your shared address gets it blocked by a website or listed for spam, you can see CAPTCHAs or blocks you did nothing to earn. Our IP reputation check shows whether your current address is on common blocklists.

CGNAT vs double NAT

Double NAT is two routers in your own home, for example your provider's modem-router with your own router plugged in behind it. You can fix it yourself by putting the first device into bridge mode or forwarding the port on both. CGNAT happens inside the provider's network, so no setting on your side removes it. The port forwarding guide covers the double NAT fix.

How to get around CGNAT

Ask your provider for a public IPv4 address. Some offer it on request or as an add-on, and it removes CGNAT for your connection.
Use IPv6 if your provider offers it. IPv6 has enough addresses for every device, so incoming connections over IPv6 do not go through NAT, though your router's firewall still has to allow them.
Use a tunnel. Services such as Cloudflare Tunnel run a small program on your machine that connects out to their network, so your service is reachable without a publicly routable IP address or an open inbound port.
Use a VPN provider that offers port forwarding. Incoming traffic then arrives at the VPN's public address and comes down the tunnel to you.

The standard for CGNAT equipment, RFC 6888, also requires support for a protocol that lets subscribers request their own mappings, normally the Port Control Protocol. Whether your provider turns it on is another matter, so ask.

Frequently asked questions

Is CGNAT bad?

For browsing, streaming and calls it is usually unnoticeable. It is a problem if you host anything at home, need port forwarding for a game or camera, or share an address that gets blocked.

Does CGNAT slow down my internet?

Not much for everyday use. In the RFC 7021 tests, single video streams played with somewhat longer buffering, and some large transfers ran slower in one setup. Raw speed mostly depends on your plan and Wi-Fi.

Is 100.64.x.x a private IP address?

Not in the RFC 1918 sense. It is Shared Address Space reserved for providers, and like private addresses it is not reachable from the public internet.

Why does my IP address show a different city?

Behind CGNAT, the public address belongs to the provider's equipment, which may sit in another city. Our guide on why your IP location is wrong explains the other causes.

Sources and further reading

Try it yourself

See the real numbers for your own connection with our free tools.