CGNAT Detection

What is CGNAT and why should you care?

Carrier-Grade NAT (also called Large-Scale NAT or NAT444) is when your ISP shares one public IPv4 address across many customers. Instead of giving you a real public IP, they put you behind a giant NAT box, similar to what your home router does for your devices — but at the ISP scale.

The IPv4 range 100.64.0.0/10 (RFC 6598) is reserved specifically for ISPs to use for CGNAT. If your "public" IP starts with 100.64 through 100.127, you're behind CGNAT.

Symptoms of being behind CGNAT

• Port forwarding doesn't work — you don't have a unique public IP, so there's nothing to forward from. Self-hosting (game servers, home security cameras, NAS access, VPN servers) is broken.
• VoIP/SIP issues — NAT traversal can fail or be unreliable.
• Some games have issues — peer-to-peer matchmaking, console NAT type warnings.
• Remote desktop / SSH from outside — won't work directly without a tunnel.
• You appear to share an IP with hundreds of others — captchas, IP-based rate limiting, getting blocked from services for someone else's behavior.

What to do if you're behind CGNAT

1. Ask your ISP for a real public IP. Usually free if you call; sometimes a small extra fee. Some ISPs require business-class service.
2. Use IPv6. CGNAT only applies to IPv4. If your ISP offers IPv6 (most do now), services that support IPv6 work normally.
3. Tunnel out. Services like Tailscale, ZeroTier, Cloudflare Tunnel, or a VPS+WireGuard let you reach your home network without needing a public IP on your end.
4. Switch ISPs. Not every ISP uses CGNAT. Smaller fiber providers usually give real public IPs.

CGNAT and why it breaks things

Carrier-Grade NAT is what happens when your ISP runs out of public IPv4 addresses and puts multiple customers behind a single one. Instead of each subscriber getting a unique public IP, dozens or hundreds share one, with the ISP performing address translation at their edge. From the customer's perspective, everything looks normal until you try to do anything that requires inbound connectivity to your home network — port forwarding, running a game server, self-hosting, VPN termination, some VoIP configurations. Then it silently doesn't work.

IPv4 address exhaustion has been the underlying issue for decades. When each ISP had abundant addresses, every subscriber got a real public IP and NAT was purely a home-router function to share it among internal devices. As new address allocations dried up, ISPs increasingly moved to CGNAT to squeeze more subscribers onto the addresses they already have. Cellular carriers were early adopters; wireline ISPs followed, especially for cheaper service tiers.

How to tell if you're behind CGNAT

The definitive check: compare the public IP your router thinks it has (visible on its status page) with the public IP the internet sees (what any IP-checking site returns). If they're different, you're behind CGNAT. Your router is on a private IP that the ISP translates to their shared pool.

The IP range 100.64.0.0/10 was specifically reserved for CGNAT by RFC 6598. If your router's WAN IP is somewhere in 100.64.0.0 through 100.127.255.255, that's a CGNAT address — the ISP is using RFC 6598 space between your router and their edge. Some ISPs use other private ranges for the same purpose (10.0.0.0/8 or 192.168.0.0/16 chained through multiple layers), which makes detection slightly less obvious but the effect is the same.

The tool's approach

This detector queries your public IP as observed from the internet, and separately shows you what CGNAT typically looks like. When you compare the tool's reported public IP with your router's WAN status page, if they match, you likely have a real public IP. If they differ (especially if the router shows a 100.64.x.x or private IP while the tool shows a different public IP), that's CGNAT.

The detector also flags whether your public IP itself falls in known CGNAT ranges, which happens rarely but does occur.

What CGNAT breaks

Port forwarding

You can't forward a port from your router to reach an internal device, because the internet doesn't reach your router directly. Traffic arrives at the ISP's CGNAT edge first, and unless the ISP has provisioned a specific mapping for your customer, incoming connections have no path to you.

If you're trying to self-host anything reachable from the internet — a personal website, a Plex server, a game server, an SSH endpoint — CGNAT makes it impossible without workarounds. Workarounds exist (reverse tunnels through services like Cloudflare Tunnel, ngrok, Tailscale Funnel) but require paid or third-party services and aren't the same as having a real public IP.

Inbound VPN connections

A VPN server on your home network can't accept incoming connections from your phone or laptop when you're traveling, because the incoming connection can't reach your router. This is the same port forwarding issue, just with VPN as the specific use case.

