Guides · Networking basics

What is CGNAT, and why can't I port-forward?

Written by Aldo · blue-team threat hunter
Last updated November 9, 2026 · 4 min read

You set up port forwarding for a game server, a camera or a home server, exactly as the guide said. From outside, nothing connects. The router isn't broken. Your connection may simply not have a public address of its own.

What CGNAT is

There aren't enough IPv4 addresses for every home and phone. Your router already solves this inside your home: all your devices share one public address, and the router (with NAT, network address translation) keeps track of which device each conversation belongs to.

CGNAT does the same one level up. Your provider's equipment shares one public address among many customers, and your router gets a private address from the provider instead. Outgoing connections work normally: browsing, streaming and calls are fine. Incoming connections are the problem. When someone outside connects to the shared public address, the provider's NAT has no idea which of its customers they want, so it drops the connection. Port forwarding on your router can't change that, because the connection never reaches your router.

Mobile networks use CGNAT almost everywhere. Many fibre and cable providers use it too, particularly newer ones and those that give customers native IPv6 with IPv4 tunnelled through a shared gateway (a set-up called DS-Lite).

A worked example: the address range that gives it away

Providers usually number the customer side of CGNAT from a block reserved for exactly this purpose, 100.64.0.0/10. We put it into iplover's subnet calculator:

So the rule of thumb: if your router's internet address starts with 100. and the second number is between 64 and 127, you're almost certainly behind CGNAT. Addresses from 100.0 to 100.63 and from 100.128 upwards are ordinary public ones; only that middle block is shared space.

Check your own connection in two minutes

1. Find your router's internet address. Open the router's admin page (often 192.168.1.1, 192.168.0.1 or fritz.box; our router guide shows how to find it) and look for “WAN”, “Internet” or “Online status”.
2. Find your public address. Open iplover's homepage; the big address at the top is what the internet sees.
3. Compare them.

A second clue is the route out. On Windows run tracert -d 8.8.8.8, on macOS or Linux traceroute -n 8.8.8.8. If the hop right after your router has a 100.64–100.127 address, that's typically the provider's NAT. (Some providers use that range inside their network for other reasons, so treat this as a hint, not proof.)

Ways around it

UPnP and similar automatic port-opening features only talk to your own router, so they can't punch through your provider's NAT either.

What CGNAT means for your address

Behind CGNAT, the public address websites see is shared with other customers at the same moment. That has side effects: one customer's misbehaviour can get the shared address blocked or flagged, sites may show you more captchas, and the address on iplover's homepage isn't “yours” in any lasting sense. It also means an address in someone's log can't be tied to a single household without the provider's records of which customer used which port at which second.