How CGNAT works
Your ISP assigns your router or device a private address or an address from the shared 100.64.0.0/10 range. A carrier-operated NAT gateway then translates that address before traffic reaches the public internet.
Device → home router → carrier NAT gateway → internetFor each outbound connection, the gateway records a mapping between your internal address and port and a public address and port. It uses that mapping to send response packets back to the correct customer. Many customers can therefore share one public IPv4 address without mixing their connections.
CGNAT vs home NAT
Both systems rewrite addresses, but they operate at different levels.
| Home NAT | CGNAT | |
|---|---|---|
| Operated by | You or your organization | Your ISP or mobile carrier |
| Shared by | Devices on one local network | Many customer connections |
| Port control | Router settings | Usually unavailable to you |
| Main purpose | Connect a private network | Conserve public IPv4 addresses |
Using both creates two translation layers, often called double NAT.
What CGNAT changes
- Inbound connections: Router port forwarding usually can’t cross the carrier gateway, which affects self-hosted servers, cameras and some peer-to-peer applications.
- Shared reputation: Other subscribers use the same public address. Their activity can contribute to an IP block or trigger website rate limiting.
- Connection records: A public IP alone may not identify one subscriber. The ISP generally needs the public source port and timestamp to match a connection to a customer.
- IPv6 traffic: Native IPv6 doesn’t need IPv4 address sharing, though firewall rules can still restrict incoming connections.
CGNAT isn’t a substitute for a firewall. Its stateful mappings often stop unsolicited inbound traffic, but security still depends on the devices, router and ISP configuration.
CGNAT and proxies
Without a proxy, a website sees the carrier gateway’s shared public address. With a forward proxy, the website sees the proxy’s exit address instead. Your CGNAT gateway still handles the outbound connection between your device and the proxy.
CGNAT doesn’t provide proxy features such as location selection or IP rotation. A proxy also doesn’t give you control over the carrier gateway or make local port forwarding available.
FAQ
How do I know if I am behind CGNAT?
Compare your router’s WAN address with the public IP shown by an external IP-checking service. If the WAN address is in 100.64.0.0/10 or a private range and differs from the public IP, upstream NAT is likely, but only your ISP can confirm CGNAT.
Can I port forward through CGNAT?
Usually not through your own router alone. Ask your ISP for a public IPv4 address or a supported port-mapping option, or use IPv6 when both ends support it.
Does CGNAT affect online gaming?
It can. Most outbound game connections work, but peer-to-peer hosting, voice features and consoles may report strict NAT because unsolicited inbound connections can’t reach your device.