The workaround is running a VPN mesh service like Tailscale or ZeroTier where every device connects outbound to a coordination server, and the peers communicate directly through the coordination service. These work fine behind CGNAT because the initial connections are outbound.

Some VoIP configurations

SIP-based VoIP that relies on the client's public IP for RTP media streams often has trouble with CGNAT. STUN and TURN servers help mitigate this, but not all SIP clients handle the CGNAT case cleanly. Symptoms include one-way audio, calls that connect but drop, or registration succeeds but incoming calls fail.

Modern VoIP providers using WebRTC generally handle CGNAT transparently. Older SIP-based systems, especially self-hosted PBXes trying to register with external providers, are the common trouble cases.

Peer-to-peer applications

BitTorrent, some game modes, direct file transfer tools, video call apps in poor connection scenarios — all rely on peer-to-peer connectivity that requires reachable endpoints. CGNAT breaks this or degrades the experience.

IP-based whitelisting or logging

Services that whitelist specific customer IPs (some corporate VPNs, certain banking sites) don't work reliably behind CGNAT because your visible IP can change from session to session and is shared with other customers. Logs on the destination side show a single IP for many different actual users.

What CGNAT doesn't affect

Normal outbound web browsing

Regular internet use — browsing websites, streaming video, sending email, using apps — works fine behind CGNAT. All of these are client-initiated outbound connections that CGNAT handles transparently.

IPv6 connectivity

If your ISP provisions IPv6 (which most modern ISPs do), your devices get real routable IPv6 addresses with no NAT at all. IPv6 makes CGNAT a non-issue for services that support it. Unfortunately, many hobbyist services and older customers are still IPv4-only, so IPv6 alone doesn't solve everything.

Outbound VPN clients

Your work laptop connecting to a corporate VPN, or your phone connecting to a consumer VPN service — both work fine behind CGNAT because the connection is outbound. It's only inbound VPN termination that breaks.

How to get a real public IP if you need one

Ask your ISP

Most ISPs offer a public IP for an additional fee, often bundled with their business tier. Sometimes this is available as an add-on to residential service. If you specifically need to self-host, the extra cost usually pays for itself in avoided workarounds.

Upgrade to business service

Business internet from the same ISP almost always comes with real public IPs, sometimes multiple. If you're running a small business from home or have significant self-hosting needs, business service is worth considering.

Switch providers

Some ISPs still give real public IPs by default. Fiber providers, in particular, often still do. Cable and wireless ISPs are the ones most likely to use CGNAT for consumer tiers.

Use a tunnel service

Cloudflare Tunnel, Tailscale Funnel, ngrok, and similar services let you expose services behind CGNAT to the internet through their infrastructure. Traffic comes into the service, which relays it to a client running on your network. Works, but adds a dependency and often has a paid tier for real production use.

Get a VPS with a real IP and tunnel through it

A cheap VPS ($5/month) gives you a real public IP. You can run WireGuard or SSH tunnels between your home network and the VPS, then forward specific ports from the VPS to your home network. More work than a commercial tunnel service but cheaper and fully in your control.

When CGNAT actually matters and when it doesn't

You are affected if

• You want to self-host anything reachable from the internet
• You need to run a VPN server at home (not client)
• You use SIP-based VoIP with an older PBX
• You play games that require open NAT
• You want to remotely access your home network without a mesh VPN
• You're troubleshooting an application that specifically needs incoming connectivity

You are not affected if

• You just browse the web, stream video, and use apps
• You use commercial cloud services for everything (no self-hosting)
• Your VPN needs are outbound only
• You've moved everything peer-to-peer to mesh services like Tailscale

Related tools

The IP Lookup tool tells you what public IP the internet sees you at, which is the number you compare against your router's WAN IP to detect CGNAT manually. The Subnet Calculator and CIDR Range Tool help understand the CGNAT range (100.64.0.0/10) and other reserved ranges. For understanding why some services fail on your connection and others don't, running the VoIP Quality Test reveals whether packet loss or NAT-related issues might be a factor.

Privacy

The detection uses your public IP as reported by Cloudflare's edge — the same IP visible to any site you connect to. Nothing more than that is used or logged. If you have concerns about IP exposure, the same detection can be done manually by comparing your router's WAN status page against any IP-checking site.