CGNAT (carrier-grade NAT) is when your ISP puts many customers behind one shared public IPv4 address. Your home still has a router and private LAN addresses, but the address websites see may belong to a whole neighborhood of subscribers. Outbound browsing usually works. Inbound access — port forwards, some games, home cameras from outside — often does not.
See the address the open internet sees on What Is My IP. This is a deeper dive than the short CGNAT note in public vs private IP.
Why ISPs use CGNAT
IPv4 addresses are scarce. Giving every household a unique public IPv4 is expensive. CGNAT lets the ISP:
- Hand your modem/router a private address or address from Shared Address Space on the WAN side
- Translate many customers through a smaller pool of real public IPv4s
- Keep everyday outbound traffic (web, apps, streaming) working
It is an ISP-scale version of the NAT already on your home router — with one extra layer between you and the public internet.
Shared public IP in practice
Without CGNAT, a typical home looks like:
- Devices:
192.168.x.x(private) - Router WAN: a unique public IPv4 from the ISP
- Websites see that public IPv4
With CGNAT:
- Devices: still private on the LAN
- Router WAN: often a non-unique address (commonly in
100.64.0.0/10, reserved as Shared Address Space — not for the open internet) - Websites see the ISP's shared public IPv4
So FindMyIP can show a "normal looking" public IP while your router's WAN page shows an address in 100.64.0.0/10 or an RFC1918 private range. Both readings can be true. They are different hops.
How to spot CGNAT (honest checks)
We do not show a magic "CGNAT: yes/no" badge. Use symptoms and two numbers:
- Router WAN IP — log into the router. If WAN is in
100.64.0.0–100.127.255.255, treat CGNAT as likely. Some ISPs use other private ranges on WAN instead. - Internet-facing IP — open What Is My IP. That is what remote servers see.
- Compare — if WAN ≠ the FindMyIP address, and WAN is not a normal unique public, you are probably behind at least one extra NAT.
- Check for your own second router. Double NAT at home can also cause a WAN/public-IP mismatch and failed port forwarding. Service and firewall configuration can cause similar failures. These clues do not prove CGNAT; ask the ISP to confirm.
- ISP / org label — ISP Lookup shows which provider owns the public address you present. It will not by itself prove CGNAT; it confirms whose network the shared exit belongs to.
RFC 6598 defines the shared 100.64.0.0/10 range. An address in that range is not an RFC1918 private address or a globally routable public endpoint.
If you only ever browse and stream, you may never notice. CGNAT shows up when you need the internet to call you.
What usually breaks
- Port forwarding / "open ports" — outsiders hit the shared public IP; the ISP has no map to your router for arbitrary inbound ports
- Hosting a game server or self-hosted app at home on IPv4 without a tunnel or relay
- Some peer-to-peer and camera apps that expect a reachable public endpoint (many now use relays; some still struggle)
- Allowlists that assume your public IP uniquely identifies your household — neighbors may share it; your public IP may also change when the CGNAT pool reshuffles
What usually still works:
- Normal HTTPS browsing and apps
- Outbound VPN clients (you connect out; the VPN exit becomes what sites see)
- Email and cloud services that you initiate
CGNAT vs "I have a private IP"
Private IPv4 LAN addresses (10., 172.16–31., 192.168.) are common on home networks. CGNAT is the extra ISP layer. You can have:
- Private LAN + unique public WAN (classic)
- Private LAN + CGNAT (common on mobile and many fiber/cable plans)
- Dual-stack with working IPv6 while IPv4 is CGNAT — some inbound use-cases move to IPv6 when the ISP provides global IPv6
For the LAN vs public distinction itself, stay with public vs private IP. For why you might see IPv4 and IPv6 together, see IPv4 vs IPv6.
What a VPN changes (and what it does not)
A VPN encrypts your traffic to a provider and replaces the address sites see with the VPN exit IP. That helps privacy and geo routing. It does not turn CGNAT into a unique residential public IPv4 for inbound port forwards on your home line.
- Sites see the VPN's IP (check on What Is My IP with the VPN on)
- Your ISP still sees a VPN tunnel from your CGNAT path
- Hosting something reachable on your home IPv4 still needs a non-CGNAT line, IPv6, or a tunnel/VPS product — not "VPN on" alone
Read what a VPN changes about the outgoing IP before confusing an exit change with inbound reachability. A dedicated VPN IP also needs appropriate inbound-routing support; the word “dedicated” alone does not provide access to a home service.
What you can do about it
- Ask the ISP for a unique public IPv4 (sometimes a paid "static" or "public IP" add-on) or confirm whether IPv6 is enabled end-to-end
- Prefer IPv6 for services that support it if your ISP gives you global IPv6
- Use vendor cloud / relay features for cameras and NAS instead of raw port forwards
- Run a tunnel or VPS when you truly need an inbound endpoint you control
- Recheck after plan changes — CGNAT can appear or disappear when the ISP re-numbers you
Confirm the arrangement before buying an add-on
CGNAT means your visible public IPv4 may be shared. Browsing keeps working; inbound IPv4 access is what suffers. Compare router WAN (watch for 100.64.0.0/10) with What Is My IP, confirm the provider via ISP Lookup, and treat "VPN for privacy" as separate from "I need a unique reachable home IP."