Carrier-Grade NAT: Why Your Public IP Isn't Yours

Carrier-grade NAT (CGNAT) is a mechanism ISPs use to share a single public IPv4 address among many customers. If your connection is behind CGNAT, the public address your router displays is not exclusively yours; it is shared with other subscribers. This page explains how to recognize CGNAT, what it means for port forwarding and inbound connections, and which limitations are beyond your control.

What Is CGNAT?

CGNAT, also known as NAT444, is a large-scale network address translation deployed by internet service providers. It allows multiple customers to share a single public IPv4 address. The ISP’s equipment performs NAT between the customer’s private network and the public internet. From your perspective, your router’s WAN interface gets a private address (such as 100.64.0.0/10) instead of a public one.

CGNAT is used because IPv4 addresses are exhausted. It is a temporary measure until IPv6 becomes universal, but it is widespread and will persist for years.

How to Detect CGNAT in Thirty Seconds

1. Check your router’s WAN IP. Log into your router and look at the WAN or Internet status. If the address is in the range 100.64.0.0 to 100.127.255.255 (100.64.0.0/10), you are behind CGNAT. This range is reserved for shared address space.
2. Compare with your public IP. Visit a website like ifconfig.me or whatismyip.com and note the public IP shown. If the router’s WAN IP is private (e.g., 192.168.x.x, 10.x.x.x, or 100.64.x.x) and does not match the public IP, you are behind CGNAT.
3. Check for a mismatch. If the router’s WAN IP is a private address and the public IP is different, CGNAT is in play.

Command line method: On Windows, open Command Prompt and run:

ipconfig

Look at the IPv4 address of your active adapter. If it is in the 100.64.0.0/10 range, you are behind CGNAT. Note that this is the address on your LAN, not the router’s WAN; you need to see the router’s WAN IP, which is not visible from ipconfig. Use the router’s web interface instead.

Why Your Public Address Is Not Yours

With CGNAT, the public IP address you see on websites is shared by many customers. The ISP’s NAT device maps your private traffic to a public IP and port combination. This means:

• Inbound connections cannot reach you. Because the public IP is shared, the ISP’s NAT cannot know which customer a connection is intended for without explicit port forwarding rules, which are rarely provided.
• Port forwarding on your router is useless. Your router can forward ports to your LAN devices, but the ISP’s NAT will not forward those ports to your router. The port forwarding rules on your router only apply to the private network between your router and the ISP’s NAT, which is not accessible from the internet.
• You cannot host servers or use peer-to-peer applications that require inbound connections.

What You Can and Cannot Fix

Workarounds for CGNAT

While you cannot change the ISP’s NAT, you can work around some limitations:

• Use IPv6. If your ISP provides IPv6, your devices can have public IPv6 addresses, and inbound connections can work over IPv6. Enable IPv6 on your router and devices.
• Use a VPN with port forwarding. Some VPN providers offer port forwarding on their servers. This allows inbound connections to your VPN IP, which then forwards to your device. This works because the VPN server has a public IP and can forward ports.
• Use a tunnel service. Services like ngrok or Cloudflare Tunnel create outbound connections to a public server, which then forwards traffic to you. This works without inbound connections.
• Use a relay server. For gaming or file sharing, some applications support relay servers that mediate connections.

What People Get Wrong About CGNAT

A common mistake is to spend hours configuring port forwarding on the router, convinced that the problem is a misconfiguration. This is a natural mistake because the router’s interface suggests port forwarding should work. The truth is that CGNAT makes port forwarding irrelevant because the ISP’s NAT is upstream of your router.

Another misconception is that a VPN will solve all CGNAT problems. While a VPN can hide your IP and bypass some restrictions, it does not give you a public IP. Inbound connections to your VPN IP will not reach your device unless the VPN provider offers port forwarding. Many VPNs do not, so the problem persists.

Finally, some believe that resetting the router or changing DNS settings will fix CGNAT. These actions have no effect because CGNAT is implemented at the ISP level, not on your equipment.

How to Request a Public IP

If you need inbound connections, contact your ISP and ask for a public IPv4 address. Many ISPs offer this as a paid add-on, often called a “static IP” or “business plan.” Be prepared to explain why you need it (e.g., for a home server or security cameras). Some ISPs may provide a public IP for free upon request, but this is not guaranteed.

Summary of Detection Steps

1. Log into your router and note the WAN IP.
2. Visit a website that shows your public IP.
3. If the WAN IP is private (100.64.0.0/10, 192.168.x.x, 10.x.x.x) and differs from the public IP, you are behind CGNAT.
4. If you need inbound connections, contact your ISP for a public IP or use a workaround.

When CGNAT Is Not the Problem

If your router’s WAN IP is a public IP (not in private ranges), you are not behind CGNAT. In that case, port forwarding should work if configured correctly. If inbound connections still fail, the issue may be a firewall, incorrect port forwarding rules, or the application not listening on the correct port.

Related Issues

• Double NAT: If your router is connected to another router that performs NAT, you may have similar symptoms. Check if your WAN IP is a private address like 192.168.x.x; if so, you are behind a second NAT, which may be your ISP’s CGNAT or your own equipment.
• IPv4 Exhaustion: CGNAT is a result of IPv4 address exhaustion. IPv6 adoption is the long-term solution.

Commands to Diagnose

On Windows, use these commands to check your network configuration:

ipconfig /all

This shows your IP configuration. Look for the IPv4 address of your active adapter. If it is in the 100.64.0.0/10 range, you are behind CGNAT. Note that this is your LAN IP, not the router’s WAN IP; to see the WAN IP, you must log into your router.

nslookup myip.opendns.com resolver1.opendns.com

This command queries OpenDNS to display your public IP. If it differs from your router’s WAN IP, you are behind CGNAT.

Conclusion

Carrier-grade NAT is a reality for many internet users. Recognizing it early saves hours of futile troubleshooting. If you need inbound connections, the only reliable fix is to obtain a public IPv4 address from your ISP. Otherwise, use IPv6 or a VPN with port forwarding to work around the limitations.