Quick Answer
CGNAT (Carrier-Grade Network Address Translation) is an ISP-level form of NAT that lets multiple subscribers share the same public IPv4 address. Instead of giving every customer a unique public IPv4 address, the provider's CGN gateway maps subscriber addresses and ports to a smaller pool of public IPv4 addresses.
The IETF defines a Carrier-Grade NAT as a NAT-based function used to share the same IPv4 address among several subscribers. The key difference from normal home NAT is ownership and scale: your router manages NAT for devices on your local network, while CGNAT is managed by the ISP for many separate customers.
For most outbound activities such as browsing, streaming, API calls, or connecting to an HTTP/SOCKS proxy, CGNAT is largely transparent. The biggest limitations appear when you need unsolicited inbound IPv4 connections, port forwarding, peer-to-peer connectivity, or hosting a service from your own network.
Key Takeaways
- CGNAT lets multiple subscribers share one public IPv4 address. The ISP tracks each flow using address and port mappings.
- CGNAT runs inside the ISP's network. Traditional NAT normally runs on a customer's home or office router.
- 100.64.0.0/10 is reserved Shared Address Space for service-provider CGN deployments. Seeing a WAN address in this range is a strong sign of CGNAT.
- Port forwarding is the main practical limitation. You can control your own router, but not the ISP's CGN mapping for unsolicited inbound IPv4 traffic.
- Outbound proxies and most client VPNs normally still work. They create connections from inside the network to an external server.
- The best workaround depends on the goal. Ask the ISP for a public IPv4 address, use native IPv6 where suitable, or use a mesh VPN, reverse tunnel, or relay-based service for remote access.
What Is CGNAT?
Carrier-Grade Network Address Translation, usually called CGNAT or CGN, is a large-scale address-translation system operated by an internet service provider. It allows several subscribers to use the same public IPv4 address at the same time.
CGNAT became important because globally unique IPv4 addresses are limited while ISPs still need to support large numbers of IPv4 customers. RFC 6598 reserved the 100.64.0.0/10 block as Shared Address Space specifically for service-provider networks using Carrier-Grade NAT.
A subscriber behind CGNAT usually has at least two address domains: private addresses inside the home or office, and an ISP-side shared address before traffic reaches the public internet. The destination website sees the public IPv4 address used by the carrier gateway, not a unique public IPv4 address dedicated to that subscriber.
CGNAT vs NAT: What's the Difference?
Both NAT and CGNAT translate addresses and ports, but they operate at different layers. Traditional NAT is usually controlled by the customer and serves one local network. CGNAT is controlled by the ISP and can serve many separate subscribers.
| Feature | Traditional NAT | CGNAT |
|---|---|---|
| Managed by | Home or office network administrator | Internet service provider |
| Scope | Devices on one local network | Many separate subscribers |
| Public IPv4 use | Commonly one public IPv4 per subscriber connection | Public IPv4 addresses are shared across subscribers |
| Address between customer router and ISP | May be public or private depending on the service | Often Shared Address Space such as 100.64.0.0/10 |
| Port forwarding | Usually configurable if the subscriber has a reachable public IPv4 address | Usually not configurable by the subscriber at the ISP layer |
| Hosting inbound IPv4 services | Possible when the public IP and firewall permit it | Difficult without a public IPv4, suitable IPv6, or a tunnel/relay |
CGNAT also commonly creates a NAT444 or double-NAT path: a device is translated once by the customer's router and then again by the provider's CGN before reaching the IPv4 internet. The IETF notes that CGNs are not managed by subscribers, which is why the second translation layer cannot normally be configured from the home router.
For a deeper explanation of the customer-side translation layer, see our guide to Network Address Translation (NAT).
How Does CGNAT Work?
CGNAT works by keeping a translation table that maps subscriber-side addresses and ports to public IPv4 addresses and ports. The public address can be shared because different connections can be distinguished by their port mappings and other flow information.
- 1. Your device gets a private address. A laptop or phone normally starts with an RFC 1918 address such as 192.168.x.x or 10.x.x.x inside the local network.
- 2. Your router performs local NAT. The home or office router translates the device's private source address into the router's WAN-side address.
- 3. The ISP's CGN performs another translation. The provider maps the subscriber-side address and source port to a public IPv4 address and an available public-side port.
- 4. The destination sees the carrier's public IPv4 address. A website or server sees the shared public egress address and source port, not the subscriber's internal address.
- 5. Return traffic is mapped back through the translation state. The CGN uses its table to send the response to the correct subscriber, and the customer's router then sends it to the correct device.
RFC 6888 defines common behavioral requirements for CGNs because address sharing can affect application compatibility. The IETF has also documented application problems that can appear when a second NAT layer is added, including limitations for inbound and peer-to-peer communication.
