FernTool

What is CGNAT (carrier-grade NAT)?

CGNAT (carrier-grade NAT, also called CGN or large-scale NAT) is a technique ISPs use to share one public IPv4 address among many customers. It’s the reason your mobile phone, 5G router or fixed-wireless connection may not have a public IP of its own — and why port forwarding sometimes simply doesn’t work.

Why CGNAT exists

The world ran out of new IPv4 addresses years ago (see what IPv6 is for the long version). Buying IPv4 space now costs tens of US dollars per address. A mobile operator with millions of subscribers can’t give each one an address, so it puts customers on private-style addresses and translates them to a smaller pool of public IPs at the edge of its network. Each public IP might serve dozens or hundreds of users simultaneously, distinguished by port numbers.

How CGNAT works

At home, your router already performs NAT: your devices have private IPs like 192.168.1.20 and share the router’s address. With CGNAT there’s a second layer:

  1. Your phone or laptop: private IP, e.g. 192.168.1.20.
  2. Your router’s WAN: an ISP-internal address, often from 100.64.0.0/10 (the range RFC 6598 reserved for this), or sometimes 10.x.x.x.
  3. The ISP’s CGNAT gateway: translates to a shared public IP — the one you see on FernTool.

That’s why it’s sometimes called “double NAT” or NAT444.

How to tell if you’re behind CGNAT

  1. Note your public IP from the FernTool homepage.
  2. Log in to your router and find the WAN/Internet IP (how to find it).
  3. Compare them. If they differ, you’re behind CGNAT (or a second router). A WAN IP between 100.64.0.0 and 100.127.255.255 is a giveaway — you can paste it into the IP lookup and it will be labelled “cgnat”.

Another clue: a traceroute to any website (tracert 8.8.8.8 on Windows, traceroute 8.8.8.8 on Mac/Linux) shows a 100.64.x.x hop early on.

Who uses CGNAT?

Nearly every mobile network worldwide uses it for consumer data. Many fixed-wireless, LTE and 5G home internet products do too, as do some fibre ISPs in IPv4-scarce markets. In South Africa, mobile data on Vodacom, MTN, Cell C, Telkom Mobile and Rain is typically behind CGNAT, while most fibre ISPs still issue public IPv4 addresses. See our South African ISP guides for network-by-network notes.

What CGNAT breaks

Normal browsing, streaming, video calls and most apps work fine, because they make outbound connections.

How to get around CGNAT

  1. Ask your ISP for a public or static IP. Many offer it as a paid add-on, or will move you off CGNAT on request.
  2. Use IPv6. IPv6 doesn’t need NAT, so each device can be reachable directly (with firewall rules). Check support with the IPv6 test.
  3. Use a tunnel or overlay network. Tools such as Tailscale, ZeroTier, WireGuard to a cheap VPS, or Cloudflare Tunnel make an outbound connection and expose your service through it — no inbound port needed.
  4. Use a VPN with port forwarding, offered by some providers.
  5. Use UPnP/peer-to-peer relays built into games and consoles; they don’t fix CGNAT but often improve NAT type.

Is CGNAT bad for privacy?

It slightly increases privacy, because many people share your public IP, but it doesn’t hide you from your ISP — the ISP logs which customer used which IP and port at what time. For real IP privacy, see how to hide your IP.

Frequently asked questions

How do I know if I am behind CGNAT?

Compare the WAN IP in your router with the public IP shown on FernTool. If they differ, or the WAN IP is in 100.64.0.0/10, you are behind CGNAT.

Can I port forward behind CGNAT?

Not through the ISP gateway. Ask your ISP for a public IP, use IPv6, or use a tunnel such as Tailscale or Cloudflare Tunnel.

Does CGNAT slow down my internet?

Usually not noticeably for browsing and streaming, though it can affect gaming NAT type and peer-to-peer apps.

What is the 100.64.0.0/10 range?

It is the shared address space reserved by RFC 6598 for carrier-grade NAT between ISPs and their customers.

More guides