Why do internet providers use CGNAT?
IPv4 addresses are limited. Carrier-Grade NAT lets an ISP connect many subscribers to the internet using fewer public IPv4 addresses. It resembles home NAT, except another translation layer operates inside the provider's network.
What does the user notice?
Usually nothing when browsing, streaming or using most applications. Problems emerge with services requiring direct incoming connections: home servers, some games, peer-to-peer applications, older cameras or conventional port forwarding.
How can you check?
- Open your router settings and find its WAN or Internet IPv4 address.
- Compare it with the public IPv4 address reported by an internet website.
- If they differ, another NAT layer may exist. A WAN address in
100.64.0.0/10is a particularly strong CGNAT indicator. - Your ISP can confirm the actual arrangement, as some other network topologies can give similar results.
Why doesn't port forwarding work?
A port forwarding rule on your home router opens a route through your local NAT only. With CGNAT, an additional ISP NAT layer sits upstream and is outside your control. Incoming internet packets may therefore never reach your router, even if its local rule is correct.
What can you do?
- Ask your ISP for a public IPv4 address; some plans provide one free and others charge extra.
- Use IPv6 if both the ISP and service support it and firewall settings are correct.
- For remote access, use a solution with an outgoing tunnel or relayed connection, which does not require direct port forwarding.
- For gaming, check whether the platform uses relay servers or modern NAT traversal mechanisms.
CGNAT versus dynamic and static public IPs
A public IPv4 address can be dynamic and change occasionally while still permitting direct incoming connections. A static public IP stays the same. With CGNAT, you generally do not have a public IPv4 assigned directly to your connection. Asking for a “public IP” and a “static IP” are therefore not necessarily the same request.
What about IPv6?
IPv6 usually does not require CGNAT-style address translation, but incoming connections are not automatically allowed. Your firewall must permit the traffic, the service must listen on IPv6 and the remote peer must have IPv6 connectivity.
Frequently asked questions
Does CGNAT slow down the internet?
Not necessarily. Its main practical limitation is direct incoming connectivity, not raw speed.
Is 100.64.x.x a private IP address?
It belongs to a special shared address space reserved for uses such as CGNAT.
Does a dynamic public IP mean I have CGNAT?
No. A public IP can change and still be assigned directly to your connection.
Does IPv6 automatically solve remote access?
Not always. You need IPv6 on both sides, appropriate firewall rules and a service listening on IPv6.