Netz5 Min. Liesen
Am I behind CGNAT? How to tell in five minutes, and what to do about it
Port forwarding does nothing, your router's WAN address starts with 100.x, and the ISP says everything is fine. How to confirm you are behind carrier-grade NAT and the four realistic ways out.
Dësen Artikel ass nach net iwwersat; d’englesch Versioun gëtt ugewisen.
You have set up port forwarding, opened the firewall and started the service, and nothing arrives from outside. If you are on a home fibre line, a 4G/5G router or a cheap business connection in Luxembourg or Belgium, the most likely reason is that your router never had a public address in the first place.
What CGNAT is
IPv4 addresses ran out years ago. To keep signing up customers, ISPs put many of them behind one shared public IPv4 address and translate in the middle. This is carrier-grade NAT, CGNAT for short. Your router still does its own NAT for the devices at home, so there are two layers of translation between your laptop and the internet. Outbound connections work, so most people never notice. Inbound connections have nowhere to go, because a packet arriving at the shared address could belong to any of the hundreds of customers behind it.
The five-minute check
1. Compare the two addresses. Log in to the router and note the WAN (internet) address it reports. Then, from a device on the same network, open What is my IP. If the two addresses differ, there is a second NAT between you and the internet, and you have your answer.
2. Look at the router's WAN address. 100.64.0.0 to 100.127.255.255 is the range set aside for carrier-grade NAT (RFC 6598), so an ISP that uses it is telling you directly. 10.x, 172.16–172.31 and 192.168.x on the WAN side mean the same thing. Anything else is a real public address.
3. Test a port from outside. Forward a port to something that answers, then try to reach it from a phone on mobile data, not from your own Wi-Fi. If the router says the port is forwarded and nothing arrives, the inbound path is blocked before your router.
Two situations look like CGNAT but are not:
- A dynamic public address.The address is public and reachable, it only changes every few days, and dynamic DNS handles that. Dynamic DNS cannot help behind CGNAT, because there is no address of yours to point the name at.
- A router with "DMZ" or "bridge mode" on.Those change which device the public address lands on. They cannot create a public address that the ISP never gave you.
Mobile and fixed-wireless connections are almost always behind CGNAT. Fibre and cable depend on the ISP and sometimes on the tariff.
The four ways out
Ask the ISP. Some will move a customer out of CGNAT on request, sometimes for a small monthly fee, sometimes only on a business subscription. When this is possible it is the cleanest fix, because nothing in your setup changes. Ask before trying anything else, and use the words "public IPv4 address" rather than "CGNAT", which the first-line support may not know.
Use IPv6. Most ISPs that CGNAT their IPv4 also hand out a public IPv6 prefix, and IPv6 has no NAT. If everyone who needs to reach you has IPv6 (most mobile networks do), you can publish the service on IPv6 only, at no cost. The limitation is on the other side: a visitor on an IPv4-only network cannot reach it. IPv6 check tells you whether a domain is reachable that way.
Move the service. If the service does not have to run at home, run it on a server that has a public address and keep the home network private. A small VPS comes with a public IPv4 and, on request, IPv6, and is the right answer for a website, a mail server or a VPN endpoint.
Tunnel a public address to your router. Your router opens an outbound WireGuard connection to a provider that has public addresses; the provider routes one of them down that tunnel to you. Outbound connections work behind CGNAT, so the tunnel comes up, and once it is up, inbound traffic for the public address arrives at your router and you forward ports as usual. The hardware stays at home and gets a real address. The NovaNode IP Tunnel works this way.
Before you pick the tunnel
A tunnel is the right choice when the hardware must stay where it is and IPv4 visitors must be able to reach it. Whoever you buy it from, the same things apply:
- Your upload speed at home becomes the download speed of whoever connects to you. Everything for that address goes through the tunnel, both ways.
- The address belongs to the provider. Geolocation points at the provider's location, the abuse contact is theirs, and the address goes back when you cancel.
- There is only one path. If the tunnel is down, the address is down. Ask what the provider promises about that; ours is best effort without an SLA, and a second endpoint is an add-on.
- If your ISP throttles or blocks UDP, a WireGuard tunnel will perform badly or not come up at all. That part is between you and the ISP.
- Mail is the exception. Most providers, us included, keep outbound port 25 closed until they have looked at what you intend to send from it.
Which one, in practice
- You need one or two ports and the ISP sells a public IP for a few euros: ask the ISP.
- Only you and your own devices need to get in: IPv6 only, free.
- The service does not need to be at home: a VPS.
- The hardware stays where it is and IPv4 visitors must reach it: the tunnel.
The longer version of this, including what a WireGuard configuration for the tunnel looks like, is in the help centre: Behind CGNAT: how to get a public IP on your own router.
NovaNode · 21.10.2026