CGNAT, NAT444, DS-Lite, and NAT64
NAT444 is a common CGNAT deployment where IPv4 traffic passes through customer-side NAT and then provider-side CGN. DS-Lite carries subscriber IPv4 traffic over an IPv6 access network before the provider performs IPv4 translation. NAT64 is related address-translation technology for IPv6-only clients reaching IPv4 services, but it is not the same thing as classic IPv4-only CGNAT.
CGNAT Advantages and Disadvantages
Advantages of CGNAT
- Conserves public IPv4 addresses. Many subscribers can share a smaller pool of globally routable IPv4 addresses.
- Supports continued IPv4 service during IPv6 transition. ISPs can keep serving IPv4-only applications and customers while expanding IPv6 deployment.
- Centralizes large-scale translation inside the provider network. The ISP can operate shared address pools and translation state as part of its network infrastructure.
Disadvantages of CGNAT
- Inbound IPv4 connections are harder. Subscribers usually cannot create a port-forwarding rule on the carrier's NAT gateway.
- Some peer-to-peer and real-time applications can be affected. Games, VoIP, self-hosted VPNs, and direct device-to-device applications may need relay or traversal techniques.
- Many subscribers share one visible IP address. Reputation systems, rate limits, abuse controls, and troubleshooting can treat unrelated users as if they came from the same public IPv4 address.
- Subscriber attribution requires ports and timestamps, not just the public IP. Because one public IPv4 address represents many users, providers need detailed mapping logs to associate a connection with a subscriber.
CGNAT does not automatically make a connection secure or anonymous. It hides the subscriber behind shared address translation, but encryption, endpoint security, authentication, and privacy still depend on the protocols and services in use.
How Do I Check If I Have CGNAT?
The simplest check is to compare the IPv4 address on your router's WAN interface with the public IPv4 address visible to an external website.
- 1. Find your router's WAN IPv4 address. Open the router or gateway status page and look for WAN, Internet, or IPv4 address.
- 2. Check whether it is inside 100.64.0.0/10. RFC 6598 reserves this range as Shared Address Space for service-provider networks, making it a strong CGNAT indicator.
- 3. Compare the WAN address with your public IPv4 address. If an external IP-check service reports a different IPv4 address, your traffic is being translated upstream of your router.
- 4. Confirm with your ISP. A mismatch can also be caused by other provider-side NAT arrangements, so the ISP can give the definitive answer and tell you whether a public IPv4 option is available.
Traceroute can sometimes show extra private or shared-address hops, but it is not a definitive CGNAT test because routers may hide, filter, or answer traceroute in different ways.
What Are the Best CGNAT Workarounds?
There is no single workaround because the right solution depends on whether you need a reachable server, remote access to a device, peer-to-peer connectivity, or simply a different outbound IP address.
| Goal | Practical option |
|---|---|
| Host a service over IPv4 | Ask the ISP for a public or static IPv4 address, or a CGNAT opt-out |
| Reach a home device remotely | Use native IPv6 when available, or a mesh VPN / relay-based remote-access service |
| Publish a service without a public home IPv4 | Use a reverse tunnel, VPS relay, or other outbound tunnel to a reachable server |
| Improve peer-to-peer connectivity | Prefer IPv6 where supported or use an application/service with NAT traversal and relay support |
| Change the outbound IP seen by a website or app | Use a VPN, HTTP proxy, or SOCKS5 proxy for that application's outbound traffic |
Dynamic DNS alone does not solve CGNAT. DDNS can keep a hostname pointed at a changing public IP, but it cannot create an inbound mapping through an ISP-controlled NAT gateway.
A standard VPN or proxy also does not remove CGNAT from the access line. It can change the outbound route and egress IP for selected traffic. To accept inbound connections, the VPN or tunnel service must specifically provide a reachable port, relay, or reverse connection.
Does CGNAT Affect Proxies?
Usually not for normal outbound proxy use. HTTP, HTTPS, and SOCKS5 connections are initiated by the client, so the ISP's CGN can create translation state for them just like it does for normal web traffic.
When an application uses a proxy, the destination service sees the proxy's egress IP for the proxied connection rather than the subscriber's CGNAT public IP. That is useful when the goal is application-level routing, geographic egress, or separating outbound sessions, but it does not make the subscriber's home network directly reachable.
If your use case requires application-level egress rather than inbound hosting, see our SOCKS5 proxy guide or learn how residential proxies work. The proxy layer and CGNAT solve different problems: CGNAT conserves ISP address space, while a proxy intentionally routes selected outbound traffic through another server or exit network.
CGNAT in One Sentence
CGNAT is an ISP-managed form of network address translation that lets many subscribers share a smaller pool of public IPv4 addresses by tracking each connection with address-and-port mappings.
It is effective at extending the usable life of IPv4, but the tradeoff is that subscribers lose direct control over the provider-side NAT layer. For everyday outbound traffic that often changes little; for port forwarding, self-hosting, some games, peer-to-peer applications, and direct remote access, it can matter a lot.
Primary technical references for this guide are IETF RFC 6888 for CGN behavior and RFC 6598 for the 100.64.0.0/10 Shared Address Space allocation.