What Is CGNAT? Why You Share an IP (and Why It Shows the Wrong City)

CGNAT (carrier-grade NAT) is how an internet provider puts many customers behind one public IPv4 address. Your router usually gets an address from the 100.64.0.0/10 range (RFC 6598, 2012), and the provider’s NAT translates it again. Inbound connections then fail, so port forwarding stops working, and IP lookups show the provider’s address and city instead of yours.

What is CGNAT and how does it work?

CGNAT, or carrier-grade NAT, is address translation run by your ISP instead of your home router. According to RFC 6598 (April 2012), the 100.64.0.0/10 block is “Shared Address Space” for numbering the links between a provider’s CGN and customer routers, reserved because “IPv4 address space is nearly exhausted.”

Ordinary NAT works like this: every device in your home gets a private address, and the router swaps it for the one public IPv4 address the ISP gives you. With CGNAT, the ISP doesn’t give you a public address at all. Your router’s WAN side gets a shared address, and the provider’s NAT swaps that for a public one.

Engineers call this layout NAT444: three IPv4 address realms and two translations. A packet passes through each realm in turn:

1. Your home network: your laptop sends from a private address such as 192.168.1.20.
2. The provider’s access network: your router translates that to its WAN address, for example 100.72.14.9.
3. The public internet: the CGN translates again, to a public address it shares with other subscribers.

Replies come back the same way, through both translation tables. That works for anything you start. It fails for anything someone else starts, because neither table has an entry for a connection nobody on your side opened.

How does the ISP share one address between customers?

RFC 6888 (April 2013, BCP 127) sets the common requirements for CGNs. Its default is “paired” pooling: a subscriber keeps the same external address across their sessions. A website therefore sees you on one address, rather than jumping between several mid-session.

The CGN then divides that address’s ports between subscribers. RFC 6888 says a CGN must support limiting the number of external ports per subscriber, so one busy household can’t starve its neighbours. A freed port should not go to someone else for at least 120 seconds, so late packets for the old connection are less likely to reach a different customer.

Why do ISPs map port ranges instead of logging every connection?

Sharing creates a record-keeping problem. When one public address serves many customers, the ISP needs the address, the port and the time to identify one of them. RFC 7422 (December 2014) estimated that per-connection logging means about 33,000 connections per household per day and about 150 MB of logs per subscriber per month.

Scale that to 1 million subscribers and the RFC puts it at about 150 TB a month. Its fix is deterministic mapping: each inside address maps by formula to an external address plus a fixed port range, so the operator logs only the formula’s inputs. RFC 6888 also says a CGN should not log destination addresses or ports.

What is the CGNAT IP range (100.64.0.0/10)?

The CGNAT IP range is 100.64.0.0/10, running from 100.64.0.0 to 100.127.255.255, which is 4,194,304 addresses. RFC 6598 defines it as Shared Address Space for provider networks. It is separate from the RFC 1918 private ranges, and packets using it must not be forwarded across provider boundaries.

Block	Range	Addresses	Defined in	Meant for
100.64.0.0/10	100.64.0.0 – 100.127.255.255	4,194,304	RFC 6598 (2012)	Links between an ISP’s CGN and customer routers
10.0.0.0/8	10.0.0.0 – 10.255.255.255	16,777,216	RFC 1918	Private networks (homes, offices)
172.16.0.0/12	172.16.0.0 – 172.31.255.255	1,048,576	RFC 1918	Private networks
192.168.0.0/16	192.168.0.0 – 192.168.255.255	65,536	RFC 1918	Private networks, most home routers

So 100.64.x.x is neither public nor private in the usual sense. It’s routable only inside one provider’s network, and RFC 6598 says providers must not include it in external-facing DNS zone files.

For the other blocks you’ll meet in router menus and logs, see our cheat sheet of private and special IPv4 ranges.

CGNAT vs NAT: what’s the difference?

Regular NAT runs on your own router and shares one public address between your devices. CGNAT runs inside the ISP’s network and shares one public address between many customers. Because CGNAT has its own 100.64.0.0/10 range, the two usually stack: your NAT on the inside, the provider’s on the outside.

