What Is CGNAT and Why Does Port Forwarding Fail?

What is carrier-grade NAT?

Carrier-grade NAT, often shortened to CGNAT or CGN, lets an Internet provider share a smaller pool of public IPv4 addresses among many customers. Your home router performs one layer of network address translation, and the provider performs another layer before traffic reaches the public Internet.

CGNAT became common because the pool of available IPv4 addresses is limited. It allows normal outbound browsing, streaming, and app use, but unsolicited inbound connections cannot easily find one customer's router behind the provider's shared gateway.

How to tell whether you are behind CGNAT

1. Open your router's Internet or WAN status page and note the address assigned by the provider.
2. Compare it with the public address shown on WhatIsMyIP.live.
3. If they differ, there is upstream NAT. It may be CGNAT or another provider router.
4. An address in 100.64.0.0/10 is specifically reserved for shared address space and is a strong CGNAT indicator.
5. Private ranges such as 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 on the WAN side also show another NAT layer.

A different router and public address can also occur with a modem/router in front of your own router. Check the equipment path before assuming the provider uses CGNAT.

Why port forwarding fails

A port-forward rule tells your home router which internal device should receive traffic addressed to the router's public side. Under CGNAT, the public address belongs to a provider gateway shared by many subscribers. You cannot normally create a matching rule on that provider gateway, so the inbound packet never reaches your router.

Universal Plug and Play and NAT-PMP solve only the local-router part. They cannot automatically control an upstream carrier NAT unless the provider supports a compatible port-control protocol.

What CGNAT affects

• Hosting a game server, website, VPN server, or remote desktop service at home.
• Direct access to security cameras or a network storage device.
• Peer-to-peer applications that prefer incoming connections.
• Some consoles reporting moderate or strict NAT.
• IP-based blocklists affecting several unrelated customers sharing one address.

Most cloud-connected cameras and smart devices still work because they create an outbound connection to a vendor service. That convenience also means access depends on the vendor's cloud security and availability.

What can you do?

• Ask for a public IPv4 address. Some providers offer one free, as a paid add-on, or only on business plans.
• Use IPv6. A globally routed IPv6 address can support inbound connections when the firewall is configured safely and the remote side has IPv6.
• Use a mesh or overlay network. Products based on WireGuard and relay services can connect devices through outbound sessions.
• Use a reverse tunnel or VPS. A home service connects outward to a server with a public address, which forwards authorized traffic.
• Use the application's relay mode. Gaming and communication tools may fall back to vendor relays, sometimes with higher latency.

Never expose a device simply to make an app work. Apply updates, use strong authentication, restrict source addresses, and prefer a VPN or authenticated tunnel over a raw management port.

Frequently asked questions

Does CGNAT slow the Internet?

It can add a small processing layer, but normal speed problems are more often caused by congestion, Wi-Fi, routing, or server distance.

Can I remove CGNAT from my router?

No. It is controlled by the provider. You can request a public address or use an alternative connection method.

Is CGNAT the same as a dynamic IP?

No. A dynamic public IP can still accept forwarded traffic while assigned. CGNAT means the public IPv4 is shared upstream.

Does IPv6 need port forwarding?

Usually not NAT-style forwarding, but the router firewall must explicitly permit safe inbound traffic to the device.