What Is CGNAT? How It Works, How to Check & Workarounds

CGNAT lets an internet service provider place many subscribers behind a smaller pool of public IPv4 addresses. It is usually invisible during ordinary browsing, streaming, and other outbound activity. You notice it when you try to forward a port, host a server, reach a home device directly, or troubleshoot why unrelated users appear to share your public IP.

Quick Answer

CGNAT, or Carrier-Grade Network Address Translation, is ISP-managed NAT that allows multiple subscribers to share one public IPv4 address. Your router may receive a non-public WAN address, often from 100.64.0.0/10, while the carrier gateway maps each connection to a public IP and port. Outbound traffic normally works, but direct inbound IPv4 connections and ordinary port forwarding may not.

Key Takeaways

• CGNAT runs in the provider's network. Home NAT serves devices on one local network; a carrier-grade NAT can serve many separate subscribers.
• The stable identifier is not just an IP address. The gateway tracks address, port, protocol, and connection state so subscribers can share one public IPv4.
• 100.64.0.0/10 is Shared Address Space. It spans 100.64.0.0 through 100.127.255.255 and is not ordinary RFC 1918 private space.
• A WAN address in that range is a strong CGNAT signal. Comparing the router's WAN IPv4 with an external public-IP result is the most useful first check.
• CGNAT and double NAT are related but not identical. CGNAT is the provider-controlled layer; double NAT is any path that crosses two NAT devices.
• Port forwarding is not always impossible, but the home router cannot control the carrier mapping. A public IPv4, ISP-supported PCP/mapping, native IPv6, or an outbound tunnel/relay may solve different needs.
• CGNAT does not provide encryption, guaranteed anonymity, or automatic IP rotation. Those are separate properties and services.

CGNAT at a Glance

What Is CGNAT?

Carrier-Grade Network Address Translation is a NAT function operated inside a service provider's network. The IETF definition in RFC 6888 describes a CGN as a NAT-based logical function that shares an IPv4 address among several subscribers.

The core idea is simple:

A website normally sees the public address used by the carrier gateway. It does not see the subscriber-side address assigned to the customer's router. Several households, offices, phones, or other subscriber connections can therefore appear under the same public IPv4 at the same time.

CGNAT is also called Carrier-Grade NAT, CGN, CG-NAT, or Large-Scale NAT (LSN). These are networking terms, not separate proxy protocols. “CCGNAT,” with two initial Cs, is a nonstandard spelling rather than the accepted acronym; this page retains its historical URL to avoid an unnecessary migration.

If you need the customer-controlled layer first, read the separate guide to Network Address Translation. The distinction is ownership: you administer the NAT on your router, while the provider administers CGNAT upstream.

How Does CGNAT Work?

A common residential IPv4 path uses two translation layers and three address domains:

203.0.113.45 belongs to an RFC 5737 documentation block; it is an example, not a functioning proxy or subscriber address.

The request follows these steps:

1. The device receives a local address. A laptop might use 192.168.1.20 inside the home network.
2. The customer router creates a NAT mapping. It replaces the device's source address and, when necessary, the source port with its WAN-side values.
3. The provider's CGN creates another mapping. It maps the subscriber-side address and port to an eligible public IPv4 and public-side port.
4. The destination receives the request. It sees the carrier's public address and mapped source port.
5. Return traffic follows the stored state. The CGN sends the response to the correct subscriber, and the home router sends it to the correct local device.

A simplified carrier table could contain entries like these:

Real gateways also distinguish protocols, destinations where required by their mapping behavior, timeouts, and other connection state. The public IPv4 alone is therefore not enough to attribute a flow. Accurate troubleshooting may require the public IP, source port, protocol, and precise timestamp.

Why Do ISPs Use CGNAT?

The main reason is IPv4 scarcity. A public IPv4 address is a finite resource, while an ISP may need to connect far more subscribers than it has unique addresses available.

CGNAT lets a provider reuse non-public subscriber-side space and multiplex active connections across a public pool. It preserves IPv4 connectivity while networks, devices, and applications continue their gradual move toward IPv6.

That makes CGNAT useful to fixed-line ISPs and especially common in mobile networks, where large numbers of devices connect, disconnect, and move through carrier infrastructure. It is an operational compromise, not a replacement for IPv6: the provider must maintain translation state, allocate ports, handle failures, and keep enough mapping information for troubleshooting and lawful attribution.

What Is the CGNAT IP Range?

RFC 6598 reserved this block as Shared Address Space:

The current IANA IPv4 Special-Purpose Address Registry marks 100.64.0.0/10 as not globally reachable.

It is important to name the block correctly. Shared Address Space resembles private space because different providers can reuse it and the public internet cannot route it. However, it is not one of the three private-use blocks reserved by RFC 1918:

An ISP can also implement upstream NAT using another non-public range or architecture. Not seeing 100.64.0.0/10 does not conclusively prove that CGNAT is absent.

