What Is CGNAT? How to Detect It and Get Around It

You've set up the port forwarding rule correctly but the port just won't open, your games console reports “NAT type: strict”, or you can't reach your security camera from outside. The most common cause of all three is CGNAT. This guide explains what CGNAT is, why providers use it, how to tell whether your connection is behind it, and what you can do about it.

What Is CGNAT?

CGNAT (carrier-grade NAT) is a technique in which an internet provider shares a single public IPv4 address among dozens or even hundreds of subscribers at the same time. It's also known as CGN or large-scale NAT.

On an ordinary home connection, your router gets a public IP of its own from the provider and translates the private addresses of your devices to that address (NAT). With CGNAT, your router gets an address from the provider's internal network instead of a public one; the translation to a public address happens a second time, on the provider's own equipment. Your traffic therefore passes through two layers of NAT, and the public IP address the internet sees isn't yours alone.

Why Do Providers Use CGNAT?

Because IPv4 addresses have run out. IPv4 offers about 4.3 billion addresses and the regional registries have no free ones left to hand out; providers that need more have to buy them on the transfer market at a high price. Providers with growing subscriber numbers close the gap by sharing the addresses they have through CGNAT. Nearly all mobile carriers and a large share of fixed-line providers use it. The long-term fix is IPv6, which can give every device its own public address.

How Do I Know If I'm Behind CGNAT?

The most reliable method is to compare the address your router received with the address the internet sees:

1. Log in to your router and find the WAN IP address on the “WAN”, “Internet” or “Status” page.
2. Look at your public IP address on the ipadresimne.net home page.
3. If the two addresses are the same, you have a public IP of your own. If they're different, there is another layer of NAT in between; you are most likely behind CGNAT.

The range the WAN address falls in is a clue as well:

Another sign: the port checker always reports the port as closed even though the rule on the router is correct and the service on the device is running.

What Does CGNAT Affect?

Browsing the web, streaming video, video calls and most online games work fine behind CGNAT, because you start those connections. Problems appear when a connection has to start from the outside towards you:

• Port forwarding doesn't work. The incoming connection stops at the provider's NAT device and never reaches your router.
• Remote access: you can't connect directly to a security camera, DVR/NVR, NAS or home server from outside.
• Gaming: consoles report a “strict” or “Type 3” NAT; hosting lobbies and matching with some players gets harder.
• Shared reputation: because of what another subscriber on the same public IP has done, you may see more CAPTCHAs or temporary blocks on websites.
• Location: IP-based location may show the city where the provider's exit point is.

How to Get Around CGNAT

1. Ask your provider for a public IP

This is the cleanest fix. Call customer service and say you want to be “moved off CGNAT” or given a “public IP address”. Some providers do it for free; others only offer it together with a paid static IP. Terms vary by provider and plan; see our static IP guide for details.

2. Use IPv6

If your provider offers IPv6, each of your devices gets its own public IPv6 address and CGNAT drops out of the picture. First check whether your connection supports IPv6 with the IPv6 test. For this to work, the network you're connecting from has to support IPv6 too, and you need to allow the device through your router's firewall.

3. Tunnels and mesh VPNs

With these services the device at home connects out to a server on the internet; since the connection starts from the inside, CGNAT doesn't get in the way. Mesh VPNs such as Tailscale and ZeroTier link your own devices together as if they were on the same network, while reverse tunnels such as Cloudflare Tunnel publish a web service running at home. If you only need to reach your own devices, this is usually the most practical route.

4. A VPN with port forwarding, or your own server

Some VPN providers offer a dedicated port or IP. Alternatively, you can rent a small virtual server (VPS) with a public IP, set up a WireGuard tunnel to it from a device at home and forward incoming connections from the server to your home. It takes more technical know-how but gives you full control.

5. The manufacturer's cloud service

Most cameras and recorders come with a cloud or P2P access feature that works without opening ports. The device connects out to the manufacturer's servers, so it works behind CGNAT as well. It's easy to set up; the trade-off is that your video passes through the manufacturer's infrastructure.

CGNAT vs. Double NAT

If your router's WAN address is a private one such as 192.168.x.x, the provider isn't necessarily the cause. If you've plugged your own router in behind the one your provider supplied, you have double NAT on your network: both devices translate addresses. In that case the fix is in your hands: you can put the provider's router into bridge mode or forward incoming connections on both devices. Our port forwarding guide walks through it. With CGNAT, the second NAT device is in the provider's network and you can't touch it.

Does CGNAT Make You Safer?

Behind CGNAT your devices can't be reached directly from the internet, which adds a screen against unsolicited scans, but it's no substitute for a firewall. Malware and phishing work over connections that you start, and CGNAT does nothing to stop them. Changing your router's admin password, keeping its firmware up to date and using strong passwords on your devices matters with or without CGNAT.