---
title: "What Is CGNAT? How to Check and Get Out of It"
description: "CGNAT is when your ISP shares one public IP address among many subscribers. Learn how to check whether you are behind CGNAT and the ways to get out of it."
url: https://proxynet.io/blog/what-is-cgnat
date: 2026-09-19
author: "Enver Kaya"
category: "Proxies"
lang: en
---

# What Is CGNAT? How to Check and Get Out of It

You logged in to your router, set up port forwarding and checked the rule again and again, yet you still cannot reach your security camera from outside. Or your console reports a strict NAT type and you cannot join the game your friend is hosting. Ask on a forum and the answer is nearly always the same: "You are behind CGNAT, call your ISP and ask them to take you off it." That answer is usually right, but it does not tell you what CGNAT is, whether your line really has it, or what exactly to ask your provider for.

This post explains in plain language what CGNAT is, why internet providers use it and how it works. Then it shows how to test whether you are behind CGNAT without installing anything. It covers the consequences, such as port forwarding, NAT type, remote access and the verification screens a shared IP can trigger, and ends with the ways out of CGNAT.

> **Note: Short answer**
>
> CGNAT (Carrier-Grade NAT, address translation at the carrier level) means your internet provider lets many subscribers use a single public IP address at the same time. Your router does not reach the internet with a public address of its own; it goes out from behind a shared device in the provider's network. To check, compare the **WAN IP address** in your router's admin page with the address shown on a "what is my IP" site: if the two differ, or the router's address starts anywhere from `100.64` to `100.127`, you are behind CGNAT. It does not affect browsing; it blocks port forwarding, hurts NAT type in games and prevents access to your home from outside. To get out, you need to ask your provider to move you off CGNAT or to give you a static IP service.

## What is CGNAT?

Two terms first. An **IP address** is the address of a device connected to the internet; the sites you visit send their replies to it. **NAT** (network address translation) is the job your home router has been doing for years: your phone, computer and TV use private addresses such as `192.168.1.x` inside the house, and the router takes all of them to the internet with one public address. In that setup the public IP address belongs to your home, that is, to your router.

CGNAT is the same job done once more, one level up, in the provider's network. The provider does not give your router a public address; it gives it an address that is valid only inside its own network. Your traffic, and the traffic of the other subscribers attached to the same device, passes through a large NAT device in the provider's core and reaches the internet with that device's public address. [RFC 6888](https://www.rfc-editor.org/rfc/rfc6888), published by the body that writes internet standards, defines CGNAT in just this way: a NAT function that shares the same IPv4 address among several subscribers and is not managed by the subscriber.

**CGN**, **CGNAT** and **NAT444** are names for the same method. A "CGNAT pool" is the group of subscribers sent to the internet with a shared address. A "CGNAT IP" is the address the provider gives your router, which is not valid on the internet by itself.

## Why do internet providers use CGNAT?

The reason fits in one sentence: IPv4 addresses have run out. IPv4 has about 4.3 billion addresses, and that is not enough for a world where every phone and TV is online. RIPE NCC, the registry that hands out addresses in Europe, the Middle East and Türkiye, announced that it [allocated its last IPv4 addresses in November 2019](https://www.ripe.net/manage-ips-and-asns/ipv4/ipv4-run-out/). Since then, providers that want new addresses are placed on a waiting list.

A provider whose subscriber count grows while its address stock does not has to share the addresses it holds. CGNAT is the method for that sharing. A subscriber who browses the web and watches video does not notice, because in those activities you start the connection. The trouble appears in tasks where the connection has to start from outside and come towards you. IPv6, the permanent fix, has no address shortage; we covered the differences in [IPv4 vs IPv6 Proxies](/blog/ipv4-vs-ipv6-proxy).

## How does CGNAT work?

When you open a site, your request goes through two separate translations:

1. Your phone sends the request to the router with its private home address (for example `192.168.1.25`).
1. The router replaces the source address with its own WAN address. Under CGNAT this is not a public address but an internal one given by the provider, such as `100.72.14.8`.
1. The request reaches the CGNAT device in the provider's network. The device replaces the source address again, this time with a real public IP address, and reserves a free **port** number on that address for the request.
1. The site sees the request as coming from that public address and sends its reply there.
1. The CGNAT device looks at its table, finds that this port on this address was reserved for a given subscriber, and forwards the reply to your router. The router delivers it to the right device in the house.

The port here is the number that tells apart the subscribers sharing one address. An IP address has 65,535 ports, and the CGNAT device divides them among subscribers. RFC 6888 requires that the provider be able to limit the number of ports assigned per subscriber. We explained the idea of a port in the "what does opening a port mean" section of [TCP vs. UDP](/blog/tcp-vs-udp).