How to Check If You Are Behind CGNAT

The most useful check compares the IPv4 on your router's WAN interface with the public IPv4 observed outside your network.

Step 1: Find the router's WAN IPv4

Open the router or gateway status page and look for a field named WAN IP, Internet IPv4, IPv4 address, or similar. Do not use a laptop's 192.168.x.x Wi-Fi address; that is the device's LAN address.

If you have an ISP gateway and your own router, check both. The personal router may show a private WAN address merely because the ISP gateway is also performing local NAT.

Step 2: Check the public IPv4

Use a public IP-checking service in a browser, or run a command such as:

Run the check without an active VPN or application proxy if the goal is to inspect the underlying ISP connection. Otherwise, the service will correctly report the VPN or proxy exit instead.

Step 3: Compare the results

For address terminology, see public versus private IP addresses.

Step 4: Rule out ordinary double NAT

Temporarily inspect the ISP gateway directly, or place it in its documented bridge/passthrough mode if that is appropriate and reversible. Do not change production network settings casually. If the only mismatch disappears when the extra local router layer is removed, the issue was local double NAT rather than carrier sharing.

Step 5: Ask the ISP

The provider can give the definitive answer. Ask:

• Is my IPv4 connection behind CGNAT?
• Can I opt out or receive a public dynamic IPv4?
• Is a static IPv4 available, and does it cost extra?
• Does the service expose inbound mapping or Port Control Protocol support?
• Is native IPv6 with prefix delegation available?

Traceroute can show shared or private hops, but it is not conclusive. Routers may hide hops, use non-public addresses for internal links even without subscriber CGNAT, or answer probes differently from normal application traffic.

CGNAT vs. NAT vs. Double NAT

NAT, CGNAT, and double NAT overlap, but they are not synonyms.

Is CGNAT the same as double NAT?

No. Double NAT is the general condition of crossing two NATs. Connecting a personal router behind an ISP gateway that is also in router mode creates double NAT even if the subscriber still receives a public IPv4.

CGNAT specifically identifies the provider-managed sharing layer. A common home deployment contains both customer NAT and carrier NAT, so it is also double NAT.

What does NAT444 mean?

NAT444 describes a path through three IPv4 address domains:

The two arrows represent two IPv4-to-IPv4 translation stages. The IETF's RFC 7021 assessment of NAT444 uses this model when discussing how carrier translation can affect applications.

Are DS-Lite and NAT64 the same as CGNAT?

No. DS-Lite carries IPv4 over an IPv6 access network before provider-side IPv4 translation (RFC 6333), while NAT64 lets IPv6 clients reach IPv4 services (RFC 6146). Classic NAT444 adds provider-side IPv4 translation upstream of customer NAT. A subscriber can have public IPv6 while IPv4 still uses CGNAT, so test each protocol separately.

What Problems Can CGNAT Cause?

CGNAT is largely transparent to ordinary outbound browsing because the subscriber initiates the connection and the gateway keeps return-path state. The limitations appear when an application expects unsolicited inbound traffic, many simultaneous ports, or a public IPv4 that uniquely identifies one subscriber.

RFC 7021 documents application tests involving gaming, peer-to-peer traffic, streaming, FTP, SIP, and conferencing. Its results show why specific application and CGN implementations must be tested rather than labeling all CGNAT connections broken.

Does CGNAT slow down the internet?

Not necessarily. A CGN adds stateful processing, but a properly provisioned carrier gateway can support normal browsing, streaming, downloads, and outbound API traffic without a meaningful user-visible penalty.

Poor capacity planning, port pressure, state-table limits, routing, or congestion can cause delay and failures. Those are deployment conditions, not proof that every CGNAT connection is inherently slow. Measure latency, packet loss, throughput, and application errors before blaming the translation layer.

Does CGNAT affect gaming?

It can affect games that rely on direct peer-to-peer connections, inbound hosting, or a particular console NAT classification. Games built around provider-hosted servers or robust relay infrastructure may work normally.

CGNAT does not automatically cause high ping. A relay chosen because a direct path is unavailable may add latency, while a congested carrier gateway can also hurt performance. The exact result depends on the game, protocols, NAT behavior, relay placement, and ISP network.

Does CGNAT block port forwarding?

Your home-router rule only controls the customer-side NAT. It cannot, by itself, create the corresponding mapping on the ISP's gateway.

That does not mean carrier-side mapping is technically impossible. RFC 6888 requires a CGN to implement a protocol for explicit subscriber control and recommends the Port Control Protocol defined by RFC 6887. In practice, availability and customer access vary by provider. UPnP on the home router does not automatically control a carrier gateway several network hops away.

