CGNAT: When the provider does not give you your own IP address

In short: With carrier-grade NAT many customers share one public IPv4 address, so servers at home cannot be reached from the internet.

In more detail: Public IPv4 addresses are scarce. Many providers therefore use CGNAT (carrier-grade NAT, also “DS-Lite” on some cable and fiber connections): the customer’s router only gets a private address from the provider (often from 100.64.0.0/10), and the provider translates many customers onto a few public addresses.

In Depth

Difference from normal NAT

At home your router already translates private addresses (192.168.x.x) to one public one. With CGNAT this happens once more at the provider (“double NAT”). From outside, your connection cannot be addressed directly; a port forward in your own router has no effect because the provider’s router in between does not forward the connection.

How to tell

Compare the WAN address in the router with the address a web page (“What is my IP?”) shows. If they differ, or the WAN address lies in the range 100.64.0.0 to 100.127.255.255, you are behind CGNAT. With DS-Lite the connection only receives an IPv6 address, and IPv4 traffic is carried through a tunnel to the provider.

Consequences

• Home servers, game hosting, remote access to cameras or NAS by port forwarding do not work.
• Some peer-to-peer programs and games have connection problems.
• More customers behind one address: shared addresses can be blocked because of other people’s abuse.
• Answering “who was it?” is more laborious for providers.

Ways out

• Use IPv6: with an IPv6 prefix every device is directly reachable (with suitable firewall rules).
• Book a public IPv4 address from the provider or switch to a tariff without CGNAT.
• VPN tunnels (for example WireGuard to a rented server) or services such as Tailscale or Cloudflare Tunnel, which use outgoing connections and therefore need no port forward.

See also: NAT, IPv6, WireGuard, IP addresses