There is a dedicated block for the internal address the provider gives your router: `100.64.0.0/10`, which runs from `100.64.0.0` to `100.127.255.255`. In 2012, [RFC 6598](https://www.rfc-editor.org/rfc/rfc6598) set this block aside for one purpose only, numbering the links between the CGNAT device and subscriber routers. In IANA's [special-purpose address registry](https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml) it is listed as "Shared Address Space" and it is not routed on the internet. Some providers use classic private addresses such as `10.x.x.x` instead of this block; the result is the same.

## What is the difference between a normal connection and CGNAT?

| Feature | Connection with a public IP | Connection behind CGNAT |
|---|---|---|
| Router's WAN address | A public address valid on the internet | The provider's internal address (`100.64` - `100.127` or `10.x`) |
| Address shown on a "what is my IP" site | Same as the router's address | Different from the router's address |
| Port forwarding on the router | Works | The rule is saved but cannot be reached from outside |
| NAT type on a console | Can be open or moderate | Strict most of the time |
| Direct access to a camera, NAS or home server | Possible | Not possible (the vendor's cloud app still works) |
| The address's history in the eyes of websites | Your own behaviour | The behaviour of everyone sharing the address |

## How do you check whether you are behind CGNAT?

The test is nothing more than comparing two addresses.

1. **Open your router's admin page.** On a device connected to the router by cable or Wi-Fi, type `192.168.1.1` into the browser's address bar (on some routers `192.168.0.1` or `192.168.2.1`). The username and password are usually printed on the label under the router.
1. **Find the WAN IP address.** Menu names change from model to model; look at the page called **Status**, **Device Info**, **Internet** or **WAN**. The line you want is labelled "WAN IP address", "IP address" or "IPv4 address". Write it down.
1. **Look at the address the outside world sees.** On a device in the same network, search for "what is my IP" and open any of the sites in the results. If a VPN or a proxy is on, turn it off first, or you will see its address instead.
1. **Compare the two.** If the addresses match, you have a public IP address and you are not behind CGNAT. If they differ, there is one more device between you and the internet translating your address.

The numbers the WAN address starts with also give you a clue:

| WAN address on the router | What it means |
|---|---|
| Between `100.64.x.x` and `100.127.x.x` | The block reserved for CGNAT. You are behind CGNAT |
| `10.x.x.x` | Very likely CGNAT (the provider uses classic private addresses) |
| `192.168.x.x` or `172.16.x.x` - `172.31.x.x` | Your router may sit behind another router or behind a building, campus or dormitory network. That is double NAT, not CGNAT; ask whoever runs that network first |
| None of the above, and the same as on the site | A public IP address. No CGNAT |

There is no need to run this test on a phone's mobile data. Mobile networks have far more subscribers than addresses, so mobile internet works with CGNAT almost all the time.

### Advanced: checking from the command line

If you cannot get into the router's admin page, on Windows type `cmd` into the **Start** menu, open Command Prompt and run this command:

```bash
tracert -d -h 3 1.1.1.1
```

The command lists the first three stops your request passes through. The first line is your router (something like `192.168.1.1`). If the second or third line shows an address between `100.64` and `100.127`, or one starting with `10.`, your traffic is passing through the provider's internal network, which is a strong sign of CGNAT.

## What does CGNAT affect?

Every effect of CGNAT rests on one rule: **connections you start work, connections that start from outside towards you do not.** The CGNAT device has no way of knowing who should receive a request that has no entry in its table, so it drops it.

### Port forwarding does not work

A port forwarding rule on your router only concerns traffic that gets as far as your router. Under CGNAT an incoming request never reaches it, because the public address lives on the provider's device, not on your router, and you have no right to write rules there. That is why a port checker site says "closed" even though you opened the port; run the WAN address test before you go hunting through settings.

### NAT type in games turns strict

Consoles and some PC games try to connect players directly to each other. Reaching a console that sits behind two layers of NAT is hard, so the NAT type shows as "Strict" or "Type 3", and hosting a game or joining voice chat becomes difficult. [RFC 7021](https://datatracker.ietf.org/doc/html/rfc7021), which summarises joint lab tests run by cable operators, records that two consoles on the same provider, behind a CGNAT device working with a single public address, could not connect to each other, and that internet phone calls made without an intermediary server and direct torrent seeding did not work either. You can find the console-side settings in our [NAT type](/blog/nat-type) post and latency problems in [How to Fix Ping and Packet Loss in Online Games](/blog/fix-ping-packet-loss-gaming).

