CGNAT: hundreds of subscribers, one IP — and why remote access fails
2 min read
What carrier-grade NAT is, why your IP is not really "yours", why port forwarding does nothing, and the ways out.
What is happening
Because IPv4 ran out, ISPs share one public IP among hundreds of subscribers at once; that is CGNAT. From the outside, you and your neighbours are the same address.
The telltale sign: your router's WAN interface shows an address in the 100.64.x.x range while our tool shows a completely different public IP — the layer in between is CGNAT.
What it breaks
Everything inbound: port forwarding does nothing (you can open the door, but the door is not yours), home cameras/NAS cannot be reached directly, self-hosting fails, and some games complain about "strict NAT". Outbound browsing is untouched — which is why most users never notice.
The ways out
In order: ask your ISP for a static/real IP (some provide it free, some for a small fee), use IPv6 (CGNAT is an IPv4 problem; if your ISP provides v6, your home is reachable over it), or run an inside-out tunnel like Tailscale/WireGuard (unaffected by CGNAT and the most practical fix for most home setups).
Our tool demonstrates every concept in this guide on your own connection: five-source location, VPN status, ASN and ISP — free, no signup.
Show my IPFrequently asked questions
How do I know for sure that I am behind CGNAT?
Compare your router's WAN address with the public IP our tool shows: if they differ and the WAN address is within 100.64.0.0–100.127.255.255, you are definitely behind CGNAT.
Does CGNAT hurt security or speed?
Speed impact is usually negligible; not being scannable from outside is even a small side benefit. The issue is reachability, not safety.