Aspect	Home NAT	CGNAT
Where it runs	Your router	The ISP’s network
Who shares the public IP	Devices in your home	Many unrelated subscribers
Inside addresses	RFC 1918 (192.168.x.x, 10.x.x.x)	100.64.0.0/10 on your router’s WAN side
Port forwarding	You set it up in the router	The ISP’s CGN holds the mappings; you can open a port only if the ISP supports PCP or forwards it for you
IP that websites see	The public address the ISP assigned you	The CGN’s shared address
Who keeps mapping records	Your router, briefly	The ISP, to identify subscribers (RFC 7422)

The practical difference is control. You own your router’s NAT table, so you can open a port on it. You don’t own the CGN’s table, so a port you open on your router leads only to a 100.64.x.x address that nobody on the internet can reach.

How do I know if I’m behind CGNAT?

Compare two addresses: your router’s WAN IP and the public IP a lookup shows. If the WAN IP sits in the 100.64.0.0/10 Shared Address Space and differs from your public IP, you’re behind CGNAT. A different private RFC 1918 WAN address also means someone upstream is translating your traffic.

1. Find your router’s WAN IP. Open the router’s admin page (the address is usually on its label) and look for the status, WAN or internet section. Note the IPv4 address shown there.
2. Find your public IP. On a device on the same network, look up your public IP. Behind a CGN, this is the CGN’s shared address.
3. Compare them. Same address: you have your own public IPv4. Different, with a WAN IP between 100.64.0.0 and 100.127.255.255: CGNAT. Different, with a 10.x, 172.16–31.x or 192.168.x WAN IP: a NAT upstream, either the ISP’s or a second router of your own.
4. Run a traceroute as a second hint. A 100.64.x.x hop right after your router points to a provider NAT.
5. Ask your ISP if you’re still unsure. Support can tell you whether your plan uses CGNAT and whether you can leave it.

Here’s how that looks in practice. Put the router’s WAN address, say 100.72.14.9, into the IP lookup, then your public IP, and compare the two results. The 100.72.14.9 lookup returns no location; it says the address is “in the shared range 100.64.0.0/10 (RFC 6598), used by internet providers for carrier-grade NAT” and has no public location or owner to look up. Your public IP is the CGN’s address; its lookup shows your ISP’s network and an approximate location, which may be another city.

One trap: a private WAN address can also mean double NAT inside your own home, such as an ISP modem routing in front of your own router. Check the modem’s WAN address too. If the modem holds the public IP, the fix is in your setup, not at the ISP.

The port checker won’t settle the question on its own. It tests whether ports on an IP or hostname answer from the internet. Behind CGNAT your public IP belongs to the CGN, so a closed port there is expected. Use it after a fix instead.

Why is CGNAT bad? Port forwarding, gaming, hosting and shared reputation

CGNAT is bad mainly for anything that needs inbound connections. Aussie Broadband (February 2024) lists port forwarding, web, email and file servers, security cameras, home automation and remote access as affected. Browsing and streaming usually work, because the CGN creates a mapping whenever you start a connection.

Port forwarding and remote access

Port forwarding needs a public address you control. Behind CGNAT, a rule on your router forwards traffic arriving at a 100.64.x.x address, and the internet can’t reach that address. Remote desktop, a home NAS, a self-hosted VPN server and cameras that expect a direct connection all fail the same way.

If you’re trying to find your public IP for remote desktop, CGNAT is often why the address you found doesn’t connect. RFC 6888 says a CGN must implement a protocol that gives subscribers explicit control over their mappings, preferably the Port Control Protocol (RFC 6887). Whether your ISP lets you use it is a question for support.

Gaming and peer-to-peer

Most online games still work, since your console or PC connects out to a game server. Trouble starts with peer-to-peer features: hosting a lobby, some voice chat, and matchmaking that tries direct player-to-player links. Games may then report a restrictive NAT type. Spintel (June 2025) names port forwarding, P2P and Dynamic DNS as the features affected.

Hosting a server at home

A game server, a website, a mail server or a home media server all need strangers to reach you first. Under CGNAT they can’t, and Dynamic DNS doesn’t help, because it would point your hostname at the CGN’s shared address.