### Access to your home from outside is cut off

A security camera recorder, a NAS, a game server at home, remote desktop and your own VPN server all wait for a connection coming from outside. Behind CGNAT you cannot reach any of them directly. The camera vendor's cloud app keeps working, because there the camera is the one that starts the connection.

### IP-based authorisation becomes unreliable

Some services work on the logic of "accept requests only from this IP address": marketplace APIs, server firewalls, the IP whitelist in proxy dashboards. Behind CGNAT two problems appear. Your address changes often and the list entry goes stale. More importantly, the address you put on the list is not yours alone; other subscribers who share it can walk through the same door. So when you use a proxy from behind CGNAT, connect with a username and password instead of an IP whitelist; we explained the difference between the two methods in [Proxy Authentication: User:Pass vs IP Whitelist](/blog/proxy-authentication-methods). For the API side, see our post on a [static IP for API access](/blog/static-ip-for-api-access).

## Why does a shared IP get you blocks or verification screens?

Sites first recognise a visitor by IP address. If too many requests arrive from one address in a short time, if spam is sent from it, or if failed logins pile up, the site starts treating that address with caution: it shows a verification screen, slows requests down or restricts the address for a while. The site has no way of knowing how many people are behind the address when it does this.

That is where the trouble with a shared IP begins. If one of the subscribers using the same public address is hammering a site with an automated program, the site flags the address and you get the same verification screen without having done anything. Even when nobody misbehaves, many people visiting the same site from one address can make the total number of requests look too high for a single household. Dormitories, cafes, office networks and shared VPNs work by the same mechanism.

We covered the places where this mechanism shows up, and the specific fix for each, in separate posts:

- On YouTube: [the "confirm you're not a bot" error](/blog/youtube-not-a-bot-error)
- On Google Search: [the unusual traffic error](/blog/google-unusual-traffic-error)
- On Instagram: [the Instagram IP ban and open proxy error](/blog/instagram-ip-ban)
- On sites that use Cloudflare: [Error 1015](/blog/cloudflare-error-1015)
- On email and security lists: [what an IP blacklist is](/blog/ip-blacklist)

Most restrictions are temporary; waiting, and not reloading the page over and over, is usually enough. When you power-cycle the router you may land on another public address from the pool; we gathered the methods in [how to change your IP address](/blog/how-to-change-ip-address). If your account was restricted unfairly, use the platform's appeal form. If the problem keeps coming back, the lasting fix is to move to an address that is not shared, as described below. Trying to get around a ban a platform has issued is against its terms and puts your account at greater risk.

### What is CGNAT logging?

When many people use one public address at the same time, the question "who connected from this address at that hour" cannot be answered with the address alone. For that reason providers keep a record of the CGNAT device's table: which subscriber was given which public address and which port at which moment. RFC 6888 lists the content of this record as the subscriber identifier, the public address, the port, the protocol and a timestamp. [RFC 6302](https://datatracker.ietf.org/doc/html/rfc6302), which is addressed to websites, recommends for the same reason that servers log not only the visitor's IP address but also the source port and a timestamp accurate to the second.

## How do you get out of CGNAT?

CGNAT is done in the provider's network, so it cannot be turned off with a router setting, by changing DNS or with a program. These are the ways out:

1. **Ask your provider to take you off CGNAT.** Call customer service or open a request in the online account portal. Say it plainly: "My line is behind CGNAT and I cannot use port forwarding; I would like a public IP address." Some providers do this free of charge, others offer it only as a paid add-on.
1. **Get a static IP service.** A fixed address supplied for a monthly fee is always a public address, so it is outside CGNAT. If you run a camera, a server or IP-based authorisation, this is the cleanest fix. We explained how it differs from a dynamic public IP in our [static IP vs dynamic IP](/blog/static-ip-vs-dynamic-ip) post.
1. **Use IPv6 if you have it.** IPv6 has no address shortage, so every device gets its own public address and CGNAT does not come into play. If your provider gives you IPv6, and both the device you want to reach and the network you connect from support IPv6, outside access can be set up this way.
1. **If direct access is not a must, use an intermediary service.** The camera vendor's cloud app, or tunnel services that start the connection from the home outwards, are not affected by CGNAT.

How providers handle the request differs from country to country. In Türkiye, for example, many home lines sit behind CGNAT, and the subject is common enough that forums have a set phrase for it, "getting out of the CGNAT pool". Subscribers there call customer service and ask to be taken out of the pool; depending on the provider and the plan, the move is either made free of charge or tied to a paid static IP service. The conditions change over time, so ask your own provider about the current terms rather than relying on old forum threads.

