What Is CGNAT? How It Works and How to Check for It
CGNAT lets an ISP share a limited pool of public IPv4 addresses among many customers. If your router WAN address is in 100.64.0.0/10, or it does not match your observed public IPv4 address after local double NAT is ruled out, CGNAT is likely. You normally need a public IP option, supported IPv6 or a relay-based workaround for inbound access.
What Is CGNAT?
Normal home NAT translates private device addresses at your own router. CGNAT adds another translation layer inside the provider network. You control the home router, but the ISP controls the carrier gateway and its public mappings.
The shared address space reserved for this purpose is 100.64.0.0/10, covering 100.64.0.0 through 100.127.255.255. A private WAN address such as 10.x.x.x can also mean upstream NAT, but it may come from a second router in your home rather than the ISP.
How CGNAT Works
1Your device starts an outbound connection
A PC or console sends traffic from a private LAN address through the home router.
2The home router creates the first mapping
The router translates the device address to its WAN address, which may still be shared or private.
3The ISP creates another mapping
The CGNAT gateway maps many subscriber sessions onto a smaller pool of public IPv4 addresses and ports.
4Return traffic follows stored state
Replies to established sessions work, but an unexpected inbound packet has no subscriber mapping and is discarded.
How to Check If You Are Behind CGNAT
1Record your public IPv4 address
Run NatChecker or another public IP service while connected to the affected network.
2Find the router WAN IPv4 address
Open the router status page and find WAN IP, Internet IP or IPv4 address. Do not use a device LAN address.
3Compare the two addresses
A match usually means the router holds the public address. A mismatch means another translation layer exists.
4Rule out local double NAT
Check whether an ISP gateway and a second Wi-Fi router are both routing. Bridge or access-point mode can remove that local layer.
5Check the address range
A WAN address in 100.64.0.0/10 is strong evidence of CGNAT. RFC1918 space proves upstream NAT, not necessarily carrier NAT.
6Confirm with the ISP
Ask whether the line uses CGNAT and whether a dynamic public IPv4, static IPv4 or IPv6 option is available.
A failed port check alone does not prove CGNAT. The service may not be listening, the firewall may block it, the protocol may be wrong, or the forwarding rule may point to an old local IP.
Problems CGNAT Can Cause
1Gaming and peer-to-peer sessions
Hosting, direct matchmaking and party chat can be less reliable when both peers have restrictive mappings.
2Port forwarding
A correct rule on the home router cannot create a mapping on an ISP gateway you do not control.
3Self-hosted services
Game servers, websites, NAS access and VPN servers cannot receive direct unsolicited IPv4 traffic.
4Shared-IP side effects
Many subscribers can appear under one public IP, which complicates rate limits, abuse attribution and IP-based allowlists.
How to Work Around CGNAT
1Request a public IPv4 address
This is the most direct solution for inbound IPv4. The ISP may offer a dynamic address, static add-on or business plan.
2Use native IPv6
IPv6 can avoid IPv4 translation when the application and remote side support it. Router firewall rules still apply.
3Use an application relay
Many games, cameras and remote-access tools provide outbound relay connections that work through CGNAT.
4Use a suitable tunnel or VPN
The service must provide port forwarding, a public endpoint or reverse tunnel. An ordinary outbound VPN is not enough.
Test before changing your network
Run the NAT test on the affected connection, save the result, and retest after each change. Changing one variable at a time makes the diagnosis useful.
Check NAT Type NowRelated guides
Detailed CGNAT Test
Compare public and WAN addresses with a complete diagnostic workflow.
Symmetric NAT Explained
Understand destination-specific mappings and P2P limitations.
Check for Double NAT
Find an extra router or gateway layer before changing ports.
Router NAT Type Guide
Use UPnP, forwarding, bridge mode and DMZ in the right order.
Frequently asked questions
How do I know if I am behind CGNAT?
Compare your router WAN IP with your public IPv4 address. If they differ, or the WAN address is in 100.64.0.0/10, upstream NAT is likely. Rule out a second home router and confirm with your ISP.
Does CGNAT cause Strict NAT?
It can. CGNAT adds an ISP-controlled translation layer that can block unsolicited inbound connections and make restrictive game or peer-to-peer results more likely.
Can I port forward through CGNAT?
Usually not from the home router alone. You need a public IP option, supported IPv6, or a relay, tunnel or VPN service specifically designed for inbound reachability.
Does CGNAT slow down the internet?
CGNAT does not automatically reduce browsing or download speed. Overloaded provider infrastructure can affect performance, but speed or latency alone does not prove CGNAT.
Can a VPN bypass CGNAT?
A VPN can make an outbound tunnel through CGNAT, but inbound access requires a provider with port forwarding, a public endpoint or a suitable relay feature.
Is 100.64.0.1 a CGNAT address?
Yes. It is inside 100.64.0.0/10, the shared address range reserved for service-provider NAT, covering 100.64.0.0 through 100.127.255.255.