CGNAT Port Forwarding: What Works and What Does Not
Traditional router forwarding usually stops at the ISP's shared address, but a public IPv4 address, VPN forwarding or an outbound relay can provide a reachable path.
Can you port forward with CGNAT?
With CGNAT, your router does not own the public IPv4 address, so a normal port-forwarding rule on that router cannot create an inbound path through the ISP's gateway. The cleanest fix is to ask the ISP for a public IPv4 address. If that is unavailable or you do not want to change the internet plan, use a VPN that explicitly provides inbound port forwarding for an app that accepts one or a few assigned ports. A low-cost, self-managed alternative is FRP through a small public server, but setting it up safely requires developer-level command-line, server and networking knowledge.
Interactive address check
Quick CGNAT Port Forwarding Check
Enter the IPv4 address shown on your router's Internet or WAN status page and the public IPv4 shown by an external check. The comparison tells you whether normal router forwarding has a clear public path.
Enter both IPv4 addresses
Use the address assigned to the router's internet side, not the private address of a computer, phone or console. Then enter the public IPv4 shown from the same connection.
An address comparison is strong evidence, but a private router address can also mean an ordinary second home router. Use the full CGNAT test to confirm
Why a Router Rule Cannot Cross CGNAT
A home router can control only its own forwarding table. With CGNAT, the public connection reaches an ISP-controlled gateway first, and that gateway has no rule identifying your household as the destination.
Public internet
A player, peer or remote client connects to the ISP's shared public address and a port.
ISP CGNAT gateway
The provider shares that public address among customers and drops an unsolicited connection that has no permitted mapping.
Your home router
Your local rule would know where to send the traffic, but the blocked connection never reaches it.
The practical answer: more rules, DMZ, UPnP and Dynamic DNS on the home router do not repair the missing rule at the ISP. You need public IPv4 or an outbound connection to a reachable relay.
Learn how CGNAT worksCGNAT Port Forwarding Options Compared
Choose the path by who needs access, which protocols the app uses and how many public ports it requires. Not every workaround produces a public endpoint.
| Option | Best for | Publicly reachable? | Main limit |
|---|---|---|---|
| Public IPv4 from the ISP | Normal router forwarding, consoles and apps that need arbitrary documented ports | Yes, through your router rule | May cost extra or be unavailable; a static address is not required unless the address must stay fixed |
| VPN with inbound port forwarding | An app that can use one or a few provider-assigned ports | Yes, on the VPN address and assigned port | Many VPNs do not support it, and you often cannot choose any port or a large range |
| FRP plus a public server | Technical users mapping specific TCP or UDP services | Yes, on the server's public address | Requires a server, configuration, updates and careful firewall rules |
| Private mesh VPN | Your own trusted devices and invited users | No; members join the private network | Every user normally needs the client and permission; it is not a public game or web endpoint |
| Direct IPv6 with firewall rules | Services and clients that both support IPv6 | Potentially, without IPv4 port forwarding | Both ends need IPv6, and the router firewall must be configured safely |
Choose the Right Workaround
Confirm that the problem is really CGNAT
Disconnect privacy VPNs and proxies, compare the router and public IPv4 addresses, and distinguish ISP CGNAT from a second router you control. A second home router has a local fix; ISP CGNAT does not.
Define who must connect
For only your own devices, private network access is safer than a public port. A public game server, peer-to-peer app or webhook needs an endpoint that anyone can reach without installing your private client.
Count the required ports and protocols
A VPN-assigned port can fit an app that accepts one configurable listening port. FRP can map a planned set of TCP or UDP ports. Apps that require a large range, arbitrary platform ports or special NAT behavior work best with public IPv4 from the ISP.
Test the new public endpoint from outside
Keep the service and tunnel running, allow the exact port on the endpoint and host firewalls, then connect from mobile data or another network. Test UDP with the real application, not only a TCP web checker.
How VPN Port Forwarding Works Behind CGNAT
The home device starts an allowed outbound VPN connection. The VPN service receives traffic on its public address and sends the assigned inbound port back through that connection.
1Choose explicit inbound forwarding support
A normal privacy VPN is not enough. Confirm that port forwarding is available on the operating system and VPN locations you plan to use.
2Connect and copy the assigned public port
The public port may be selected by the provider and may change. Keep the VPN connected to the forwarding-capable location.
3Enter that exact port in the app
For a torrent client or configurable server, set its listening port to the port assigned by the VPN. A different local listening port requires a feature that supports remapping.
4Allow the app on the host firewall
The VPN can deliver the packet while the computer still blocks it. Add a narrow rule for the app or assigned port and required protocol.
5Test the VPN address from outside
Use the VPN's public address and assigned port while the service is running. Your home public address and old router forward are no longer the public entry point.
Check the port requirement before buying
VPN forwarding is a poor fit when a console or game requires an arbitrary group or wide range of ports that the provider will not assign. It is a strong fit when the app accepts one configurable listening port or a small known set.
Open a port-forwarding VPN directly
Compare current platform and location support on the provider site before paying; port availability can differ by VPN app and server.
How FRP Port Forwarding Works Behind CGNAT
FRP uses a small server with public IPv4 as the entry point. Software on the home device opens an outbound connection to that server, then carries selected public TCP or UDP ports back to the local service.
1Prepare a public server
Use a server with a public address, enough bandwidth and a location near the people who will connect. List every TCP and UDP port the service actually needs.
2Run the server and home-side FRP programs
Run the FRP server program on the public server and the client program on the home machine. The home side initiates the connection, so CGNAT allows it.
3Map each required service port
For every service, specify the local address and port, the TCP or UDP protocol, and the public server port that remote users will enter.
4Restrict and maintain the public endpoint
Use authentication, update both programs, expose only required ports and restrict source addresses when the service does not need the entire internet.
5Connect to the public server address
Test from another network and review both FRP logs. The public destination is the server address and mapped port, not your home address.
Best Path by Use Case
| Goal | Usually the best path | Why |
|---|---|---|
| Host a public game server | Public IPv4, or FRP when the game uses a small known set of TCP/UDP ports | Players should connect without joining a private network; verify that the game accepts a relayed address and configurable ports. |
| Improve incoming peer connections | VPN with one assigned inbound port | Most desktop peer-to-peer clients let you set one listening port to match the VPN assignment. |
| Reach your own home devices | Private mesh VPN | It avoids a public endpoint and is safer when only approved devices need access. |
| Publish a small web application | A managed outbound web tunnel or FRP on a public server | The home service creates the outbound path; HTTPS, authentication and domain handling can live at the public endpoint. |
| Reach a camera or device dashboard | Private mesh VPN rather than a public forward | Administrative interfaces are frequent targets and rarely need to be open to everyone. |
CGNAT May Not Be the Only Problem
A relay cannot repair an app that is stopped, bound only to localhost or blocked by its own firewall. Prove that the service works from another device at home before testing any public IPv4, VPN or FRP endpoint.
Troubleshoot a port that is still closedFrequently Asked Questions
Technical References
These standards and registries define shared address space, carrier NAT behavior and the limited exception where a provider supports explicit port mapping.