Does CGNAT Make You Anonymous or Secure?

No. Address sharing makes a public IPv4 less useful as a subscriber identifier by itself, but it does not provide complete anonymity.

The ISP can maintain mapping information, and an internet service can observe additional signals such as accounts, cookies, application identifiers, TLS properties, browser behavior, and request patterns. RFC 6269 explains why systems may need source ports and timestamps when public IPv4 addresses are shared.

CGNAT also does not encrypt traffic. HTTPS, a properly configured VPN, or another secure protocol supplies encryption for the relevant portion of the path. Stateful translation commonly prevents unsolicited packets from matching an existing mapping, but NAT is not a substitute for host security, authentication, updates, or a firewall policy.

How to Work Around CGNAT

You normally cannot disable provider CGNAT from the home router. Choose a workaround based on the actual goal.

Does a VPN bypass CGNAT?

Most VPN clients work because they initiate an outbound connection through the carrier gateway. The destination then sees the VPN server's egress address for tunneled traffic.

That does not remove CGNAT from the access line. For inbound hosting, the VPN service must provide a reachable port, public address, relay, or reverse path. A VPN without inbound mapping changes outbound egress but does not make a server at home directly reachable.

Does IPv6 solve CGNAT?

Native IPv6 can remove the need to share an IPv4 address for IPv6 traffic. It is often the cleanest route for end-to-end reachability when both sides support it.

It is not an automatic fix. The ISP must provide usable IPv6 connectivity and, for a routed home network, suitable prefix delegation. The router firewall must allow only the intended inbound traffic, DNS must publish the correct record where needed, and the application/client must support IPv6. IPv4-only destinations may still use CGNAT, DS-Lite, NAT64, or another transition mechanism.

CGNAT vs. VPN vs. Proxy

These technologies can all change which address appears somewhere in a connection, but they solve different problems.

An outbound SOCKS5 proxy normally works from behind CGNAT for the same reason web browsing does: the client starts the connection. A proxy is not a CGNAT-removal tool and does not fix port forwarding for unrelated inbound services.

How CGNAT Relates to Mobile Proxies

Mobile carriers commonly use CGNAT, so several devices or subscriber sessions can sometimes share one carrier public IPv4. That network behavior is one reason a dedicated device, SIM, or proxy endpoint does not automatically guarantee a globally unique public mobile IPv4. Two separate devices can occasionally receive the same carrier egress because the mobile operator—not the proxy application—controls the CGN mapping.

CGNAT and proxy rotation are still different mechanisms:

• CGNAT lets the carrier choose address-and-port mappings for ordinary subscriber traffic.
• Proxy rotation lets a proxy platform select or request another eligible exit according to a product's session policy.
• A sticky proxy session asks the platform to retain an exit for continuity, but the underlying mobile peer or carrier mapping can still change or disappear.

Proxidize Mobile Proxies provide managed HTTP(S) and SOCKS5 access points with rotating and sticky session controls. The destination sees the selected mobile-network egress for the proxied connection rather than the customer's home CGNAT address. For the difference between deliberate provider rotation and ordinary network reassignment, read the IP rotation guide.

Shared carrier addressing can complicate IP-only reputation and rate-limit decisions because one address may represent unrelated users. It does not make a mobile proxy invisible, unblockable, or authorized for every destination. Websites can evaluate many other signals, and customers remain responsible for lawful, permitted use.

Contextual CTA: Need managed mobile egress rather than an inbound-hosting workaround? Explore Proxidize Mobile Proxies. If the requirement is broad global web-data access rather than mobile-network identity, compare residential proxy access separately.

Common CGNAT Misconceptions

“Every 100.x.x.x address is CGNAT”

False. Only 100.64.0.0 through 100.127.255.255 belongs to 100.64.0.0/10. Other 100.x.x.x addresses can be globally routable public space.

“100.64.0.0/10 is an RFC 1918 private range”

False. It is RFC 6598 Shared Address Space. Both categories are non-global, but their intended uses and registry classifications differ.

“A mismatched WAN and public IP always proves CGNAT”

False. It proves that some upstream translation or routing difference exists. A second local router, ISP gateway, VPN, proxy, or another provider architecture can also create a mismatch.

“CGNAT rotates my IP on every request”

False. A carrier can reuse or change public mappings according to its implementation and connection state. Existing connections normally need stable mappings to keep working. CGNAT is address sharing, not a promise of per-request rotation.

“Port forwarding is impossible under every CGNAT deployment”

Too absolute. The subscriber cannot solve the carrier layer with a home-router rule alone, but an ISP may offer a public-IP add-on, explicit mapping, PCP, or another inbound service.

“CGNAT guarantees security and anonymity”

False. It provides translation and address sharing. Encryption, endpoint security, identity, logging, application behavior, and privacy controls remain separate.