What Is CGNAT? Carrier-Grade NAT Explained
What Is CGNAT
CGNAT (Carrier-Grade NAT) is large-scale address translation deployed by ISPs at the access-network edge. After IPv4 exhaustion, carriers use CGNAT devices to let many users share a small pool of public IPs - which is why your queried public IP may be identical to users in the same region.
Why CGNAT Exists
There are only about 4.3 billion public IPv4 addresses in total, and they have long been exhausted. Giving every broadband subscriber a dedicated public IP is no longer practical, so ISPs share public IPs across hundreds or thousands of households through CGNAT.
CGNAT vs Home NAT
| Item | Home NAT | CGNAT |
|---|---|---|
| Deployment location | Home router | ISP access network |
| Households sharing one public IP | 1 | Hundreds or thousands |
| Direct inbound access | Possible with port forwarding | Generally not possible |
| Public IP stability | May change on router reboot | Usually stable but shared |
Typical Effects of CGNAT
- External parties cannot reach your home devices directly; tunnelling, port mapping or a VPN is required.
- Self-hosted websites or game servers cannot be exposed directly to the Internet.
- IP lookups may return the same result as nearby users, reducing geolocation accuracy.
- Some risk-sensitive services may flag the shared IP as suspicious.
How to Tell If You Are Behind CGNAT
- Compare the router WAN IP with the public IP you queried: if they differ, another NAT layer (likely CGNAT) exists in between.
- If inbound access still fails after configuring port forwarding, you are probably behind CGNAT.
- Check whether the WAN IP falls into 100.64.0.0/10 (RFC 6598), the dedicated CGNAT shared range.