V VPN Glossaryvpnglossary.com
163 entries · 2026 ed.
№ 017 / 163 C Networking

CGNAT (Carrier-Grade NAT)

Carrier-grade NAT (CGNAT) is when an ISP puts many customers behind one shared public IPv4 address, adding a second layer of translation after your router.

§ 01

Definition

Because IPv4 addresses ran out, many mobile networks and some fixed-line ISPs no longer give each customer a public address. RFC 6598 even reserved a special range, 100.64.0.0/10, for the addresses used between the customer and the carrier's NAT.

§ 02

How it works

If your router's WAN address starts with 100.64 to 100.127, or differs from the IP that websites report, you are probably behind CGNAT. Outbound browsing works normally, but inbound connections such as hosting a game server or reaching a home camera directly are blocked.

§ 03

Why it matters

CGNAT means your public IP is shared with neighbours, which is not real privacy: the ISP still logs who used which port and when. It also explains why port forwarding at home fails and why some people use a VPN with port forwarding or a mesh tool to get inbound access.

/ Sources

  1. RFC 6598: Shared Address Space (100.64.0.0/10)
  2. RFC 6888: CGN requirements