Shared reputation and CAPTCHAs

Your public IP’s reputation is shared with everyone behind it. If another subscriber on the same CGN address sends spam or hammers a login page, blocklists and rate limits hit the address, not the person. That’s why a clean user can get CAPTCHAs or “too many requests” pages they did nothing to earn.

You can check your IP’s reputation to see the risk score and blocklist signals for the address sites see. On a CGN address, a listing describes the address and everyone on it, not you. A public address of your own takes you out of that shared pool.

Why does my IP show the wrong city?

IP geolocation databases locate the public address, and behind CGNAT that’s the CGN’s address, not yours. The CGN can sit in a different city, and many subscribers share its address. That shared address is all a lookup can see.

A geolocation database can only place one address in one spot. When subscribers from several towns exit through the same CGN, the database places that address where its evidence points, which may be nowhere near you. Everyone behind it inherits that approximate location, and the time zone that comes with it. That’s also why your IP time zone can differ from your clock.

The city can also change without you moving. Paired pooling keeps you on one address during your sessions, but that address can change over time, for example after a reconnect. Your public IP changes, and its approximate location changes with it.

How to get around CGNAT

The surest way around CGNAT is a public IPv4 address from your ISP, often for a fee. The Australian provider Spintel (June 2025) charges A$2 a month extra for a dynamic public IP and A$5 a month for a static IP on residential plans. The alternatives are IPv6, a VPN with port forwarding, a relay or tunnel, or a business plan.

• Ask your ISP to take you off CGNAT. Aussie Broadband (February 2024) lets customers ask to opt out for a valid reason and sells a static IP as a paid add-on; its business and static-IP customers aren’t on CGNAT. Spintel lets NBN customers switch in their online account. Trade-off: not every ISP offers this, and Spintel’s mobile, 4G and 5G services stay on CGNAT with no opt-out.
• Use IPv6. Global IPv6 addresses need no NAT, so a device can be reachable directly if your ISP provides IPv6 and you allow the traffic in your router’s firewall. Trade-off: the other side needs IPv6 too, and IPv4-only networks still can’t reach you. Our IPv6 address tool expands and compresses addresses when you’re writing firewall rules.
• Use a VPN that offers port forwarding. A standard VPN changes the address you’re seen as but opens no inbound ports. Only a provider with port forwarding accepts traffic on its server and passes it down your tunnel. Trade-off: a monthly cost, extra latency, and an exit address that risk checks may label as VPN.
• Use a tunnel or relay service. Your device connects out to a relay that accepts inbound traffic on your behalf. It works through any NAT, because the connection starts on your side. Trade-off: a third party carries your traffic, and some services limit protocols or bandwidth.
• Move to a business plan with a static IP. It costs more, but you get a public address that stays yours, which suits servers and remote access.

After any change, test it. Confirm your router’s WAN IP now matches the public IP a lookup shows, set up the forward, then use the port checker to see whether the port answers from the internet. If the WAN IP still starts with 100.64 to 100.127, the change hasn’t reached your line yet.

How common is CGNAT?

In a 2016 measurement study (Richter et al., “A Multi-perspective Analysis of Carrier-Grade NAT Deployment”, ACM IMC 2016), more than 90% of cellular networks and 17–18% of fixed “eyeball” networks used CGN. Those are shares of networks, not users, and the data is from 2016.

Read the figures with care. An “eyeball” network here is an autonomous system that serves end users, and one counted as using CGN may put only some of its customers behind it. The study combined several methods, including a week-long BitTorrent DHT crawl from March 2016, and the authors say that method should be viewed as a lower bound.

We couldn’t find a current, primary source for the share of users behind CGNAT, so we won’t give one. Provider pages show the pressure, though. Aussie Broadband says its IPv4 pool “has been consumed” and that buying more gets more expensive each time. Many fixed-wireless, satellite and mobile providers use CGNAT too.

The long-term answer is IPv6. The IESG note on RFC 6598 called the shared block an operational expedient and reaffirmed the commitment to IPv6.

Frequently Asked Questions