CGNAT, or Carrier-Grade NAT, is a technique used by Internet service providers to share the same public IPv4 address between multiple subscribers. It helps operators cope with the shortage of IPv4 addresses, but it can complicate certain uses such as home hosting, remotely accessible cameras or online gaming.
Key takeaways
- CGNAT shares a public IP between multiple customers of an operator.
- It is common on mobile networks and some fibre or cable offerings.
- It can prevent opening inbound ports towards your router.
- IPv6 or a dedicated public IP option can resolve certain blocks.
Why CGNAT exists
IPv4 only provides around 4.3 billion addresses, which is insufficient for all modern devices and connections. Operators have long used NAT in home routers: several private devices share the home's public address. CGNAT applies a similar logic, but at the scale of the operator's network.
With CGNAT, your router does not necessarily receive a real public IPv4 address. It may receive an intermediate address, and then the operator's network again translates the traffic to a shared public IP. For web browsing, streaming or standard applications, this architecture often goes unnoticed.
How to know if you are behind CGNAT
Compare the WAN address shown in your router's interface with the public address shown by a tool like Ipzy. If the two addresses are different, there may be upstream NAT. Certain ranges such as 100.64.0.0 to 100.127.255.255 are specifically reserved for CGNAT.
Another common sign is the inability to open a port despite a correctly configured redirect in the router. You create the rule, the service works locally, but it remains inaccessible from the Internet. In this case, the block may come from the fact that the public address is not actually assigned to your router.
Effects on gaming and home services
CGNAT can cause a strict NAT type on certain consoles or gaming platforms. Outbound connections work, but direct inbound connections become difficult. This can hinder hosting a game, voice chat or certain peer-to-peer mechanisms.
It can also block direct access to a NAS, home server, IP camera, Minecraft server, personal VPN or home automation solution exposed from home. Manufacturer cloud services may continue to work, as they often use an outbound connection from your network to their servers.
CGNAT and privacy
Sharing a public IP address does not make you anonymous. The operator retains technical information that allows a connection, a port range and a subscriber to be associated at a given moment according to its legal obligations. For websites, however, multiple users may appear behind the same IP, which can lead to captchas or blocks if another user of the shared address generated suspicious traffic.
A shared IP can also complicate diagnosis: a degraded IP reputation does not always mean your own device is responsible. It may come from another customer, a VPN, a mobile network or a heavily used operator range.
Possible solutions
The cleanest solution is to ask your operator for a dedicated public IPv4 address, sometimes called a fixed IP option or CGNAT exit. Depending on the provider, this may be free, paid or unavailable. For some uses, enabling IPv6 may also help, as each device can have a routable address, provided the firewall is correctly configured.
Another approach is to use an outbound tunnel: VPN with port forwarding, SSH tunnel, reverse proxy, secure tunnel service or cloud solution. These options avoid depending on a directly opened inbound port on the router, but they add an intermediary to understand and secure.
Conclusion
CGNAT is invisible for many uses, but it becomes important as soon as you want to be reachable from the Internet. Understanding this layer avoids searching indefinitely for an error in the router when the block comes from the operator's network.
FAQ
Does CGNAT slow down the Internet?
Not necessarily. It mainly affects inbound connections and certain peer-to-peer uses.
Does a fixed IP remove CGNAT?
Often yes, if the operator provides a real dedicated public IPv4.
Does IPv6 replace the need to open IPv4 ports?
For IPv6-compatible services, partly yes, but the firewall must be configured carefully.