You look up your IP address, then check the address your router says it has, and they don't match. Or a site keeps throwing CAPTCHAs at you, or a game says your NAT type is strict no matter what you change. There's a good chance your ISP has put you behind carrier-grade NAT, and the public address you think of as yours is shared with other customers.
IPv4 has about 4.3 billion addresses, and they ran out years ago. IANA handed its last blocks to the regional registries in 2011, and ISPs have been rationing ever since. New providers, mobile networks and fast-growing fibre companies often simply can't get enough addresses to give every customer one.
The proper long-term fix is IPv6, which has room for everyone. But plenty of websites and services still need IPv4, so ISPs need a way to stretch the addresses they have. CGNAT is that stretch: the same trick your home router uses, applied again at the ISP's end.
At home, your router does NAT. Every device on your network has a private address, and the router rewrites outgoing traffic so it all appears to come from the router's one public address. Our guide to NAT and port forwarding covers that layer in detail.
With CGNAT, your router doesn't get a public address either. It gets a private one from the ISP, and a large NAT box inside the ISP's network does the same rewriting again. Your traffic is translated twice, once by your router and once by the carrier, and comes out on a public address shared by many subscribers.
RFC 6598 reserved a block specifically for the link between the carrier's NAT and customer routers: 100.64.0.0/10, which runs from 100.64.0.0 to 100.127.255.255. It's separate from the familiar home ranges like 192.168.x.x so it doesn't collide with whatever you use on your LAN. The RFC also says packets from this range must not cross between providers, so it never appears on the public internet. We cover where it fits alongside the other reserved ranges in private IP address ranges.
How do many customers share one address without their traffic getting mixed up? Ports. Each connection gets a different source port on the shared address, and the carrier's NAT tracks which port maps to which customer. Many carriers hand each customer a fixed block of ports, which also makes it easier to trace activity back to a subscriber later. RFC 7422 describes that deterministic approach.
Compare two addresses. First, find your public IP with our IP lookup, or from a terminal:
curl -4 ifconfig.meThen log into your router and find its WAN or internet address. If the two match, you have a public address of your own. If they don't, there's another NAT between you and the internet.
Check the range. A router WAN address anywhere from 100.64.0.0 to 100.127.255.255 is a clear sign of CGNAT. Some ISPs use other private ranges, such as 10.x.x.x, for the same purpose, so a mismatch in step one matters more than the exact numbers.
Run a traceroute. The first hop is your own router. If the next hop or two are 100.64 to 100.127 addresses, you're looking at the carrier's internal network:
traceroute example.comOur guide to reading a traceroute explains the rest of the output.
Mobile networks use CGNAT very widely, so tethering a laptop to your phone is an easy way to see it in action.
Incoming connections. This is the big one. Nothing on the internet can start a connection to you, because the carrier's NAT has no idea which customer should receive it. Port forwarding on your router doesn't help, since the second NAT is the one blocking you. Hosting a game server, running a home web server, reaching your NAS or cameras remotely: none of it works directly. You can confirm with our port scanner against your public address. Everything will show closed or filtered.
Games and peer-to-peer apps. Consoles may report a strict or moderate NAT type, and voice chat or matchmaking can struggle. Most modern games relay traffic through servers when direct connections fail, so it's usually a nuisance rather than a blocker.
Reputation you didn't earn. Websites see the shared address, not you. If someone else on it is sending spam, scraping or hammering a login page, the whole address can land on a blocklist or hit a rate limit. That's where the endless CAPTCHAs come from. An IP-based ban from a forum or game can catch you too. Our blacklist check will show whether your current public address is listed, though with CGNAT there isn't much you can do about it yourself.
Geolocation. A shared address may be registered to wherever the carrier's NAT sits, which can be a city or more away. Our post on how accurate IP geolocation is explains why.
Ask your ISP for a public IPv4 address. Many will provide one, sometimes free on request, sometimes as a paid add-on or with a business plan. Ask specifically for a "public" or "static" IPv4 address and mention that you're behind CGNAT.
Use IPv6. If your ISP offers IPv6, each of your devices gets a globally routable address with no carrier NAT in the way. You'll still need to open the relevant port in your router's IPv6 firewall, and whoever connects to you needs IPv6 too.
Use a tunnel or overlay network. Mesh VPN tools and tunnelling services work by having your device connect outwards, which CGNAT allows, and then carrying traffic back through that connection. It's the most practical way to reach your home network remotely without changing your ISP plan.
Not really, and in one sense it's the opposite. It blocks unsolicited incoming connections, which acts a bit like an extra firewall. The downsides are about reachability and shared reputation, not exposure.
Sort of. Cookies, logins and browser fingerprints separate users on a shared address. For tracing abuse, RFC 6302 recommends that servers log the source port and an accurate timestamp as well as the IP, because on a shared address the IP alone doesn't identify anyone.
Usually not by much. Adding a translation step costs very little, and your speed depends far more on the line itself. If you're seeing slow speeds, a speed test is a better starting point.
For outgoing traffic, a VPN gives you the VPN provider's address instead of the shared one, which can end the CAPTCHAs. For incoming connections, only a VPN that offers port forwarding helps, and many don't.
0 comments
No comments yet. Be the first.