Why does my router show a different IP than my public IP?

Your ISP is likely using CGNAT, so your router gets a carrier-internal IP while the public IP is shared.

Can I do port forwarding behind CGNAT?

Usually not; you can ask your ISP for a public IP or use tunneling services like frp or Tailscale.

Networking Basics

NAT Explained: Port Forwarding, CGNAT and More

What Is NAT

Network Address Translation (NAT) lets many devices on a private LAN share one public IP. A home router translates private IPs (e.g. 192.168.1.x) to its public IP for outbound traffic, then routes replies back to the right device.

Port Forwarding

By default outsiders cannot reach your LAN devices. Port forwarding explicitly maps an inbound public port to a port on a specific LAN device - useful for self-hosted web services, NAS, remote desktop, or cameras.

Requires router support for port forwarding.
Requires a real public IP.
Behind CGNAT, the operator-side NAT cannot be configured, so port forwarding often fails.

CGNAT: The Carrier's "Big NAT"

IPv4 addresses are scarce, so many ISPs share egress IPs among users - carrier-grade NAT (CGNAT), typically using 100.64.0.0/10 (RFC 6598). Browsing still works, but inbound connections and port forwarding do not.

How to Tell If You Are Behind CGNAT

Compare your router WAN IP with your public IP; if they differ, another NAT layer exists.
A WAN IP in 100.64.0.0/10 strongly indicates CGNAT.
Ask your ISP for a dynamic public IP; some regions offer it free.

Enter an IP to check whether it is private or a CGNAT reserved address. →

What Is NAT

Port Forwarding

CGNAT: The Carrier's "Big NAT"

How to Tell If You Are Behind CGNAT

FAQ