Carrier-Grade Network Address Translation (CGNAT) Detection and Technical Guide

CGNAT stands for Carrier-Grade Network Address Translation. It is also known as Large-Scale NAT (LSN). Internet service providers use this network architecture on Layer 3 routers.

CGNAT allows an ISP to provide internet access to thousands of subscribers through one public IPv4 address or a limited pool of public addresses. It operates at the network layer, translating private IP address space into globally routable public addresses.

Why Do Internet Providers Use CGNAT?

IPv4 Address Exhaustion: ISPs cannot easily obtain new public IPv4 address blocks because of the global shortage. The depletion of the IANA and APNIC/RIR address pools has contributed to this problem.
Financial Cost: CGNAT reduces the cost of purchasing additional public IPv4 addresses or static public IPv4 blocks.
IPv6 Transition: Providers use CGNAT as an interim solution while their networks move toward complete IPv6 deployment.

WAN IP vs Public IP: The Technical Difference

WAN IP: A WAN IP is assigned to your router’s WAN interface by the ISP’s DHCP or PPPoE server. In a CGNAT environment, it may be an RFC 1918 private address or an RFC 6598 shared address.
Public IP: A public IP is globally routable on the internet. It is normally configured on the external interface of the carrier gateway. External servers see this address as the source of your connection.

How to Find Your Router’s WAN IP Address

Open your router’s default gateway address in a browser. Common addresses include 192.168.0.1 and 192.168.1.1.
Sign in to the router’s administration panel.
Open the Status, Network Map, or WAN Status page.
Find the field labeled IPv4 Address, Internet IP, or WAN IP.
Write down the address for comparison.

How to Check Your Public IP Address

Visit one of these websites from a device connected to your network:

whatismyip.com
ipinfo.io
ifconfig.me

You can also run the following command in a terminal or command prompt:

Comparing the WAN IP and Public IP

No CGNAT: If the router’s WAN IP exactly matches the address reported by an external IP-checking website, your connection has probably received a direct public IP address.
CGNAT Active: If the WAN IP belongs to a private or shared address range and the public IP is completely different, your ISP is probably using CGNAT.

CGNAT IP Address Ranges

ISPs use a dedicated shared address block defined by RFC 6598:

CGNAT Shared Address Space: 100.64.0.0/10

This block covers addresses from 100.64.0.0 through 100.127.255.255. If your router’s WAN IP falls within this range, it strongly indicates CGNAT.

ISPs may also use RFC 1918 private address ranges inside their networks:

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

CGNAT Detection Screenshot and Analysis

Consider the following example:

Router WAN Status: 100.64.15.20
Public IP Checker: 203.0.113.50

The two addresses do not match. The router’s WAN address also belongs to the 100.64.0.0/10 shared address range. These results clearly indicate that the connection is behind CGNAT.

Confirming CGNAT With Traceroute

Run this command on Windows:

Use this command on Linux or macOS:

The first hop is usually your local router. If the second or third hop shows an address from 100.64.0.0/10 or another private range, the traffic may be passing through the ISP’s internal CGNAT gateway before reaching the public internet.

Why Does CGNAT Break Port Forwarding?

Inbound Traffic Is Dropped: The ISP’s gateway does not have a route or preconfigured port mapping that directs unsolicited inbound traffic to your home router.
Stateful Packet Inspection: The gateway dynamically creates state entries for outbound connections. An external client cannot directly initiate a connection to your home server.
Protocol Limitations: UPnP and NAT-PMP may configure mappings on your local router, but they cannot configure the ISP’s carrier-level gateway.

How CGNAT Affects Gaming and Remote Access

Strict NAT or NAT Type 3: CGNAT may cause problems with peer-to-peer matchmaking, hosting sessions, PlayStation Network, and Xbox Live.
Remote Access and Self-Hosting: Services such as SSH, RDP, Plex, and self-hosted VPN servers usually cannot receive direct inbound connections through CGNAT.

These services may still work through STUN, TURN, or ICE infrastructure. Overlay networking tools such as Tailscale or ZeroTier may also provide an alternative connection method.

How to Get a Public IP From Your ISP

Contact your ISP’s technical support team or Network Operations Center. Ask whether they can provide one of these options:

A static public IP address
A dedicated dynamic public IP address
Removal from the CGNAT address pool

Many providers charge an additional monthly fee for this service.

You may also ask whether the ISP supports dual-stack IPv6. IPv6 can provide globally routable addresses without the same IPv4 CGNAT overhead.

CGNAT Frequently Asked Questions

Can a VPN bypass CGNAT?

A VPN client creates an outbound encrypted tunnel, so normal VPN connections can work behind CGNAT. However, a standard VPN connection does not automatically provide direct inbound port forwarding.

What alternatives are available for remote access?

Remote-access options include Cloudflare Tunnel, ngrok, Tailscale, ZeroTier, and other mesh VPN solutions.

Final CGNAT Detection Checklist

Sign in to the router’s administration panel and record its WAN IP.
Check whether the WAN IP belongs to 100.64.0.0/10 or a private address range.
Check the public IP through an external website.
Compare the public IP with the router’s WAN IP.
Run traceroute and inspect the early hops for 100.64.x.x or private addresses.