What Is CGNAT? Carrier-Grade NAT and Why Your IP Isn't Really Yours

You already share one public IP among your household's devices thanks to NAT. CGNAT (carrier-grade NAT) applies the same trick one level up: your ISP shares one public IP among hundreds of customers. It's increasingly common — nearly universal on mobile networks — and it changes what your IP address means.

Why ISPs use it

IPv4 addresses ran out. New and growing ISPs can't get enough for one-per-customer, and buying them costs real money (tens of dollars per address). CGNAT lets thousands of subscribers share a small pool, buying time while IPv6 adoption grinds forward.

How to tell if you're behind CGNAT

1. Log into your router and note its WAN address.
2. Check your public IP on our homepage.
3. If they differ, you're behind CGNAT. A WAN address in 100.64.0.0–100.127.255.255 is the giveaway — that range is reserved specifically for CGNAT.

What CGNAT breaks

• Inbound connections — port forwarding is impossible; the shared public IP's ports aren't yours to open. Home servers, camera access and some remote-desktop setups fail.
• Gaming — strict NAT types, worse matchmaking, and occasional bans triggered by other people on your shared IP.
• Reputation collisions — one bad actor among your IP-mates can get the shared address blacklisted or CAPTCHA-flagged for everyone.
• Geolocation — the gateway may sit in another city, so your detected location drifts.

What still works fine

Ordinary browsing, streaming, video calls, most gaming, and anything outbound — the overwhelming majority of what people do. Many users never notice CGNAT at all.

Your options if it's a problem

1. Ask your ISP for a real public IP — many offer one (sometimes free, sometimes a small fee, sometimes only with business plans).
2. Use IPv6 — if your ISP provides it, inbound connectivity works without NAT at all.
3. Tunnel out — VPNs with port-forwarding features, or a cheap cloud server relaying to your home, bypass CGNAT entirely.

Frequently asked questions