You followed the port-forwarding guide to the letter: you opened the port, pointed it at the right device, and saved the rule. A port checker still says it is closed. Or perhaps you just cannot reach your home security camera, NAS, or game server from outside the house, no matter what you change. Before you blame your router, there is a good chance the real culprit lives one hop upstream, inside your internet provider's network. It is called CGNAT, and a growing number of home connections sit behind it.

What is CGNAT?

CGNAT stands for Carrier-Grade Network Address Translation (you will also see it written as CGN, or LSN for Large-Scale NAT). It is the same basic idea as the NAT your own router already performs, but run at a much bigger scale by your internet service provider.

Your home router uses NAT so that every device on your network can share the single public IP address your provider gives you. CGNAT adds a second layer of translation upstream: the provider shares one public IPv4 address among many customers at once. Instead of handing each household a unique public address, the ISP gives you an address from a shared pool and translates it again inside its own network. The result is two layers of NAT stacked back to back - one you control (your router) and one you do not (the carrier's).

Why ISPs use CGNAT

It comes down to math. The original IPv4 addressing scheme has room for about 4.3 billion addresses - a number that felt limitless in the 1980s and is nowhere near enough for the tens of billions of devices online today. The regional registries that hand out IPv4 blocks began running dry years ago; ARIN, which covers North America, exhausted its free pool back in 2015.

Buying additional IPv4 addresses on the open market is expensive, so rather than give every customer a scarce public address, providers conserve them by putting large groups of subscribers behind a shared pool. CGNAT lets an ISP serve thousands of homes with a fraction of the public addresses that would otherwise be required. The real long-term fix is IPv6, which has effectively unlimited address space - but until IPv6 is everywhere, CGNAT is how carriers stretch the IPv4 they have.

CGNAT vs. double NAT

CGNAT is easy to confuse with double NAT, and while the two are related, they are not the same problem. Double NAT usually happens inside your own home - typically when your ISP's gateway is left in router mode and you connect a second router behind it, so traffic passes through two routers you can both see and control. You can fix double NAT yourself by putting one of those devices into bridge mode.

CGNAT is double NAT you cannot reach. The extra layer lives inside the carrier's network, not your living room. You cannot log into it, cannot configure it, and cannot switch it off from your router. That distinction matters, because the fixes are completely different: bridge mode solves double NAT but does nothing for CGNAT.

How to tell if you are behind CGNAT

There is a quick, reliable test. You are simply comparing two numbers:

  1. Your router's WAN IP. Log into your router's admin page and find the WAN (or Internet) IP address on the status screen. If you need help getting in, see how to access your router settings.
  2. Your public IP. From any device on the network, visit a "what is my IP" site or run curl ifconfig.me in a terminal. This is the address the rest of the internet actually sees.

Now compare them. If the two addresses match, you have a normal public IP and you are not behind CGNAT. If they are different, your provider is translating your traffic somewhere upstream - and that is CGNAT.

There is an even more definitive tell. RFC 6598 set aside a special block, 100.64.0.0/10 (addresses from 100.64.0.0 through 100.127.255.255), specifically as "shared address space" for carrier NAT. If your router's WAN address starts with anything from 100.64.x to 100.127.x, you are behind CGNAT, full stop. A private-style WAN address (such as 10.x.x.x) that does not match your public IP is another strong sign.

Which ISPs use CGNAT

CGNAT turns up wherever public IPv4 is scarcest:

  • Mobile and 5G / fixed-wireless home internet. The major US fixed-wireless services - T-Mobile Home Internet, Verizon 5G Home, and AT&T Internet Air - place residential customers behind CGNAT by default. Their gateways simply have no public IPv4 address on the WAN side, which is why the port-forwarding page on these devices appears to work but changes nothing. See our guide to 5G home internet for more on how these plans behave.
  • Starlink. Starlink Residential and Roam plans use CGNAT, which is why subscribers often see a WAN address in the 100.64 range. Starlink has also documented a cap on the number of concurrent connections (sessions) a customer can hold open at once - reported at 1,200 - after which the oldest connections are dropped.
  • Newer and smaller ISPs. Many regional fiber, cable, and wireless providers that did not stockpile IPv4 years ago now run at least some customers through CGNAT.

Because these policies change and vary by market, treat the specifics above as a snapshot rather than a permanent rule. The only way to know your own situation for certain is the WAN-versus-public-IP test above.

What CGNAT breaks - and what it does not

For everyday use, CGNAT is invisible. Browsing, streaming, video calls, online-game matchmaking, and cloud-connected smart-home gadgets all rely on outbound connections that your own device starts, and those work normally behind CGNAT. Most people never notice it is there.

The trouble starts when something on the internet needs to reach into your network unprompted. Behind CGNAT, these typically break:

  • Port forwarding and self-hosting. Running a game server, forwarding a port to a Plex or Home Assistant box, or hosting your own website all depend on inbound connections that CGNAT blocks.
  • Remote access to home devices. Reaching security cameras, a NAS, or a home desktop from outside the house often fails.
  • Strict NAT in games. Some consoles and titles report a "Strict" or "Moderate" NAT type, which can interfere with party chat and peer-to-peer matchmaking.
  • Inbound VPN servers. A VPN server hosted on your router is unreachable from outside, because there is no public address to connect back to.
  • Shared reputation. Since you share a public IP with strangers, you can inherit their problems - surprise CAPTCHAs, rate limits, or the occasional IP ban triggered by someone else on the same address.

Notice the common thread: if a task requires an unsolicited connection to open a port on your side, CGNAT is what stops it. If you are weighing the trade-offs of opening ports in the first place, our note on whether port forwarding is safe is worth a read.

How to work around CGNAT

If you genuinely need inbound access, here are the realistic options, from easiest to most involved.

  • Use an overlay (mesh) VPN - the modern answer. Tools like Tailscale, ZeroTier, and Nebula build a private network between your devices by having each one make an outbound connection to a coordination service. Because nothing needs an inbound port, they sail straight through CGNAT and work on almost any connection. For most people who just want to reach their own devices remotely, this is the simplest fix, and the free tiers are generous.
  • Expose a single web service with a tunnel. If you only need to publish a website or dashboard, a service such as Cloudflare Tunnel runs a small outbound agent on your network and gives you a public URL - no public IP required.
  • Rent a cheap VPS as a relay. For full control, a small virtual server with a real public IP can act as a middleman: your home connects out to the VPS over WireGuard or an SSH reverse tunnel, and the VPS forwards outside traffic back in. More setup, but very flexible.
  • Ask your ISP to take you off CGNAT. Some providers will assign a genuine public or static IPv4 address on request, occasionally for a small monthly fee. It never hurts to ask - though fixed-wireless and satellite carriers frequently cannot offer one.
  • Use IPv6 if your provider offers it. Many CGNAT'd networks still hand out real, globally routable IPv6 addresses with no NAT at all. If both ends of the connection support IPv6, you can often reach your home services directly over IPv6 and sidestep the IPv4 CGNAT entirely.

What will not help: putting your router in the "DMZ", buying a fancier gaming router, or subscribing to an ordinary commercial VPN - none of these change what the carrier does upstream (unless the VPN specifically advertises port forwarding). Chasing those is the most common way people lose an afternoon to this problem.

Bottom line

CGNAT is a side effect of the internet running out of IPv4 addresses, and for the majority of households it causes no visible problems at all. It becomes an obstacle only when you want to host something or reach your own network from outside. If that is you, run the two-minute WAN-versus-public-IP check to confirm what you are dealing with. When CGNAT is the answer, an overlay network like Tailscale - or native IPv6 - will usually get you back in without waiting on your ISP.

Sources