You followed every step: reserved a local IP, opened the firewall and created a perfect port forwarding rule. Yet the port checker still says filtered, and friends cannot connect. The likely culprit is carrier-grade NAT (CGNAT) – a technique internet providers use to share a single public IPv4 address among many customers. This guide explains how it works, how to tell if you are behind it, and what you can do.
What CGNAT is
At home, your router uses NAT to share one public IP between your devices (see public vs private IP addresses). With CGNAT, your provider does the same thing one level up: instead of giving your router a public address, it gives it an address from a shared range, and a large NAT device in the provider’s network translates traffic from many customers to a small pool of public addresses.
The result is “double NAT”: your device → your router’s NAT → your provider’s NAT → the internet. Outgoing connections work fine. But incoming connections have nowhere to go, because the provider’s NAT device does not know which of its hundreds of customers should receive them – and you cannot configure it.
Why providers use it
The world has run out of new IPv4 addresses. Buying more is expensive, and many providers – especially mobile networks, fixed-wireless and satellite providers, and newer fibre companies – have far more customers than addresses. CGNAT lets them keep connecting new customers. It is a standard, legitimate practice, and the standard range 100.64.0.0/10 (100.64.0.0 – 100.127.255.255) was reserved specifically for it.
How to tell if you are behind CGNAT
- Compare addresses. Find the WAN or Internet IP on your router’s status page, then check your public IP on our home page. If they differ, there is NAT between your router and the internet.
- Check the range. A WAN IP between
100.64.0.0and100.127.255.255is almost certainly CGNAT. A WAN IP in10.x.x.x,172.16–31.x.xor192.168.x.xmeans either CGNAT or another router in front of yours (for example, the provider’s modem-router). - Run a traceroute from your computer (
tracert 1.1.1.1on Windows,traceroute 1.1.1.1on macOS/Linux). If the second hop after your router has a private or 100.64 address, that is likely the provider’s NAT. - Mobile data is almost always behind CGNAT.
What CGNAT breaks
- Port forwarding – hosting game servers, websites, Plex or a home VPN server.
- Remote access to cameras, NAS devices and smart home hubs that rely on incoming connections.
- Some online games, which report a “strict” or “type 3” NAT and may struggle with voice chat or hosting matches.
- Peer-to-peer apps, which connect more slowly or via relays.
- IP reputation – because you share an address with others, you may see more CAPTCHAs or inherit a ban caused by another customer.
Normal browsing, streaming and video calls are not affected.
Your options
1. Ask your provider for a public IP
Many providers will move you off CGNAT on request, sometimes for free, sometimes for a small monthly fee or with a business plan. Ask for a “public IPv4 address”, “opt out of CGNAT” or a “static IP”. This is the simplest and most complete fix.
2. Use IPv6
Providers that use CGNAT for IPv4 often give full IPv6. Each of your devices gets a public IPv6 address that can accept incoming connections once you add a firewall rule on your router. The catch: the people connecting to you also need IPv6. Read IPv6 explained.
3. Use a mesh VPN
Services such as Tailscale and ZeroTier create a private network between your devices that works through CGNAT by making outgoing connections from each side. They are excellent for reaching your own NAS, cameras or computers remotely, and for playing with a small group of friends who install the same app.
4. Use a tunnel or a cheap VPS
For publishing a website or service to everyone, tunnelling services such as Cloudflare Tunnel or ngrok make an outgoing connection from your server and expose it through their network. Alternatively, rent a small virtual server with a public IP and run a WireGuard tunnel from your home to it, forwarding the ports you need on the VPS.
5. Use a VPN with port forwarding
A few commercial VPN providers offer port forwarding: you get a port on the VPN server’s public IP that forwards through the tunnel to you. This suits peer-to-peer apps, but the port number is usually assigned by the provider.
6. Rely on relays and UPnP alternatives
Many games and apps automatically fall back to relay servers when direct connections fail. Performance may be slightly worse, but it often works without any changes.
Don’t confuse CGNAT with double NAT at home
If the WAN IP is a private address like 192.168.0.x, the extra NAT might be your own equipment – for example, a provider modem-router with your own Wi-Fi router plugged into it. In that case you can fix it yourself: put the provider device into bridge or modem-only mode, or forward the ports on both devices, or set your router as the “DMZ host” on the provider device. Our port forwarding guide covers this.
Summary
CGNAT shares one public IPv4 address among many customers. It is invisible for everyday use but blocks incoming connections, so port forwarding cannot work. Check your router’s WAN address – especially for the 100.64.0.0/10 range – then ask your provider for a public IP, or work around it with IPv6, a mesh VPN or a tunnel.