What is CGNAT? Carrier-grade NAT explained

Short answers

How carrier-grade NAT works

Your home router already performs NAT: devices on your network use private addresses and leave through one public address. With CGNAT the provider adds the same kind of translation in its own network. Your router or phone receives an internal address, and a translator at the provider maps each outbound connection to a public IPv4 address and source port.

Because the mapping includes the port, one public address can carry connections from many subscribers at once. A home connection behind CGNAT is therefore often translated twice: once by your router and once by the provider, a layout sometimes called NAT444. The translator keeps the mapping while the connection is active and can reuse the public port afterwards.

The shared range exists so that a provider’s internal addresses cannot collide with the private range a customer already uses at home. RFC 6598 asks that it be used only in provider networks with CGN, not as an extra private range. A provider may still choose another internal range, so an address outside 100.64.0.0/10 does not rule CGNAT out.

Why providers and mobile carriers use it

The central IPv4 free pool ran out in 2011, and the regional registries now have little or no new IPv4 space to allocate. A provider that adds subscribers faster than it can obtain public addresses can either share addresses through CGNAT, move traffic to IPv6, or both. Most do both: IPv6 for services that support it and CGNAT for the IPv4 remainder.

Mobile networks are the clearest case. Phones mostly make outbound connections, change cells and reconnect often, so a carrier can translate their IPv4 traffic without most subscribers noticing. Fixed-line broadband, fibre and satellite providers use CGNAT too, particularly for newer or lower-cost plans.

What CGNAT changes for you

A shared public address

Websites see the translator’s public address, which other subscribers can be using at the same moment. An address alone does not identify one household or one phone.

No unsolicited inbound connections

Port forwarding, hosting a game or server, remote access to a home camera and some direct device-to-device features need an inbound path. Behind CGNAT that path ends at the provider unless it offers port mapping.

Shared limits and reputation

A site that rate-limits or challenges a public address applies that decision to everyone translated to it. You can receive a challenge caused by someone else’s traffic.

Changing public addresses

The public address for your next connection can differ from the last one, because the translator chooses a mapping per connection or per session. A lookup taken a minute ago may not describe the current connection.

Coarse location

Geolocation databases often place a translator’s address at a provider gateway or region rather than near the subscriber. The wrong-country guide explains why lookups disagree.

IPv6 avoids most of this: devices normally receive globally routable IPv6 addresses, so inbound reachability depends on firewalls rather than translation. A service reached over IPv6 sees a different address from one reached over IPv4 on the same connection.

How to tell if you are behind CGNAT

1. Open your router’s status page and note its WAN or internet address. On a phone using mobile data, the network details show the address the carrier assigned to the device.
2. Ask an echo service which public address it sees, for example https://api.portproof.org/v1/echo-ip, from a device on the same connection and without a proxy.
3. Compare them. Equal addresses mean no translation happens beyond your router. Different addresses mean another NAT layer sits between you and the internet.
4. Classify the WAN address. An address in 100.64.0.0/10 is the shared address space defined for carrier-grade NAT. An RFC 1918 address, such as one starting with 10 or 192.168, means another NAT layer that can be your provider or a second router of your own.

# The public address the echo endpoint sees (no proxy configured)
curl --disable --silent --show-error --noproxy '*' --max-time 10 https://api.portproof.org/v1/echo-ip

# The first few hops towards a destination
traceroute -n -m 5 example.com      # macOS and Linux
tracert -d -h 5 example.com         # Windows

# example: a hop in the shared range after your router suggests CGNAT
#  1  192.168.1.1     (your router)
#  2  100.64.x.x      (provider translator side)
#  3  ...
# echo endpoint reports 203.0.113.x

Traceroute is a supporting hint, not proof. Providers can use the shared range on internal links, some hops do not answer, and a CGNAT translator does not always appear as a separate hop. The WAN and public-address comparison is the more reliable check, and your provider can confirm the setup.

Why CGNAT matters for mobile proxies

A mobile proxy routes your request through a carrier modem, so the website sees the carrier’s public address, normally the translated one. That address is shared with real subscribers of the same carrier. Because blocking or limiting it would affect many unrelated people, many services treat carrier addresses as shared rather than as the identity of one user.

That does not exempt traffic from a site’s rules. Rate limits, terms of service and account checks still apply, and a shared address can carry other users’ reputation. Plan permitted, bounded work, and read the mobile and residential comparison for how the two pools differ.

CGNAT also explains two things you may observe on mobile proxies. The exit address can change while the modem stays the same, because the carrier controls the translation. And two different modems can present the same public address, because they share a translator. Compare the address over a few permitted connections with the curl test rather than treating one equal or different result as proof.

If CGNAT gets in your way

• Ask your provider whether a public IPv4 address is available for your plan; some offer it on request or for a fee.
• Use IPv6 for inbound access where your provider, router and the remote side all support it.
• Run an outbound tunnel or VPN to a server you control and accept inbound connections there.
• For remote access to your own devices, prefer a service that connects outbound from your network instead of relying on port forwarding.

References checked 6 November 2026: RFC 6598, shared address space, RFC 6888, CGN requirements and RFC 1918, private address allocation.

What is not allowed

Use these checks on connections you own or administer, and use proxies only for permitted work such as QA, ad verification and market research. See the acceptable-use policy.

Read next