You already know what CGNAT is, you can check whether you are on it, and you have seen why port forwards die on a shared exit. This post is the next step: how to get a unique public IP — or another path that actually lets the internet reach you — when shared IPv4 is blocking what you need.
This is an escape / obtain guide, not another definition or detection checklist. Confirm CGNAT first if you have not; then pick a fix that matches the job.
You can compare router WAN vs the address sites see on the FindMyIP homepage after any plan change. IP Lookup is optional context for the public address you land on.
Short answer
To leave CGNAT for real inbound IPv4, ask the ISP for a unique public IPv4 (often sold as a “public IP,” “static IP,” or business add-on). Confirm in writing that it is not still carrier-grade NAT. Alternatives that help for some goals: global IPv6, vendor cloud relays, a tunnel or VPS, or a VPN product that offers port forwarding / a dedicated exit — understanding each option’s limits. A plain consumer VPN for browsing privacy does not open inbound ports on your home CGNAT line.
Decide what “public IP” means for your goal
People say “I need a public IP” for different jobs:
| Goal | What you actually need |
|---|---|
| Host a game, camera, NAS, or home lab from outside | Reachable inbound path (unique public IPv4, IPv6, relay, or tunnel) |
| Stable allowlist for work / school | Address that stays yours and is not shared with neighbors |
| Privacy / geo routing while browsing | Different exit — often a VPN — not the same as inbound home reachability |
| Just see the number sites see today | A web check on / — see how to find your public IP |
If you only browse and stream, you may not need to “escape” at all. Escape matters when the internet must call you, or when a shared exit breaks an allowlist.
Option 1 — Ask the ISP for a unique public IPv4
This is the direct fix for classic home inbound over IPv4.
- Call or chat support with notes: router WAN, public IP from What Is My IP, and that you already ruled out double NAT at home.
- Ask clearly: “Can I get a unique public IPv4 that is not CGNAT?” Do not stop at “static” alone — some “static” products are stable inside a shared pool. You want unique and public. Related vocabulary: static vs dynamic IP for home internet.
- Ask price, contract term, and whether IPv6 is already available on the line.
- After it is provisioned, wait for the modem to renegotiate, then compare router WAN to the homepage again. They should match (or closely agree) with a normal public-looking WAN — not
100.64.0.0/10.
If support only offers “static within CGNAT,” that does not restore inbound port forwards. Push for unique public IPv4 or use another option below.
Option 2 — Prefer IPv6 when the ISP gives a global prefix
Many plans are CGNAT on IPv4 while IPv6 is end-to-end. If your devices, router, and the remote side all speak IPv6, you may not need a paid IPv4 add-on for that use case.
- Confirm the ISP hands out a global IPv6 prefix (not only link-local).
- Open FindMyIP and note whether an IPv6 address appears for your path.
- Point services at IPv6 when they support it; keep IPv4 for legacy clients.
IPv6 does not magically fix every app. It is a real escape hatch when both ends support it. Background: IPv4 vs IPv6 for normal users.
Option 3 — Relays, tunnels, and “stop needing inbound”
Not every camera or NAS needs a raw port on your house:
- Vendor cloud / relay — many products already assume CGNAT and phone home outbound.
- Tunnel or VPS — your home connects out to a machine that is reachable; you control the far end. That is a product choice, not a free router checkbox.
- Outbound-only workflows — sync, push, or a hosted service may be enough.
These do not give your home a unique residential IPv4. They solve reachability another way — often cheaper and safer than exposing the whole LAN.
Option 4 — VPN options (honest limits)
A VPN changes the address sites see when you browse. That is useful for privacy and geo routing. Details: what a VPN changes on your IP.
What a typical consumer VPN does not do: open inbound ports on your CGNAT home path. Turning VPN on does not make your-home:port reachable from the open internet.
Some VPN products advertise port forwarding, a dedicated IP, or inbound-friendly plans. Those can help on the VPN’s network when the feature is real and configured — they still are not the same as a unique residential public IPv4 from your ISP. Read the provider’s docs for inbound support; do not assume the word “dedicated” means your house is suddenly reachable. We do not invent signup or affiliate links here — pick a provider yourself if that product fits.
Use a VPN for exit control and privacy. Use ISP unique IPv4 / IPv6 / relay / tunnel when the goal is inbound to home.
After you change the plan — verify once
- VPN off, on the home network you care about.
- Note public IP on /.
- Note router WAN.
- Optional: IP Lookup or ISP Lookup for the exit’s org label.
- If inbound was the goal, retest the service from a phone on mobile data (not the same Wi‑Fi).
| After the change | Likely reading |
|---|---|
| WAN matches FindMyIP, WAN looks public | Unique public IPv4 path looks good |
WAN still in 100.64.0.0/10 |
Still CGNAT — escalate with ISP or switch options |
| Browse OK, inbound still dead | Firewall, wrong port, or you bought “static” without unique public — recheck the contract |
What not to waste time on
- Re-saving the same port forward while still on CGNAT — the map never arrives at your router (why forwards fail).
- Expecting a reboot alone to invent a unique public IP.
- Buying the cheapest “static” add-on without asking “unique public, not CGNAT?”
- Confusing “I can see a public IP on FindMyIP” with “that address is mine alone.” On CGNAT the page shows the shared exit.
Bottom line
Getting a public IP that is yours usually means paying the ISP for a unique public IPv4, enabling IPv6 when it is global end-to-end, or solving reachability with relays / tunnels — not rewriting the same CGNAT explainer. Confirm you are on shared addressing with the detection guide, then ask support the unique-public question once, verify on What Is My IP after the change, and keep VPN privacy separate from inbound home access.