Am I behind CGNAT? How to check, and what it changes

Carrier-grade NAT happens inside your ISP's network, so there's no switch for it on your router. The provider runs one large NAT of its own and puts many customers behind each public IPv4 address. Most people only find out when port forwarding refuses to work, or when websites start treating them as if they were somebody else. Checking takes two addresses and a minute in the router's admin page.

How do I check if I'm behind CGNAT?

Compare two addresses: the WAN (internet) address your router reports, and the public address the rest of the internet sees. If they match, the public IPv4 address is yours alone. If they don't, something between your router and the internet is translating your traffic, and on a home or mobile connection that is usually the ISP's CGNAT.

1. Open your router's admin page. It usually lives at the gateway address, such as 192.168.1.1 or 192.168.0.1, and the label on the router normally prints it. Find the status or internet page and write down the WAN IP (some routers call it Internet IP or IPv4 address).
2. On a device connected to the same network, with any VPN switched off, open the iplogs.com self-check and note the IPv4 address it shows. When you have IPv6 as well, it shows both; use the IPv4 one.
3. Compare the two using the table below.

CGNAT only applies to IPv4. If the self-check shows only an address with colons (IPv6), get your IPv4 address with curl https://ipv4.iplogs.com/v1/ip, or use the traceroute check in the next section.

Can I check for CGNAT without logging in to the router?

Yes, with traceroute. The first hop is your own router. On a CGNAT connection the next hop or two usually carry addresses from 100.64.0.0/10 before the trace reaches ordinary public addresses. Cloudflare's researchers use the same test: an address within 100.64.0.0/10 between the first private hop and the public IP is, in their words, "a strong indicator of CGNAT."

# macOS or Linux: first six hops, no name lookups
traceroute -n -m 6 8.8.8.8

# Windows (Command Prompt)
tracert -d -h 6 8.8.8.8

A CGNAT trace tends to have this shape. The addresses below are made up to show the pattern, not copied from a real connection:

 1  192.168.1.1     1.1 ms    <- your router
 2  100.72.0.1      7.9 ms    <- ISP's shared address space: CGNAT
 3  100.64.12.9     8.6 ms
 4  (public address) 10.2 ms   <- now on the public internet

Read the result with some care. Some ISP equipment doesn't answer traceroute at all, so a hop may show as * * *. A 10.x.x.x address at hop 2 points to double NAT but doesn't prove CGNAT, because, as Cloudflare notes, "ISPs sometimes use private addresses internally without CGNAT." And the absence of 100.64 hops doesn't clear you, since some carriers do CGNAT on private space. When the trace is ambiguous, the router comparison above settles it.

What is the 100.64.0.0/10 address range?

It's the block RFC 6598 reserved in 2012 as Shared Address Space, running from 100.64.0.0 to 100.127.255.255, "designated for Service Provider use with the purpose of facilitating CGN deployment." The same RFC says packets carrying these addresses "MUST NOT be forwarded across Service Provider boundaries," so a 100.64 address only means something inside your ISP's network.

That is why looking one up tells you nothing about where you are. When we sent 100.64.1.1 to the iplogs API, the response came back with no owner, no country, and a single signal saying the prefix isn't announced on the internet (trimmed):

{
  "score": 0.2,
  "verdict": "clean",
  "is_vpn": false,
  "signals": [
    { "type": "ip_unannounced_prefix", "weight": 0.2, "matched": true }
  ],
  "ip_info": { "ip": "100.64.1.1", "asn": "AS0", "org": "", "country": "" }
}

Ignore the score here. The useful part is the empty org and country: the address has no public identity, because only your ISP can route it.

Why does CGNAT matter if my internet works?

For browsing, streaming and video calls it usually doesn't. Outgoing connections work normally. It starts to matter when someone needs to connect in to you, and when your IP address is judged by what other people do with it.

Port forwarding and hosting at home stop working

Your router can forward a port, but the ISP's NAT sits in front of it and has no idea that rule exists, so connections from outside never arrive. Starlink's help page states that its default CGNAT policy "does not allow inbound traffic." That breaks anything where the other side starts the connection: a game or Minecraft server you host, a NAS or camera you reach directly from outside, remote desktop to a home PC.

You share an IP reputation with strangers

Every website sees the same address for everyone behind it. If one customer on your shared IP runs a scraper or has an infected device, rate limits and blocklists catch all of you. Cloudflare measured the effect across its network: CGNAT addresses "are subject to rate limiting three times more often than non-CGNAT IPs," even though their traffic looked more human than average.

A shared address is one of the usual innocent reasons behind constant CAPTCHAs or a high IP fraud score. Lots of users arriving from one address also looks a bit like a VPN exit, so CGNAT comes first in our list of reasons people get flagged as a VPN when they aren't.

Which ISPs use CGNAT?

Mobile networks commonly do, and plenty of fixed-line and satellite providers use it too as IPv4 addresses run short. There is no reliable public list, because ISPs rarely advertise it. Cloudflare notes that "CGNAT is common in mobile networks" and found the heaviest reliance across much of Africa and Central and Southeast Asia, where ISPs hold far fewer IPv4 addresses per user than in North America or Europe.

Starlink is one provider that documents it. Its default IPv4 setup "uses Carrier-Grade Network Address Translation (CGNAT) using private address space from the 100.64.0.0/10 prefix," and a public IPv4 address is an option on its Local and Global Priority plans. For any other ISP, run the test above or ask support whether your plan includes a public or static IPv4 address.

How do I get out of CGNAT?

You can't switch it off yourself, because the translation happens on the ISP's equipment. The simplest route is to ask the ISP for a public IPv4 address. Some providers do it on request, others charge for it or only include it with business or static-IP plans. Starlink lets eligible customers turn on its public IPv4 option from the account dashboard.

If your ISP gives you IPv6, use that for inbound access. CGNAT exists to stretch IPv4, and IPv6 devices can have globally reachable addresses; Starlink, for example, delegates a /56 IPv6 prefix to every dish. You still have to allow the port in the router's IPv6 firewall (Starlink's own router can't, so it suggests a third-party router), and whoever connects to you needs IPv6 too.

The fallback is an outbound tunnel: a small cloud server or a tunnelling service that your machine dials out to, which then gives you a public address to publish. In effect you rent a public IP somewhere else and forward the traffic home. Most VPN apps won't do this unless they offer port forwarding. They swap one shared address for another, often with a worse reputation, and leave you with no inbound ports.

Is CGNAT bad for privacy or security?

Neither much better nor much worse. Websites can't tell you from your neighbours by IP address alone, but your ISP still knows which customer used which connection, because it runs the translation. On security, Cloudflare points out a side effect: since the translated addresses aren't reachable from outside, CGNAT has protected "many home devices that might be vulnerable to compromise."