Once the change is made, power-cycle the router and repeat the test. If the two addresses match, you are out of CGNAT and your port forwarding rules now work.

## How are CGNAT and proxies related?

A proxy is an intermediary server that goes out to the internet on your behalf from another address, and it changes only the address of the connection going from you outwards. It does not open ports to your home, does not change your console's NAT type and does not give you outside access to your camera. The fix for those lies with your provider. Products such as [Gaming Proxy](https://proxynet.io/gaming-proxy) change the route to the game server and the address it sees; they do not solve a NAT type problem.

The real counterpart of CGNAT in the proxy world is the mobile proxy. In mobile networks a large number of real subscribers sit behind one public address at the same time. If a site blocks that address, it also blocks every real customer using it at that moment. That is why sites tend to be more tolerant of mobile carrier addresses. This is the trust mechanism behind [Mobile Proxy](https://proxynet.io/mobile-proxy); the details are in [What are Mobile Proxies?](/blog/mobile-proxy-101) and [residential proxies vs mobile proxies](/blog/residential-proxies-vs-mobile-proxies).

The opposite need exists as well: if your work requires you to go out with the same unshared address every time (for example to have it added to an API's IP list), having your home line behind CGNAT is not an obstacle. [ISP Proxy](https://proxynet.io/static-isp-residential-proxy) give you an address that is reserved for you and does not change; since you start the connection, CGNAT does not affect this traffic. Our [ISP proxy vs residential proxy](/blog/isp-vs-residential-proxy) post explains what sets this type apart.

## Common mistakes

- **Resetting or replacing the router.** The problem is in the provider's network, not in the router. A new router gets the same internal address.
- **Trying to get out of CGNAT by changing DNS.** DNS only turns site names into IP addresses; it does not change the address you are given.
- **Assuming a VPN ends CGNAT.** A VPN changes your exit address, but that address is shared too, and most VPNs do not open a port for incoming connections.
- **Mistaking double NAT for CGNAT.** If your router's WAN address starts with `192.168`, the device you are behind is most likely a second router in the building or the house. Check this before calling your provider.

## Decision guide

| Your need | Recommendation |
|---|---|
| Strict NAT type on a console, you cannot host games | Ask your provider to take you off CGNAT, then move on to the console settings |
| Outside access to a camera or NAS | Use the vendor's cloud app if it is enough; if not, ask for a public or static IP |
| Having an address added to an API or firewall IP list | A static IP, or a fixed proxy address reserved for you |
| Frequent verification screens because of a shared address | Wait and restart the router; if it keeps happening, ask for a public IP |

## Frequently asked questions

### Does CGNAT slow down your internet?

Not in everyday use. Your traffic passes through one extra device; if that device is overloaded, latency can rise, but that is a capacity problem on the provider's side. If your ping is high, look at Wi-Fi, line quality and distance to the server first.

### Is CGNAT secure, and does it improve security?

Since no connection can be opened from outside towards you, the devices in your home cannot be scanned directly from the internet; that is a small side benefit. CGNAT is not a security product, though; it does not stop a connection you start to a malicious site.

### Does getting out of CGNAT cost money?

It depends on the provider and the plan. Some providers move you to a dynamic public IP free of charge on request, others take you out only with a monthly paid static IP service. Ask your own provider about the current terms; information on forums may be out of date.

### Will my IP address be fixed once I am out of CGNAT?

No. Leaving CGNAT gives you a public address, but that address can stay dynamic and change when the router reconnects. For port forwarding and NAT type that is enough. If the address must never change, you need a static IP service as well.

### Can you get out of CGNAT on mobile internet?

On consumer mobile lines, in practice no; mobile networks are built on CGNAT. This is also why the NAT type comes out strict when you play over a phone's hotspot.

### Can I use a proxy behind CGNAT?

Yes. You start the connection to the proxy, so CGNAT does not interfere with this traffic. Just connect with a username and password for authentication instead of putting your shared, changing address on an IP whitelist.

## Summary

CGNAT is providers sharing one public address among many subscribers because IPv4 addresses have run out. If the WAN address on your router differs from the address you see on a "what is my IP" site, you are behind CGNAT. It does not affect browsing; it breaks port forwarding, NAT type on consoles, access to your home from outside and IP-based authorisation. The fix is with the provider, not in the router: ask to be taken off CGNAT, for a static IP or for IPv6. If your work requires going out with the same address every time, or working with mobile carrier addresses, take a look at our [proxy services](/proxy).