Behind CGNAT: how to get a public IP on your own router

Why port forwarding stops working on a shared IPv4 address, how to tell whether your connection has one, and the four ways around it, with their limits.

6 min read · Updated 19 October 2026

You set up port forwarding on the router, open the port in the firewall, and nothing from outside ever arrives. On many home and mobile connections in Luxembourg and Belgium this is not a configuration error: the address your router gets from the ISP is not a public one.

What CGNAT is

IPv4 ran out of addresses years ago. To keep connecting new customers, ISPs put many of them behind one shared public address and translate in the middle. This is called carrier-grade NAT, or CGNAT. Your router still does its own NAT for your home network, so there are two layers of translation between your devices and the internet. Outbound connections work. Inbound ones have nowhere to go, because a packet arriving at the shared address could belong to any of the hundreds of customers behind it, and the ISP's translator does not know yours is the one that wants it.

Port forwarding, dynamic DNS, a VPN server at home, a media server that friends connect to, remote access to a camera or NAS: all of these need an inbound connection, and all of them fail behind CGNAT.

How to check whether you are behind it

1. Compare addresses.Log in to your router and note the WAN or internet address it reports. Then open any "what is my IP" site from a device in the network. If the two differ, there is another NAT layer between you and the internet.
2. Look at the router's WAN address.An address starting with 100.64 to 100.127 is from the range reserved for carrier-grade NAT (RFC 6598). 10.x, 172.16 to 172.31 and 192.168.x on the WAN side point to the same thing.
3. Test from outside.Forward a port, then try to reach it from a mobile phone on cellular data, not from your own Wi-Fi. If the router reports the forward is active but nothing arrives, the inbound path is blocked before your router.

A dynamic public address is a different problem. It is public and reachable, it only changes from time to time, and dynamic DNS takes care of that. Dynamic DNS does not help behind CGNAT, because there is no address of yours to point the name at.

The four ways around it

1. Ask the ISP for a public address. Some ISPs will take a customer out of CGNAT on request, sometimes for a monthly fee, sometimes only on a business subscription. When it is available this is the cleanest fix, because nothing changes in your setup, so ask the ISP first.

2. Use IPv6. Most ISPs that use CGNAT for IPv4 also give out a public IPv6 prefix, and IPv6 has no NAT at all. If everyone who needs to reach you has IPv6 (most mobile networks do), you can expose services on IPv6 only. The limit is the other side: a visitor on an IPv4-only network cannot reach an IPv6-only service.

3. Host the service elsewhere. If the service does not have to run at home, run it on a server with a public address and keep the home network private. A small VPS comes with a public IPv4 and IPv6 address and is the right answer for a website, a mail server or a VPN endpoint.

4. A tunnel from a provider that has public addresses. Your router opens an outbound VPN connection to a server that does have public space, and the provider routes a public address through that connection back to you. Outbound connections work behind CGNAT, so the tunnel comes up; once it is up, traffic for the public address flows down it to your router, which then forwards ports as usual. This keeps the hardware at home and gives it a real address.

What a tunnel does and does not do

The NovaNode IP Tunnel is option 4: a WireGuard tunnel from our network in Luxembourg that routes a fixed IPv4 address and an IPv6 prefix to your router or server. Before choosing a tunnel, from us or from anyone else, you should know the following:

• Your side initiates.Only outbound UDP to the endpoint is needed, so it works behind CGNAT. If your ISP blocks or throttles UDP, the tunnel will not come up or will perform badly; that part is between you and your ISP.
• All traffic for the public address goes through the tunnel, in both directions. Your upload speed at home becomes the download speed of whoever connects to you.
• The address belongs to the provider.Geolocation says Luxembourg, the abuse contact is the provider's, and the address returns to the provider when you cancel. Reverse DNS is set on request.
• It is a single path.Our tunnel runs on one endpoint, best effort, with no SLA; a redundant setup with a second endpoint is an add-on on request. If the tunnel is down, the public address is down.
• Mail is restricted.Outbound port 25 is closed by default and opened after review. Most other ports are forwarded as they are.
• Fair use applies.Capacity is shared; what counts as fair use is in the product terms, and a dedicated commitment can be quoted.
• No BGP, no AS number needed.The address is routed statically to the tunnel. If you do want to announce your own prefixes, that is a different product: see What a sponsoring LIR does.

What a WireGuard configuration for this looks like, and how a quote works, is on the IP Tunnel page. For a setup you run yourself on a VPS, the same idea works with any WireGuard-capable router and the VPS's own address.

Which option, in practice

• Need one or two ports reachable from outside, ISP offers a public IP for a small fee: option 1.
• Only you and your own devices need to get in, all of them on mobile or modern connections: option 2, IPv6 only, at no cost.
• The service does not need to be at home: option 3, a VPS.
• The hardware must stay where it is and IPv4 visitors must reach it: option 4, a tunnel.

Did this not solve it? Open a ticket and tell us what you tried.